Some AD Users are not able to access Ubuntu machine in the domain, the error after trying to access the server via ssh I get in /var/log/auth.log:
Jun 14 11:50:36 SR sshd[1467842]: Invalid user UserName from 192.168.40.45 port 49378
Jun 14 11:50:37 SR sshd[1467842]: Connection reset by invalid user UserName 192.168.40.45 port 49378 [preauth]
Jun 14 11:50:45 SR sshd[1467955]: Invalid user UserName from 192.168.40.45 port 49379
Jun 14 11:50:50 SR sshd[1467955]: pam_unix(sshd:auth): check pass; user unknown
Jun 14 11:50:50 SR sshd[1467955]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.40.45
Jun 14 11:50:50 SR sshd[1467955]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.40.45 user=UserName
Jun 14 11:50:50 SR sshd[1467955]: pam_sss(sshd:auth): received for user UserName: 10 (User not known to the underlying authentication module)
Jun 14 11:50:52 SR sshd[1467955]: Failed password for invalid user UserName from 192.168.40.45 port 49379 ssh2
It works for other users, but this specific user has joined recently and he can't access the Machine. Also changed the ldap_idmap_range(min/max and size), to check if the issue was with ID Mapping, but it did not work out.
Even if the user tries to login via GUI, they get the following error:
I also tried to login through some other users ssh sessions with su - UserName, but still I can't it gives back the error: su: user UserName does not exist
Below is sssd config file:
[sssd]
domains = "dn"
config_file_version = 2
services = nss, pam
[domain/"dn"]
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = "DN"
realmd_tags = manages-system joined-with-adcli
id_provider = ad
fallback_homedir = /home/%u@%d
ad_domain = "dn"
# use_fully_qualified_names = True
ldap_id_mapping = True
access_provider = ad
ad_gpo_access_control = permissive
these are content of log files in /var/log/sssd
/var/log/sssd/sssd_Domain-Name.log.1:
(Date) [be[mydomain.com]] [orderly_shutdown] (0x0010): SIGTERM: killing children
(Date) [be[mydomain.com]] [orderly_shutdown] (0x0010): SIGTERM: killing children
(Date) [be[mydomain.com]] [orderly_shutdown] (0x0010): SIGTERM: killing children
(Date) [be[mydomain.com]] [orderly_shutdown] (0x0010): SIGTERM: killing children
and sssd.log:
(Date) [sssd] [service_signal_done] (0x0010): Unable to signal service [2]: No such file or directory
(Date) [sssd] [service_signal_done] (0x0010): Unable to signal service [2]: No such file or directory
(Date) [sssd] [service_signal_done] (0x0010): Unable to signal service [2]: No such file or directory
and basically nothing else, primary log files are empty
This is what I get for sssd status:
sssd.service - System Security Services Daemon
Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled)
Active: active (running) since Sat 2023-06-17 06:45:14 CEST; 3 days ago
Main PID: 3371613 (sssd)
Tasks: 4 (limit: 77003)
Memory: 45.5M
CGroup: /system.slice/sssd.service
├─3371613 /usr/sbin/sssd -i --logger=files
├─3371615 /usr/libexec/sssd/sssd_be --domain mydomain.com --uid 0 --gid 0 --logger=files
├─3371616 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
└─3371617 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --logger=files
Date MyServer sssd_be[3371615]: Backend is online
Date MyServer sssd[816515]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may>
Date MyServer sssd[816515]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may>
Date MyServer adcli[816513]: GSSAPI client step 1
Date MyServer adcli[816513]: GSSAPI client step 1
Date MyServer adcli[816513]: GSSAPI client step 1
Date MyServer sssd[816519]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may>
Date MyServer sssd[816519]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may>
Date MyServer sssd[816524]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may>
Date MyServer sssd_be[3371615]: Backend is offline
