[Samba] Working through the PAM Offline Authentication Wiki page, but...

[Rowland Penny]

On Tue, 19 Nov 2024 11:33:07 -0500
"John R. Graham via samba" <samba at lists.samba.org> wrote:

> ...the tests for initial online login to my newly joined Linux domain 
> member the machine through ssh are failing. I ran:
> 
>      terra ~ # ssh HOME\\jgraham at localhost
>      (HOME\jgraham at localhost) Password:
>      (HOME\jgraham at localhost) Password:
>      (HOME\jgraham at localhost) Password:
>      HOME\jgraham at localhost's password:
>      Permission denied, please try again.
>      HOME\jgraham at localhost's password:
>      Received disconnect from ::1 port 22:2: Too many authentication 
> failures
>      Disconnected from ::1 port 22
> 
> (Password was entered each time it was prompted for.) Log excerpts:
> 
> /var/log/messages:
> 
>      Nov 19 11:18:29 terra samba-dcerpcd[25488]: [2024/11/19 
> 11:18:29.613623,  0] ../../source3/rpc_server/rpc_host.c:2843(main)
>      Nov 19 11:18:29 terra samba-dcerpcd[25488]:   samba-dcerpcd
> version 4.19.7 started.
>      Nov 19 11:18:29 terra samba-dcerpcd[25488]:   Copyright Andrew 
> Tridgell and the Samba Team 1992-2023
>      Nov 19 11:18:29 terra rpcd_lsad[25499]: [2024/11/19 
> 11:18:29.696642,  0] 
> ../../source3/rpc_server/rpc_worker.c:1127(rpc_worker_main)
>      Nov 19 11:18:29 terra rpcd_lsad[25499]:   rpcd_lsad version
> 4.19.7 started.
>      Nov 19 11:18:29 terra rpcd_lsad[25499]:   Copyright Andrew
> Tridgell and the Samba Team 1992-2023
>      Nov 19 11:18:29 terra rpcd_lsad[25501]: [2024/11/19 
> 11:18:29.739755,  0] 
> ../../source3/rpc_server/rpc_worker.c:1127(rpc_worker_main)
>      Nov 19 11:18:29 terra rpcd_lsad[25501]:   rpcd_lsad version
> 4.19.7 started.
>      Nov 19 11:18:29 terra rpcd_lsad[25501]:   Copyright Andrew
> Tridgell and the Samba Team 1992-2023
>      Nov 19 11:18:29 terra rpcd_lsad[25504]: [2024/11/19 
> 11:18:29.790433,  0] 
> ../../source3/rpc_server/rpc_worker.c:1127(rpc_worker_main)
>      Nov 19 11:18:29 terra rpcd_lsad[25504]:   rpcd_lsad version
> 4.19.7 started.
>      Nov 19 11:18:29 terra rpcd_lsad[25504]:   Copyright Andrew
> Tridgell and the Samba Team 1992-2023
>      Nov 19 11:18:29 terra rpcd_lsad[25507]: [2024/11/19 
> 11:18:29.822732,  0] 
> ../../source3/rpc_server/rpc_worker.c:1127(rpc_worker_main)
>      Nov 19 11:18:29 terra rpcd_lsad[25507]:   rpcd_lsad version
> 4.19.7 started.
>      Nov 19 11:18:29 terra rpcd_lsad[25507]:   Copyright Andrew
> Tridgell and the Samba Team 1992-2023
>      Nov 19 11:18:34 terra sshd-session[25516]: pam_unix(sshd:auth): 
> authentication failure; logname=jgraham uid=0 euid=0 tty=ssh ruser= 
> rhost=::1  user=HOME\jgraham
>      Nov 19 11:18:36 terra sshd-session[25479]: error: PAM: 
> Authentication failure for HOME\\jgraham from ::1
>      Nov 19 11:18:40 terra sshd-session[25683]: pam_unix(sshd:auth): 
> authentication failure; logname=jgraham uid=0 euid=0 tty=ssh ruser= 
> rhost=::1  user=HOME\jgraham


At a guess, your PAM stack is incorrect, it doesn't seem to be using
winbind, I would expect to see lines like this:

2024-11-19T17:48:38.678440+00:00 devstation sshd[9437]: pam_winbind(sshd:auth): getting password (0x00000388)

Rowland