How does one properly debug the shell login in the following case?
Authentication is handled via sssd configuration and a krb5 authentication server. Logging in with the same .conf-file on Ubuntu 16.04 LTS works perfectly. Once one uses it with 17.04, logging in with everything other than root results in the getty shell being restarted - /var/log/syslog states
email@example.com: Service has no hold-off time, sheduling restert. Stopped Getty on tty2. Started Getty on tty2.
and in auth.log the following is noted:
pam_sss(login:account): Access denied for user <user>: 4 (System error) System error
login <user> results in
root@pctest# login <user> password: System error root@pctest#
sssctl config-check results in no errors as expected from the working configuration on 16.04 LTS.
Every test I mentioned was performed on automatically configured and manually checked, freshly installed systems on formatted drives. Additional packages were installed via the
ubuntu-standard metapackage (no desktop environment installed). Nevertheless the problem was also reproduced on a working 16.04 LTS system upgraded to 17.04.
I did neither find a verbose mode for
login nor a reasonable way to execute the failing part of the login as standalone. So what would you do?
[Edit] Working workaround
A solution for the given problem is:
Workaround for us was to set ad_gpo_access_control = permissive in the [domain] section of file /etc/sssd/sssd.conf ...