We have an issue on some of our AWS machines, running Amazon's hacked Fedora/RHEL linux where newer-in-AD users can login with password but cannot autheticate for sudo. Users that were created in AD a while ago have no issues and this does not seem to follow a pattern on servers (for eg. we created 3 servers at once from the same ami, 2 work, one fails). The errors in the logs are of this format, starting with sucessful login via password:

Jan 18 18:35:37 HOSTNAME sshd[24496]: pam_krb5[24496]: authentication succeeds for 'USERNAME' (USERNAME@AD.DOMAIN)

Jan 18 18:35:37 HOSTNAME sshd[24496]: Accepted password for USERNAME from local_ip port 45236 ssh2

Jan 18 18:35:37 HOSTNAME sshd[24496]: pam_unix(sshd:session): session opened for user USERNAME by (uid=0)

Jan 18 18:35:43 HOSTNAME sudo: pam_unix(sudo:auth): authentication failure; logname=USERNAME uid=10764 euid=0 tty=/dev/pts/2 ruser=USERNAME rhost= user=USERNAME

Jan 18 18:35:43 HOSTNAME sudo: pam_krb5[24526]: account checks fail for 'USERNAME@AD.DOMAIN': user disallowed by .k5login file for 'USERNAME

Jan 18 18:35:43 HOSTNAME sudo: pam_krb5[24526]: authentication fails for 'USERNAME' (USERNAME@AD.DOMAIN): Permission denied (Success)

I've double checked that the user didn't have a .k5login file, there was none, and adding one with only 'USERNAME@AD.DOMAIN' didn't change the behavior or the log messages. I've also verified, as best as I can, that these new users aren't somehow different in AD, but I'm far from an expert there so there may be something else to check there if I knew where to look


  • Why are you using AD? Is this a mostly-Windows environment? – Michael Hampton Jan 18 '16 at 20:32
  • ARe the server's time all in sync? – TheFiddlerWins Jan 18 '16 at 21:45
  • @MichaelHampton - It's a windows-client environment with mostly linux servers. We figured it was easier to get the servers to speak AD than the other way around – amacks Jan 19 '16 at 14:09
  • @TheFiddlerWins - all the servers are NTP-updated and pointing to the AD servers as time source. I just double checked and they are within a second of each other. – amacks Jan 19 '16 at 16:44
  • It might be easier to have Linux clients! – Michael Hampton Jan 19 '16 at 16:47

In /etc/krb5.conf add this lines:

pam = {  
        EXAMPLE.COM = {  
            ignore_k5login = true  

where EXAMPLE.COM is your AD realm.

| improve this answer | |
  • We've already tried that, sadly no effect – amacks Feb 2 '16 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.