SSSD / sssd

#223 User can not change kerberos password via ssh
Closed: Fixed Opened by jgalipea.

Closed: Fixed
Reopen Issue

Description[[BR]]
Attempting to change a user's password via ssh with sssd configured with ipa ldap identity source and ipa krb auth (chpass_provider = krb5) in sssd.conf returns password prompt several times and eventually fails with permission denied.[[BR]]

ssh Results[[BR]]

[root@jennyv1 tet]# ssh -l jimi@BOS.REDHAT.COM 10.16.2.185
Password: 
Password has expired.
New Password: 
Reenter new Password: 
Password: 
Password: 
Permission denied (publickey,gssapi-with-mic,keyboard-interactive).

/var/log/secure[[BR]]

Oct  9 12:56:04 jennyF11 unix_chkpwd[14968]: check pass; user unknown
Oct  9 12:56:04 jennyF11 unix_chkpwd[14968]: password check failed for user (jimi@BOS.REDHAT.COM)
Oct  9 12:56:04 jennyF11 sshd[14967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=jennyv1.bos.redhat.com  user=jimi@BOS.REDHAT.COM
Oct  9 12:56:04 jennyF11 sshd[14967]: pam_sss(sshd:auth): user info: [Password has expired]
Oct  9 12:56:04 jennyF11 sshd[14967]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=jennyv1.bos.redhat.com user=jimi@BOS.REDHAT.COM
Oct  9 12:56:04 jennyF11 sshd[14967]: pam_sss(sshd:auth): received for user jimi@BOS.REDHAT.COM: 27 (Authentication token expired)
Oct  9 12:56:16 jennyF11 sshd[14967]: pam_sss(sshd:auth): user info: [Input/output error]
Oct  9 12:56:16 jennyF11 sshd[14967]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=jennyv1.bos.redhat.com user=jimi@BOS.REDHAT.COM
Oct  9 12:56:16 jennyF11 sshd[14967]: pam_sss(sshd:auth): received for user jimi@BOS.REDHAT.COM: 4 (System error)
Oct  9 12:56:18 jennyF11 sshd[14965]: error: PAM: Authentication failure for jimi@BOS.REDHAT.COM from jennyv1.bos.redhat.com
Oct  9 12:56:18 jennyF11 sshd[14966]: Postponed keyboard-interactive for jimi@BOS.REDHAT.COM from 10.16.0.46 port 39642 ssh2
Oct  9 12:56:23 jennyF11 unix_chkpwd[14973]: check pass; user unknown
Oct  9 12:56:23 jennyF11 unix_chkpwd[14973]: password check failed for user (jimi@BOS.REDHAT.COM)
Oct  9 12:56:23 jennyF11 sshd[14972]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=jennyv1.bos.redhat.com  user=jimi@BOS.REDHAT.COM
Oct  9 12:56:23 jennyF11 sshd[14972]: pam_sss(sshd:auth): user info: [Decrypt integrity check failed]
Oct  9 12:56:23 jennyF11 sshd[14972]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=jennyv1.bos.redhat.com user=jimi@BOS.REDHAT.COM
Oct  9 12:56:23 jennyF11 sshd[14972]: pam_sss(sshd:auth): received for user jimi@BOS.REDHAT.COM: 4 (System error)
Oct  9 12:56:24 jennyF11 sshd[14965]: error: PAM: Authentication failure for jimi@BOS.REDHAT.COM from jennyv1.bos.redhat.com
Oct  9 12:56:24 jennyF11 sshd[14966]: Postponed keyboard-interactive for jimi@BOS.REDHAT.COM from 10.16.0.46 port 39642 ssh2
Oct  9 12:56:28 jennyF11 unix_chkpwd[14976]: check pass; user unknown
Oct  9 12:56:28 jennyF11 unix_chkpwd[14976]: password check failed for user (jimi@BOS.REDHAT.COM)
Oct  9 12:56:28 jennyF11 sshd[14975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=jennyv1.bos.redhat.com  user=jimi@BOS.REDHAT.COM
Oct  9 12:56:28 jennyF11 sshd[14975]: pam_sss(sshd:auth): user info: [Decrypt integrity check failed]
Oct  9 12:56:28 jennyF11 sshd[14975]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=jennyv1.bos.redhat.com user=jimi@BOS.REDHAT.COM
Oct  9 12:56:28 jennyF11 sshd[14975]: pam_sss(sshd:auth): received for user jimi@BOS.REDHAT.COM: 4 (System error)
Oct  9 12:56:30 jennyF11 sshd[14965]: error: PAM: Authentication failure for jimi@BOS.REDHAT.COM from jennyv1.bos.redhat.com
Oct  9 12:56:30 jennyF11 sshd[14966]: Connection closed by 10.16.0.46

sssd.conf

[sssd]
config_file_version = 2
domains = BOS.REDHAT.COM
sbus_timeout = 30
services = nss, dp, pam
[nss]
filter_groups = root
filter_users = root
[pam]
[dp]
[domain/BOS.REDHAT.COM]
id_provider = ldap
ldap_group_search_base = cn=groups,cn=accounts,dc=bos,dc=redhat,dc=com
ldap_tls_reqcert = never
ldap_uri = ldap://jennyv2.bos.redhat.com:389
ldap_user_search_base = cn=users,cn=accounts,dc=bos,dc=redhat,dc=com
use_fully_qualified_names = TRUE
cache_credentials = FALSE
enumerate = TRUE
auth_provider = krb5
krb5_kdcip = 10.16.0.47
krb5_realm = BOS.REDHAT.COM
ldap_schema = rfc2307bis
chpass_provider = krb5
timeout = 30

SSSD version[[BR]]

sssd-client-0.7.0-0.2009100817git80bf7e6.fc11.i586[[BR]]
sssd-0.7.0-0.2009100817git80bf7e6.fc11.i586[[BR]]

In /etc/ssh/sshd_conf ... ChallengeResponseAuthentication yes[[BR]]

Fields changed

milestone: SSSD Deferred => SSSD 0.6.1

FYI - changing password via su is working fine - I dont know if this is a configuration issue, likely it is - but it is a valid use case and would require documenting the configuration.[[BR]]

Password change functionality is a new feature. Postponing to 0.7.0 to get it right.

milestone: SSSD 0.6.1 => SSSD 0.7.0

Fixed in 91f92358f790ddd2cf60b0b950d1d7fb586528f7

fixedin: => 0.7.0
resolution: => fixed
status: new => closed

Fields changed

rhbz: => 0

Metadata Update from @jgalipea:
- Issue assigned to sbose
- Issue set to the milestone: SSSD 0.7.0

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1265

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Lowest
defect
Kerberos Provider
master
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.