Mac OS X Server user unable to log in though log appears fine

Question

Trying to troubleshoot a user who is unable to log into our server from a client. Client is bound to server and other users can authenticate.

ApplePasswordServer.Server.log says the following when user in question tries to log in from a terminal:

Jul 26 2009 17:42:26    AUTH2: {0x473633ea7bc7fcaa0000000553400871, jeffb} DIGEST-MD5 authentication succeeded.
Jul 26 2009 17:42:26    AUTH2: {0x473633ea7bc7fcaa0000000553400871, jeffb} DIGEST-MD5 authentication succeeded.
Jul 26 2009 17:42:26    GETPOLICY: user {0x473633ea7bc7fcaa0000000553400871, jeffb}.
Jul 26 2009 17:42:31    KERBEROS-LOGIN-CHECK: user {0x473633ea7bc7fcaa0000000553400871, jeffb} is in good standing.
Jul 26 2009 17:42:31    KERBEROS-LOGIN-CHECK: user {0x473633ea7bc7fcaa0000000553400871, jeffb} authentication succeeded.
Jul 26 2009 17:42:31    AUTH2: {0x473633ea7bc7fcaa0000000553400871, jeffb} DIGEST-MD5 authentication succeeded.
Jul 26 2009 17:42:31    AUTH2: {0x473633ea7bc7fcaa0000000553400871, jeffb} DIGEST-MD5 authentication succeeded.

We are immediately kicked out with rather abrupt response:

macx42:~ weston$ ssh jeffb@xserver
Password:
Connection closed by 10.0.1.32

Edit: We have tried changing the user's password with Workgroup Manager to no avail...

Edit 2: Responding to comment...I DO see the failed attempt logged in /var/log/secure.log:

Jul 26 17:42:23 xserver sshd[498]: /etc/sshd_config line 70: Unsupported option KerberosGetAFSToken
Jul 26 17:42:26 xserver com.apple.SecurityServer[34]: checkpw() succeeded, creating credential for user jeffb
Jul 26 17:42:26 xserver com.apple.SecurityServer[34]: checkpw() succeeded, creating shared credential for user jeffb
Jul 26 17:42:26 xserver com.apple.SecurityServer[34]: Succeeded authorizing right system.login.tty by client /usr/sbin/sshd for au
thorization created by /usr/sbin/sshd.
Jul 26 17:42:26 xserver sshd[498]: error: PAM: User account has expired for jeffb from bigmac.demetrioi.com
Jul 26 17:42:31 xserver com.apple.SecurityServer[34]: checkpw() succeeded, creating credential for user jeffb
Jul 26 17:42:31 xserver com.apple.SecurityServer[34]: checkpw() succeeded, creating shared credential for user jeffb
Jul 26 17:42:31 xserver com.apple.SecurityServer[34]: Succeeded authorizing right system.login.tty by client /usr/sbin/sshd for au
thorization created by /usr/sbin/sshd.
Jul 26 17:42:31 xserver sshd[498]: Failed password for jeffb from 10.0.1.201 port 54698 ssh2

Edit 3 - Results of dirt:

xserver:~ weston$ dirt -u jeffb -p ********
Call to dsGetRecordList returned count = 1 with Status : eDSNoErr : (0)

Call to checkpw(): Success

path: /LDAPv3/127.0.0.1
Username: jeffb
Password: ********
Success

Answer 1

Maybe it has something to do with this line from your log :

Jul 26 17:42:26 xserver sshd[498]: error: PAM: User account has expired for jeffb from bigmac.demetrioi.com

Looking at this i think the shell for your user is not in /etc/shells

Answer 2

I have had this problem before a long time ago, but on Mac OS X Leopard client. I believe I also had this problem on an Ubuntu server as well.

Can't for the life of me remember what I did, I think I may have solved it by removing the user account and adding a new one and just using that. I know that worked. I think the problem may have happened because the SSH and user account passwords got out of sync or something like that.

Sorry I can't give you a straight answer but this happened when I was tooling with things I shouldn't have been. Best advice I can offer is try resetting the password for the user account, that might fix it. Other than that you may have to migrate the user's files to a new account and delete the old one. Good luck.

Answer 3

Test using dirt on the client and on the server.

dirt -u jeffb -p

Compare results.

---

Compare user's account properties to a working user account using Inspector in Workgroup Manager.

Answer 4

Is that user able to authenticate to other services (AFP, for example). Is the user able to login when using a different client workstation? Do you have any Service ACLs defined?

Answer 5

I am having this problem too.

we have 5 iMacs in the office with Xserve all running 10.6 with network accounts/home folders, one machine will not login unless i keep trying for about 50/60 times.

It seems to be a problem with the machine and not the user account as all other machine will login to any account and this particular machine wont allow any unless i keep trying???

any ideas would be appreciated

David