PAM SSSD Allow Local Users
up vote
1
down vote
favorite
I've got a default SSSD configuration with PAM. I can login fine as any LDAP user. However, when I create a local user on a server:
adduser test1
passwd test1
and then try to login as that user I get the following error:
pam_sss(sshd:account): Access denied for user test1: 10 (User not known to the underlying authentication module)
My /etc/nsswitch.conf is this:
passwd: files sss
shadow: files sss
group: files sss
#hosts: db files nisplus nis dns
hosts: files dns
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files sss
netgroup: files sss
publickey: nisplus
automount: files ldap
aliases: files nisplus
sudoers: files sss
Now files is listed as an alternate in nsswitch.conf but it doesn't seem to be looking at the files to authenticate.
How can I allow login as a local user when SSSD is my authentication module?
linux ssh pam
edited Oct 16 '17 at 14:20
Ramhound
19.6k156084
asked Apr 28 '16 at 14:25
user3063045
17819
add a comment |
up vote
1
down vote
favorite
I've got a default SSSD configuration with PAM. I can login fine as any LDAP user. However, when I create a local user on a server:
adduser test1
passwd test1
and then try to login as that user I get the following error:
pam_sss(sshd:account): Access denied for user test1: 10 (User not known to the underlying authentication module)
My /etc/nsswitch.conf is this:
passwd: files sss
shadow: files sss
group: files sss
#hosts: db files nisplus nis dns
hosts: files dns
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files sss
netgroup: files sss
publickey: nisplus
automount: files ldap
aliases: files nisplus
sudoers: files sss
Now files is listed as an alternate in nsswitch.conf but it doesn't seem to be looking at the files to authenticate.
How can I allow login as a local user when SSSD is my authentication module?
linux ssh pam
edited Oct 16 '17 at 14:20
Ramhound
19.6k156084
asked Apr 28 '16 at 14:25
user3063045
17819
1
I ended up just creating an LDAP user to replace the local user
– user3063045
Apr 28 '16 at 18:08
add a comment |
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I've got a default SSSD configuration with PAM. I can login fine as any LDAP user. However, when I create a local user on a server:
adduser test1
passwd test1
and then try to login as that user I get the following error:
pam_sss(sshd:account): Access denied for user test1: 10 (User not known to the underlying authentication module)
My /etc/nsswitch.conf is this:
passwd: files sss
shadow: files sss
group: files sss
#hosts: db files nisplus nis dns
hosts: files dns
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files sss
netgroup: files sss
publickey: nisplus
automount: files ldap
aliases: files nisplus
sudoers: files sss
Now files is listed as an alternate in nsswitch.conf but it doesn't seem to be looking at the files to authenticate.
How can I allow login as a local user when SSSD is my authentication module?
linux ssh pam
edited Oct 16 '17 at 14:20
Ramhound
19.6k156084
asked Apr 28 '16 at 14:25
user3063045
17819
I've got a default SSSD configuration with PAM. I can login fine as any LDAP user. However, when I create a local user on a server:
adduser test1
passwd test1
and then try to login as that user I get the following error:
pam_sss(sshd:account): Access denied for user test1: 10 (User not known to the underlying authentication module)
My /etc/nsswitch.conf is this:
passwd: files sss
shadow: files sss
group: files sss
#hosts: db files nisplus nis dns
hosts: files dns
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files sss
netgroup: files sss
publickey: nisplus
automount: files ldap
aliases: files nisplus
sudoers: files sss
Now files is listed as an alternate in nsswitch.conf but it doesn't seem to be looking at the files to authenticate.
How can I allow login as a local user when SSSD is my authentication module?
linux ssh pam
linux ssh pam
edited Oct 16 '17 at 14:20
Ramhound
19.6k156084
asked Apr 28 '16 at 14:25
user3063045
17819
edited Oct 16 '17 at 14:20
Ramhound
19.6k156084
asked Apr 28 '16 at 14:25
user3063045
17819
edited Oct 16 '17 at 14:20
Ramhound
19.6k156084
edited Oct 16 '17 at 14:20
Ramhound
19.6k156084
edited Oct 16 '17 at 14:20
Ramhound
19.6k156084
19.6k156084
asked Apr 28 '16 at 14:25
user3063045
17819
asked Apr 28 '16 at 14:25
user3063045
17819
asked Apr 28 '16 at 14:25
user3063045
17819
17819
1
I ended up just creating an LDAP user to replace the local user
– user3063045
Apr 28 '16 at 18:08
add a comment |
1
I ended up just creating an LDAP user to replace the local user
– user3063045
Apr 28 '16 at 18:08
1
1
I ended up just creating an LDAP user to replace the local user
– user3063045
Apr 28 '16 at 18:08
I ended up just creating an LDAP user to replace the local user
– user3063045
Apr 28 '16 at 18:08
add a comment |
2 Answers
2
active
oldest
votes
up vote
0
down vote
Sounds strange. You should look in your pam configuration, in
the lines starting with account. I suppose that there is only
pam_sss but not pam_unix.
To find the right pam file scould be tricky, depends on the distribution
you use.
For RHEL based system and SSH it is /etc/pam.d/password-auth
edited Oct 16 '17 at 14:22
Ramhound
19.6k156084
answered May 4 '16 at 12:48
sterni1971
114
add a comment |
up vote
0
down vote
Troubleshooting Authentication, Password Change and Access Control
In order for authentication to be successful, the user information must be accurately provided first. Before debugging authentication, please make sure the user information is resolvable with getent passwd $user or id $user. Failing to retrieve the user info would also manifest in the secure logs or the journal with message such as:
pam_sss(sshd:account): Access denied for user admin: 10 (User not known to the underlying authentication module)
Source of Information
answered Dec 12 '17 at 11:57
Mohit Malviya
1
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1070887%2fpam-sssd-allow-local-users%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
Sounds strange. You should look in your pam configuration, in
the lines starting with account. I suppose that there is only
pam_sss but not pam_unix.
To find the right pam file scould be tricky, depends on the distribution
you use.
For RHEL based system and SSH it is /etc/pam.d/password-auth
edited Oct 16 '17 at 14:22
Ramhound
19.6k156084
answered May 4 '16 at 12:48
sterni1971
114
add a comment |
up vote
0
down vote
Sounds strange. You should look in your pam configuration, in
the lines starting with account. I suppose that there is only
pam_sss but not pam_unix.
To find the right pam file scould be tricky, depends on the distribution
you use.
For RHEL based system and SSH it is /etc/pam.d/password-auth
edited Oct 16 '17 at 14:22
Ramhound
19.6k156084
answered May 4 '16 at 12:48
sterni1971
114
add a comment |
up vote
0
down vote
up vote
0
down vote
Sounds strange. You should look in your pam configuration, in
the lines starting with account. I suppose that there is only
pam_sss but not pam_unix.
To find the right pam file scould be tricky, depends on the distribution
you use.
For RHEL based system and SSH it is /etc/pam.d/password-auth
edited Oct 16 '17 at 14:22
Ramhound
19.6k156084
answered May 4 '16 at 12:48
sterni1971
114
Sounds strange. You should look in your pam configuration, in
the lines starting with account. I suppose that there is only
pam_sss but not pam_unix.
To find the right pam file scould be tricky, depends on the distribution
you use.
For RHEL based system and SSH it is /etc/pam.d/password-auth
edited Oct 16 '17 at 14:22
Ramhound
19.6k156084
answered May 4 '16 at 12:48
sterni1971
114
edited Oct 16 '17 at 14:22
Ramhound
19.6k156084
edited Oct 16 '17 at 14:22
Ramhound
19.6k156084
edited Oct 16 '17 at 14:22
Ramhound
19.6k156084
19.6k156084
answered May 4 '16 at 12:48
sterni1971
114
answered May 4 '16 at 12:48
sterni1971
114
answered May 4 '16 at 12:48
sterni1971
114
114
add a comment |
add a comment |
up vote
0
down vote
Troubleshooting Authentication, Password Change and Access Control
In order for authentication to be successful, the user information must be accurately provided first. Before debugging authentication, please make sure the user information is resolvable with getent passwd $user or id $user. Failing to retrieve the user info would also manifest in the secure logs or the journal with message such as:
pam_sss(sshd:account): Access denied for user admin: 10 (User not known to the underlying authentication module)
Source of Information
answered Dec 12 '17 at 11:57
Mohit Malviya
1
add a comment |
up vote
0
down vote
Troubleshooting Authentication, Password Change and Access Control
In order for authentication to be successful, the user information must be accurately provided first. Before debugging authentication, please make sure the user information is resolvable with getent passwd $user or id $user. Failing to retrieve the user info would also manifest in the secure logs or the journal with message such as:
pam_sss(sshd:account): Access denied for user admin: 10 (User not known to the underlying authentication module)
Source of Information
answered Dec 12 '17 at 11:57
Mohit Malviya
1
add a comment |
up vote
0
down vote
up vote
0
down vote
Troubleshooting Authentication, Password Change and Access Control
In order for authentication to be successful, the user information must be accurately provided first. Before debugging authentication, please make sure the user information is resolvable with getent passwd $user or id $user. Failing to retrieve the user info would also manifest in the secure logs or the journal with message such as:
pam_sss(sshd:account): Access denied for user admin: 10 (User not known to the underlying authentication module)
Source of Information
answered Dec 12 '17 at 11:57
Mohit Malviya
1
Troubleshooting Authentication, Password Change and Access Control
In order for authentication to be successful, the user information must be accurately provided first. Before debugging authentication, please make sure the user information is resolvable with getent passwd $user or id $user. Failing to retrieve the user info would also manifest in the secure logs or the journal with message such as:
pam_sss(sshd:account): Access denied for user admin: 10 (User not known to the underlying authentication module)
Source of Information
answered Dec 12 '17 at 11:57
Mohit Malviya
1
answered Dec 12 '17 at 11:57
Mohit Malviya
1
answered Dec 12 '17 at 11:57
Mohit Malviya
1
answered Dec 12 '17 at 11:57
Mohit Malviya
1
1
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1070887%2fpam-sssd-allow-local-users%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
I ended up just creating an LDAP user to replace the local user
– user3063045
Apr 28 '16 at 18:08