1

We have an issue on some of our AWS machines, running Amazon's hacked Fedora/RHEL linux where newer-in-AD users can login with password but cannot autheticate for sudo. Users that were created in AD a while ago have no issues and this does not seem to follow a pattern on servers (for eg. we created 3 servers at once from the same ami, 2 work, one fails). The errors in the logs are of this format, starting with sucessful login via password:

Jan 18 18:35:37 HOSTNAME sshd[24496]: pam_krb5[24496]: authentication succeeds for 'USERNAME' ([email protected])

Jan 18 18:35:37 HOSTNAME sshd[24496]: Accepted password for USERNAME from local_ip port 45236 ssh2

Jan 18 18:35:37 HOSTNAME sshd[24496]: pam_unix(sshd:session): session opened for user USERNAME by (uid=0)

Jan 18 18:35:43 HOSTNAME sudo: pam_unix(sudo:auth): authentication failure; logname=USERNAME uid=10764 euid=0 tty=/dev/pts/2 ruser=USERNAME rhost= user=USERNAME

Jan 18 18:35:43 HOSTNAME sudo: pam_krb5[24526]: account checks fail for '[email protected]': user disallowed by .k5login file for 'USERNAME

Jan 18 18:35:43 HOSTNAME sudo: pam_krb5[24526]: authentication fails for 'USERNAME' ([email protected]): Permission denied (Success)

I've double checked that the user didn't have a .k5login file, there was none, and adding one with only '[email protected]' didn't change the behavior or the log messages. I've also verified, as best as I can, that these new users aren't somehow different in AD, but I'm far from an expert there so there may be something else to check there if I knew where to look

thanks

7
  • Why are you using AD? Is this a mostly-Windows environment? Jan 18, 2016 at 20:32
  • ARe the server's time all in sync? Jan 18, 2016 at 21:45
  • @MichaelHampton - It's a windows-client environment with mostly linux servers. We figured it was easier to get the servers to speak AD than the other way around
    – amacks
    Jan 19, 2016 at 14:09
  • @TheFiddlerWins - all the servers are NTP-updated and pointing to the AD servers as time source. I just double checked and they are within a second of each other.
    – amacks
    Jan 19, 2016 at 16:44
  • It might be easier to have Linux clients! Jan 19, 2016 at 16:47

1 Answer 1

0

In /etc/krb5.conf add this lines:

[appdefaults]  
pam = {  
       [....]  
        EXAMPLE.COM = {  
            ignore_k5login = true  
        }
}  

where EXAMPLE.COM is your AD realm.

1
  • We've already tried that, sadly no effect
    – amacks
    Feb 2, 2016 at 20:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .