Red Hat Enterprise Linux Diagnostics and Troubleshooting

Re-create the issue. From the workstation machine, attempt to log in to the operator1 account on the servera machine. The login either fails to connect or presents a password prompt. Press Ctrl+C at any time to exit the authentication process.

1. The following output is an example of incorrect behavior:

   [student@workstation ~]$ ssh operator1@servera
   Connection closed by 172.25.250.10 port 22

2. The following output is another possible example of incorrect behavior:

   [student@workstation ~]$ ssh operator1@servera
   Password: RedHat123^
   Password: RedHat123^
   Password: RedHat123^
   operator1@servera's password: RedHat123^
   Permission denied, please try again.
   operator1@servera's password: RedHat123^
   Received disconnect from 172.25.250.10 port 22:2: Too many authentication failures
   Disconnected from 172.25.250.10 port 22
   [student@workstation ~]$

Log in to servera.

1. As the student user on the workstation machine, log in to the servera machine and switch to the root user.

   [student@workstation ~]$ ssh student@servera
   ...output omitted...
   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]#

Ensure that the Identity Management service is providing Kerberos tickets.

1. Use the kinit admin command to authenticate and obtain Kerberos credentials. When prompted, use RedHat123^ as the password.

   [root@servera ~]# kinit admin
   Password for admin@LAB.EXAMPLE.COM: RedHat123^

2. Use the klist command to verify that the Kerberos ticket is created.

   [root@servera ~]# klist
   Ticket cache: KCM:0
   Default principal: admin@LAB.EXAMPLE.COM
   
   Valid starting       Expires              Service principal
   11/23/2021 20:50:11  11/24/2021 20:50:06  krbtgt/LAB.EXAMPLE.COM@LAB.EXAMPLE.COM

The previous step indicates that both LDAP and Kerberos are functioning normally, so the problem might be the SSSD configuration. Clear the SSSD log files on the servera machine and attempt to log in as the operator1 user to generate fresh logs. Search the log files for possible errors.

1. Enable detailed SSSD debug logging.

   [root@servera ~]# sssctl debug-level 6

2. Invalidate all objects in the SSSD cache.

   [root@servera ~]# sss_cache -E

3. Clear previous SSSD logs to minimize the troubleshooting data set.

   [root@servera ~]# sssctl logs-remove
   Truncating log files...

4. From a new terminal on workstation, attempt to log in to the operator1 user account to regenerate the error.

   [student@workstation ~]$ ssh operator1@servera
   Connection closed by 172.25.250.10 port 22

5. On servera, review the SSSD logs for information about a failed request.

   The log file indicates that no rules were found for the host.

   [root@servera ~]# tail /var/log/sssd/sssd_lab.example.com.log
   (2021-11-23 21:51:12): [be[lab.example.com]] [sdap_account_expired] (0x0400): IPA access control succeeded, checking AD access control
   (2021-11-23 21:51:12): [be[lab.example.com]] [sdap_account_expired_ad] (0x0400): Performing AD access check for user [operator1@lab.example.com]
   (2021-11-23 21:51:12): [be[lab.example.com]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaHost)(fqdn=serverc.lab.example.com))][cn=accounts,dc=lab,dc=example,dc=com].
   (2021-11-23 21:51:12): [be[lab.example.com]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
   (2021-11-23 21:51:12): [be[lab.example.com]] [ipa_pam_access_handler_done] (0x0020): No HBAC rules found, denying access
   (2021-11-23 21:51:12): [be[lab.example.com]] [dp_req_done] (0x0400): DP Request [PAM Account #9]: Request handler finished [0]: Success
   (2021-11-23 21:51:12): [be[lab.example.com]] [_dp_req_recv] (0x0400): DP Request [PAM Account #9]: Receiving request data.
   (2021-11-23 21:51:12): [be[lab.example.com]] [dp_req_destructor] (0x0400): DP Request [PAM Account #9]: Request removed.
   (2021-11-23 21:51:12): [be[lab.example.com]] [dp_req_destructor] (0x0400): Number of active DP request: 0
   (2021-11-23 21:51:12): [be[lab.example.com]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.pamHandler: Success

Check and repair any issues in the /etc/sssd/sssd.conf file.

1. Inspect the file. The ipa_hostname parameter is incorrect. Fix the parameter so that it matches the following output.

   [root@servera ~]# cat /etc/sssd/sssd.conf | grep ipa_hostname
   ipa_hostname = servera.lab.example.com

2. Restart the sssd service.

   [root@servera ~]# systemctl restart sssd

Verify that the operator1 user is not prompted for a password when logging in to the servera machine.

1. From the additional terminal on workstation, log in to the operator1 account on the servera machine.

   The login is successful. Exit the terminal when connected.

   [student@workstation ~]$ ssh operator1@servera
   ...output omitted...
   [operator1@servera ~]$ exit

2. Close the terminal that is connected to servera and return to workstation as the student user.

   [root@servera ~]# exit
   [student@servera ~]$ exit
   [student@workstation ~]$