mjhjmtu

EDIT 1: added solution, pam was faulty

i'm trying to set up freeipa client on debian 9 client using this guide:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/identity_management_guide/linux-manual

Current setup:

• Freeipa service is installed on centos 7.6 (ipa-server 4.6.4-10.el7.centos.2)


• Debian 9 on which i am trying to set up as client has installed selinux and configured in permissive mode, sssd and sssd-krb5 in version 1.15.0-3


• I am able to login on local (non freeipa) users which existed on the system before installation/configuration (intended behaviour)

I am not able to login via freeipa newly created user (lines appear when i'm trying ssh newuser@host). Error:

==> sssd_dev.company.log <==
(timestamp) [sssd[be[dev.company]]] [sysdb_get_real_name] (0x0040): Cannot find user [nobody@dev.company] in cache
(timestamp) [sssd[be[dev.company]]] [ipa_id_get_account_info_orig_done] (0x0080): Object not found, ending request
(timestamp) [sssd[be[dev.company]]] [krb5_auth_send] (0x0020): Illegal zero-length authtok for user [newuser@dev.company]

Configs below:

SSSD:

[sssd]
config_file_version = 2
services = nss, pam, sudo, ssh
domains = dev.company
debug_level = 3
[nss]
debug_level = 3
[pam]
debug_level = 3
[sudo]
debug_level = 3
[ssh]
debug_level = 3
[domain/dev.company]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = dev.company
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = company-dev-test-01.dev.company
chpass_provider = ipa
ipa_server = freeipa.dev.company
ldap_tls_cacert = /etc/ipa/ca.crt
debug_level = 3

/etc/krb5.conf

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 master_kdc = FILE:/var/log/krb5masterkdc.log
 admin_server = FILE:/var/log/kadmind.log
 kpasswd_server = FILE:/var/log/kpasswdserver.log

[libdefaults]
 default_realm = DEV.COMPANY
 dns_lookup_realm = false
 dns_lookup_kdc = false
 rdns = false
 ticket_lifetime = 24h
 forwardable = yes
 allow_weak_crypto = false

[realms]
 DEV.COMPANY = 
 kdc = freeipa.dev.company:88
 master_kdc = freeipa.dev.company:88
 admin_server = freeipa.dev.company:749
 kpasswd_server = freeipa.dev.company:464
 default_domain = dev.company
 

[domain_realm]
 .dev.company = DEV.COMPANY
 dev.company = DEV.COMPANY

/etc/pam.d/common-account

account [default=bad success=ok user_unknown=ignore] pam_sss.so forward_pass use_first_pass
account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so
account requisite pam_deny.so
account required pam_permit.so
account sufficient pam_localuser.so

/etc/pam.d/common-auth (old, not working)

auth [success=2 default=ignore] pam_sss.so forward_pass use_first_pass
auth [success=1 default=ignore] pam_unix.so nullok_secure
auth requisite pam_deny.so
auth required pam_permit.so

/etc/pam.d/common-auth (new, working)

auth [success=2 default=ignore] pam_sss.so forward_pass
auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass
auth requisite pam_deny.so
auth required pam_permit.so

/etc/pam.d/common-password

password [success=2 default=ignore] pam_sss.so forward_pass
password [success=1 default=ignore] pam_unix.so obscure sha512
password requisite pam_deny.so
password required pam_permit.so

/etc/pam.d/common-session

session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_mkhomedir.so
session required pam_permit.so
session required pam_unix.so 
session optional pam_sss.so