active directory fatal: Access denied for user by PAM account configuration
There is 8 Linux servers configed with SSSD for AD user login auth. Please find the sssd, pam system_auth, password_auth & sshd config file from the attached. But the issue is I can not use all AD user to ssh login server, here is AD user "jsun" for example. Linux local user login is fine. From journal log, I can see below error:
yum reinstall pam completed successfully. But AD user ssh connect to server still showing "Authentication failed". Nothing different.
Journal log is still showing the same error as below:
Dec 18 15:57:12 mertvd1 sshd[16839]: debug1: userauth-request for user shshe service ssh-connection method none [preauth]
Dec 18 15:57:12 mertvd1 sshd[16839]: debug1: attempt 0 failures 0 [preauth]
Dec 18 15:57:12 mertvd1 sshd[16839]: debug2: parse_server_config: config reprocess config len 767
Dec 18 15:57:12 mertvd1 sshd[16839]: debug2: monitor_read: 8 used once, disabling now
Dec 18 15:57:12 mertvd1 sshd[16839]: debug2: input_userauth_request: setting up authctxt for shshe [preauth]
Dec 18 15:57:12 mertvd1 sshd[16839]: debug2: input_userauth_request: try method none [preauth]
Dec 18 15:57:12 mertvd1 sshd[16839]: debug1: PAM: initializing for "shshe"
Dec 18 15:57:12 mertvd1 sshd[16839]: debug1: PAM: setting PAM_RHOST to "mkotst.internal"
Dec 18 15:57:12 mertvd1 sshd[16839]: debug1: PAM: setting PAM_TTY to "ssh"
Dec 18 15:57:12 mertvd1 sshd[16839]: debug2: monitor_read: 100 used once, disabling now
Dec 18 15:57:12 mertvd1 sshd[16839]: debug2: monitor_read: 4 used once, disabling now
Dec 18 15:57:12 mertvd1 sshd[16839]: debug2: monitor_read: 80 used once, disabling now
Dec 18 15:57:20 mertvd1 sshd[16839]: debug1: userauth-request for user shshe service ssh-connection method password [preauth]
Dec 18 15:57:20 mertvd1 sshd[16839]: debug1: attempt 1 failures 0 [preauth]
Dec 18 15:57:20 mertvd1 sshd[16839]: debug2: input_userauth_request: try method password [preauth]
Dec 18 15:57:20 mertvd1 sshd[16839]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=mkotst.internal user=shshe
Dec 18 15:57:20 mertvd1 sshd[16839]: debug1: PAM: password authentication accepted for shshe
Dec 18 15:57:20 mertvd1 sshd[16839]: debug1: do_pam_account: called
Dec 18 15:57:20 mertvd1 be[internal][30312]: Group Policy Container with DN [cn={70638449-FAE7-4C2F-9061-0D9BFBF28DB8},cn=policies,cn=system,DC=internal] is unreadable or has unreadable or m
Dec 18 15:57:20 mertvd1 be[internal][30312]: Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode.
Dec 18 15:57:20 mertvd1 sshd[16839]: Failed password for shshe from 10.175.120.49 port 56450 ssh2
Dec 18 15:57:20 mertvd1 sshd[16839]: fatal: Access denied for user shshe by PAM account configuration [preauth]
Dec 18 15:57:20 mertvd1 sshd[16839]: debug1: do_cleanup [preauth]
Dec 18 15:57:20 mertvd1 sshd[16839]: debug1: monitor_read_log: child log fd closed
Dec 18 15:57:20 mertvd1 sshd[16839]: debug1: do_cleanup
Dec 18 15:57:20 mertvd1 sshd[16839]: debug1: PAM: cleanup
Dec 18 15:57:20 mertvd1 sshd[16839]: debug1: Killing privsep child 16840
Resolution:
Command authconfig --updateall will work.
Actually, it is "account required pam_deny.so" wrongly configed.
update to "account required pam_permit.so", also works
[root@mertvd1 ~]# cat /etc/pam.d/password-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth required pam_tally2.so deny=5
auth required pam_faildelay.so delay=2000000
auth required pam_listfile.so item=user sense=deny file=/etc/security/users onerr=succeed
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
account required pam_tally2.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_deny.so #--->AD USER 被禁止登录
password requisite pam_pwquality.so try_first_pass retry=3 minlen=8 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 reject_username
password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember=13
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session optional pam_oddjob_mkhomedir.so umask=0077
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
[root@mertvd1 ~]# cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth required pam_tally2.so deny=5
auth required pam_faildelay.so delay=2000000
auth required pam_listfile.so item=user sense=deny file=/etc/security/users onerr=succeed
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
account required pam_tally2.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass retry=3 minlen=8 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 reject_username
password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember=13
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session optional pam_oddjob_mkhomedir.so umask=0077
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so