API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Dec 30th, 2016
307
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.35 KB | None | 0 0
raw download clone embed print report
  1. Restricted login list - couldn't resolve srvDomainUsers [40071]
  2.  
  3. Dec 30 08:56:47 srv3 login[1713]: PAM (login) illegal module type: sessions
  4. Dec 30 08:56:47 srv3 login[1713]: PAM (other) illegal module type: sessions
  5. Dec 30 08:56:50 srv3 login[1713]: [lsass-pam] [module:pam_lsass]User user12 is denied access because they are not in the 'require membership of' list
  6. Dec 30 08:56:50 srv3 login[1713]: [lsass-pam] [module:pam_lsass]pam_sm_authenticate error [login:user12][error code:40158]
  7. Dec 30 08:56:50 srv3 login[1713]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=/dev/tty1 ruser= rhost= user=user12
  8. Dec 30 08:56:50 srv3 login[1713]: pam_sss(login:auth): Request to sssd failed. Connection refused
  9. Dec 30 08:56:53 srv3 login[1713]: FAILED LOGIN (1) on '/dev/tty1' FOR 'user12', Authentication failure
  10.  
  11. root@srv3:~# /opt/pbis/bin/config --dump
  12. AllowDeleteTo ""
  13. AllowReadTo ""
  14. AllowWriteTo ""
  15. MaxDiskUsage 104857600
  16. MaxEventLifespan 90
  17. MaxNumEvents 100000
  18. DomainSeparator "\"
  19. SpaceReplacement "^"
  20. EnableEventlog false
  21. SaslMaxBufSize 16777215
  22. Providers "ActiveDirectory"
  23. DisplayMotd false
  24. PAMLogLevel "verbose"
  25. UserNotAllowedError "Access denied"
  26. AssumeDefaultDomain true
  27. CreateHomeDir true
  28. CreateK5Login true
  29. SyncSystemTime true
  30. TrimUserMembership true
  31. LdapSignAndSeal false
  32. LogADNetworkConnectionEvents true
  33. NssEnumerationEnabled true
  34. NssGroupMembersQueryCacheOnly true
  35. NssUserMembershipQueryCacheOnly false
  36. RefreshUserCredentials true
  37. CacheEntryExpiry 14400
  38. DomainManagerCheckDomainOnlineInterval 300
  39. DomainManagerUnknownDomainCacheTimeout 3600
  40. MachinePasswordLifespan 2592000
  41. MemoryCacheSizeCap 0
  42. HomeDirPrefix "/home"
  43. HomeDirTemplate "%H/%U"
  44. RemoteHomeDirTemplate ""
  45. HomeDirUmask "022"
  46. LoginShellTemplate "/bin/bash"
  47. SkeletonDirs "/etc/skel"
  48. UserDomainPrefix "srv"
  49. DomainManagerIgnoreAllTrusts false
  50. DomainManagerIncludeTrustsList
  51. DomainManagerExcludeTrustsList
  52. RequireMembershipOf "srv\DomainUsers"
  53. Local_AcceptNTLMv1 true
  54. Local_HomeDirTemplate "%H/local/%D/%U"
  55. Local_HomeDirUmask "022"
  56. Local_LoginShellTemplate "/bin/sh"
  57. Local_SkeletonDirs "/etc/skel"
  58. UserMonitorCheckInterval 1800
  59. LsassAutostart true
  60. EventlogAutostart true
  61. BlacklistDC
  62.  
  63. LSA Server Status:
  64.  
  65. Compiled daemon version: 8.5.2.265
  66. Packaged product version: 8.5.265.1
  67. Uptime: 0 days 0 hours 14 minutes 5 seconds
  68.  
  69. [Authentication provider: lsa-activedirectory-provider]
  70.  
  71. Status: Online
  72. Mode: Un-provisioned
  73. Domain: SRV.LOCAL
  74. Domain SID: S-1-5-21-2727847642-148432537-1030246457
  75. Forest: srv.local
  76. Site: Default-First-Site-Name
  77. Online check interval: 300 seconds
  78. [Trusted Domains: 1]
  79.  
  80.  
  81. [Domain: SRV]
  82.  
  83. DNS Domain: srv.local
  84. Netbios name: SRV
  85. Forest name: srv.local
  86. Trustee DNS name:
  87. Client site name: Default-First-Site-Name
  88. Domain SID: S-1-5-21-2727847642-148432537-1030246457
  89. Domain GUID: 8ac2ba85-7313-6746-abfe-d44f9856708e
  90. Trust Flags: [0x001d]
  91. [0x0001 - In forest]
  92. [0x0004 - Tree root]
  93. [0x0008 - Primary]
  94. [0x0010 - Native]
  95. Trust type: Up Level
  96. Trust Attributes: [0x0000]
  97. Trust Direction: Primary Domain
  98. Trust Mode: In my forest Trust (MFT)
  99. Domain flags: [0x0001]
  100. [0x0001 - Primary]
  101.  
  102. [Domain Controller (DC) Information]
  103.  
  104. DC Name: dc1.srv.local
  105. DC Address: 192.168.253.200
  106. DC Site: Default-First-Site-Name
  107. DC Flags: [0x0000f1fd]
  108. DC Is PDC: yes
  109. DC is time server: yes
  110. DC has writeable DS: yes
  111. DC is Global Catalog: yes
  112. DC is running KDC: yes
  113.  
  114. [Global Catalog (GC) Information]
  115.  
  116. GC Name: dc1.srv.local
  117. GC Address: 192.168.253.200
  118. GC Site: Default-First-Site-Name
  119. GC Flags: [0x0000f1fd]
  120. GC Is PDC: yes
  121. GC is time server: yes
  122. GC has writeable DS: yes
  123. GC is running KDC: yes
  124.  
  125. Name: PowerBroker Identity Services (PBIS)
  126. Default: yes
  127. Priority: 260
  128. Conflicts: winbind
  129. Auth-Type: Primary
  130. Auth:
  131. [success=end default=ignore] pam_lsass.so try_first_pass
  132. Auth-Initial:
  133. [success=end default=ignore] pam_lsass.so
  134. Account-Type: Primary
  135. Account:
  136. [success=ok new_authtok_reqd=ok default=ignore] pam_lsass.so unknown_ok
  137. [success=end new_authtok_reqd=done default=ignore] pam_lsass.so
  138. Session-Type: Additional
  139. Session:
  140. optional pam_lsass.so
  141. Password-Type: Primary
  142. Password:
  143. [success=end default=ignore] pam_lsass.so use_authtok try_first_pass
  144. Password-Initial:
  145. [success=end default=ignore] pam_lsass.so
  146.  
  147. #
  148. # /etc/pam.d/common-account - authorization settings common to all services
  149. #
  150. # This file is included from other service-specific PAM config files,
  151. # and should contain a list of the authorization modules that define
  152. # the central access policy for use on the system. The default is to
  153. # only deny service to users whose accounts are expired in /etc/shadow.
  154. #
  155. # As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
  156. # To take advantage of this, it is recommended that you configure any
  157. # local modules either before or after the default block, and use
  158. # pam-auth-update to manage selection of other modules. See
  159. # pam-auth-update(8) for details.
  160. #
  161.  
  162. # here are the per-package modules (the "Primary" block)
  163. account [success=ok new_authtok_reqd=ok default=ignore] pam_lsass.so unknown_ok
  164. account [success=2 new_authtok_reqd=done default=ignore] pam_lsass.so
  165. account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so
  166. # here's the fallback if no module succeeds
  167. account requisite pam_deny.so
  168. # prime the stack with a positive return value if there isn't one already;
  169. # this avoids us returning an error just because nothing sets a success code
  170. # since the modules above will each just jump around
  171. account required pam_permit.so
  172. # and here are more per-package modules (the "Additional" block)
  173. account sufficient pam_localuser.so
  174. account [default=bad success=ok user_unknown=ignore] pam_sss.so
  175. # end of pam-auth-update config
  176.  
  177. #
  178. # /etc/pam.d/common-session - session-related modules common to all services
  179. #
  180. # This file is included from other service-specific PAM config files,
  181. # and should contain a list of modules that define tasks to be performed
  182. # at the start and end of sessions of *any* kind (both interactive and
  183. # non-interactive).
  184. #
  185. # As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
  186. # To take advantage of this, it is recommended that you configure any
  187. # local modules either before or after the default block, and use
  188. # pam-auth-update to manage selection of other modules. See
  189. # pam-auth-update(8) for details.
  190.  
  191. # here are the per-package modules (the "Primary" block)
  192. session [default=1] pam_permit.so
  193. # here's the fallback if no module succeeds
  194. session requisite pam_deny.so
  195. # prime the stack with a positive return value if there isn't one already;
  196. # this avoids us returning an error just because nothing sets a success code
  197. # since the modules above will each just jump around
  198. session required pam_permit.so
  199. # The pam_umask module will set the umask according to the system default in
  200. # /etc/login.defs and user settings, solving the problem of different
  201. # umask settings with different shells, display managers, remote sessions etc.
  202. # See "man pam_umask".
  203. session optional pam_umask.so
  204. # and here are more per-package modules (the "Additional" block)
  205. #session optional pam_lsass.so
  206. sessions [success=ok default=ignore] pam_lsass.so
  207. session required pam_unix.so
  208. session optional pam_sss.so
  209. session optional pam_systemd.so
  210. # end of pam-auth-update config
  211. session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
  212.  
  213. #
  214. # /etc/pam.d/common-auth - authentication settings common to all services
  215. #
  216. # This file is included from other service-specific PAM config files,
  217. # and should contain a list of the authentication modules that define
  218. # the central authentication scheme for use on the system
  219. # (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
  220. # traditional Unix authentication mechanisms.
  221. #
  222. # As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
  223. # To take advantage of this, it is recommended that you configure any
  224. # local modules either before or after the default block, and use
  225. # pam-auth-update to manage selection of other modules. See
  226. # pam-auth-update(8) for details.
  227.  
  228. # here are the per-package modules (the "Primary" block)
  229. auth [success=3 default=ignore] pam_lsass.so
  230. auth [success=2 default=ignore] pam_unix.so nullok_secure try_first_pass
  231. auth [success=1 default=ignore] pam_sss.so use_first_pass
  232. # here's the fallback if no module succeeds
  233. auth requisite pam_deny.so
  234. # prime the stack with a positive return value if there isn't one already;
  235. # this avoids us returning an error just because nothing sets a success code
  236. # since the modules above will each just jump around
  237. auth required pam_permit.so
  238. # and here are more per-package modules (the "Additional" block)
  239. # end of pam-auth-update config
  240. ~
  241. ~
  242.  
  243. [libdefaults]
  244. default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
  245. default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
  246. preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
  247. dns_lookup_kdc = true
  248. pkinit_kdc_hostname = <DNS>
  249. pkinit_anchors = DIR:/var/lib/pbis/trusted_certs
  250. pkinit_cert_match = &&<EKU>msScLogin<PRINCIPAL>
  251. pkinit_eku_checking = kpServerAuth
  252. pkinit_win2k_require_binding = false
  253. pkinit_identities = PKCS11:/opt/pbis/lib/libpkcs11.so
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!