3

Trying to troubleshoot a user who is unable to log into our server from a client. Client is bound to server and other users can authenticate.

ApplePasswordServer.Server.log says the following when user in question tries to log in from a terminal:

Jul 26 2009 17:42:26    AUTH2: {0x473633ea7bc7fcaa0000000553400871, jeffb} DIGEST-MD5 authentication succeeded.
Jul 26 2009 17:42:26    AUTH2: {0x473633ea7bc7fcaa0000000553400871, jeffb} DIGEST-MD5 authentication succeeded.
Jul 26 2009 17:42:26    GETPOLICY: user {0x473633ea7bc7fcaa0000000553400871, jeffb}.
Jul 26 2009 17:42:31    KERBEROS-LOGIN-CHECK: user {0x473633ea7bc7fcaa0000000553400871, jeffb} is in good standing.
Jul 26 2009 17:42:31    KERBEROS-LOGIN-CHECK: user {0x473633ea7bc7fcaa0000000553400871, jeffb} authentication succeeded.
Jul 26 2009 17:42:31    AUTH2: {0x473633ea7bc7fcaa0000000553400871, jeffb} DIGEST-MD5 authentication succeeded.
Jul 26 2009 17:42:31    AUTH2: {0x473633ea7bc7fcaa0000000553400871, jeffb} DIGEST-MD5 authentication succeeded.

We are immediately kicked out with rather abrupt response:

macx42:~ weston$ ssh jeffb@xserver
Password:
Connection closed by 10.0.1.32

Edit: We have tried changing the user's password with Workgroup Manager to no avail...

Edit 2: Responding to comment...I DO see the failed attempt logged in /var/log/secure.log:

Jul 26 17:42:23 xserver sshd[498]: /etc/sshd_config line 70: Unsupported option KerberosGetAFSToken
Jul 26 17:42:26 xserver com.apple.SecurityServer[34]: checkpw() succeeded, creating credential for user jeffb
Jul 26 17:42:26 xserver com.apple.SecurityServer[34]: checkpw() succeeded, creating shared credential for user jeffb
Jul 26 17:42:26 xserver com.apple.SecurityServer[34]: Succeeded authorizing right system.login.tty by client /usr/sbin/sshd for au
thorization created by /usr/sbin/sshd.
Jul 26 17:42:26 xserver sshd[498]: error: PAM: User account has expired for jeffb from bigmac.demetrioi.com
Jul 26 17:42:31 xserver com.apple.SecurityServer[34]: checkpw() succeeded, creating credential for user jeffb
Jul 26 17:42:31 xserver com.apple.SecurityServer[34]: checkpw() succeeded, creating shared credential for user jeffb
Jul 26 17:42:31 xserver com.apple.SecurityServer[34]: Succeeded authorizing right system.login.tty by client /usr/sbin/sshd for au
thorization created by /usr/sbin/sshd.
Jul 26 17:42:31 xserver sshd[498]: Failed password for jeffb from 10.0.1.201 port 54698 ssh2

Edit 3 - Results of dirt:

xserver:~ weston$ dirt -u jeffb -p ********
Call to dsGetRecordList returned count = 1 with Status : eDSNoErr : (0)

Call to checkpw(): Success

path: /LDAPv3/127.0.0.1
Username: jeffb
Password: ********
Success
Improve this question
5
  • Does anything appear in /var/log/secure.log?
    – Chealion
    Jul 27, 2009 at 16:59
  • well, yes, in fact. see "Edit 2" above...
    – Meltemi
    Jul 27, 2009 at 21:50
  • Deactivating and reactivating the account in Workgroup Manager have any effect?
    – Chealion
    Jul 28, 2009 at 3:14
  • Does the user have a default shell or a nonstandard one that isn't present on the client? anything odd in the dotfiles?
    – palmer
    Aug 6, 2009 at 19:21
  • Run sshd in the foreground with -vvv switches, and do the same on the client. That can provide a lot more insight in to the sshd side of things.
    – Kamil Kisiel
    Sep 22, 2009 at 23:05

5 Answers 5

Reset to default
1

Maybe it has something to do with this line from your log :

Jul 26 17:42:26 xserver sshd[498]: error: PAM: User account has expired for jeffb from bigmac.demetrioi.com

Looking at this i think the shell for your user is not in /etc/shells

Improve this answer
1

I know this question is almost 3 years old, but I think I found an answer that may help other people that have this problem.

Try to resolve by performing the following:

  1. Open System Preferences ==> Sharing ==> Remote Login (or Remote Management)

  2. Make sure either Allow Access for All Users is selected or add the user in question to the Only these users box

Apparently starting in OS X 10.5, the AllowUsers option in sshd_config has been deprecated by Apple. So if the user is allowed in the sshd_config and not in the System Preferences, then the user will not be allowed to login. I haven't done extensive checking, but I found this information out from http://hintsforums.macworld.com/showthread.php?t=108595 (post #4).

Improve this answer
0

I have had this problem before a long time ago, but on Mac OS X Leopard client. I believe I also had this problem on an Ubuntu server as well.

Can't for the life of me remember what I did, I think I may have solved it by removing the user account and adding a new one and just using that. I know that worked. I think the problem may have happened because the SSH and user account passwords got out of sync or something like that.

Sorry I can't give you a straight answer but this happened when I was tooling with things I shouldn't have been. Best advice I can offer is try resetting the password for the user account, that might fix it. Other than that you may have to migrate the user's files to a new account and delete the old one. Good luck.

Improve this answer
0

Test using dirt on the client and on the server. 

dirt -u jeffb -p

Compare results.

Compare user's account properties to a working user account using Inspector in Workgroup Manager.

Improve this answer
1
  • I get the exact same response from dirt from both the server and the client...(you can see it above)
    – Meltemi
    Jul 28, 2009 at 1:21
0

Is that user able to authenticate to other services (AFP, for example). Is the user able to login when using a different client workstation? Do you have any Service ACLs defined?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .