Re: "System error" when trying to logon via SSH to CentOS 8 joined to AD

[Gordon Messmer <gordon.messmer@xxxxxxxxx>]

On Mon, Mar 22, 2021 at 11:10 PM Konstantin Boyandin via CentOS
<centos@xxxxxxxxxx> wrote:
> I joined a CentOS 8 box to an AD, using the below document as general
> guide:

How general?  Can you describe what you've done that differed from the guide?

> When I comment a line in /etc/pam.d/password-auth (the one commented
> below), error goes away:
> #account     [default=bad success=ok user_unknown=ignore] pam_sss.so

Have you checked /var/log/audit/audit.log for AVCs during login?  I
suspect an SELinux error.

> $ cat /etc/krb5.conf
> [libdefaults]
>      default_ccache_name = KEYRING:persistent:%{uid}

Specifically, I thought that sssd defaults to KCM storage for kerberos
credentials, not the kernel keyring.  You might be seeing an SELinux
deny due to non-default ccache storage.
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos