Mac OS X Server user unable to log in though log appears fine

mac-osxmac-osx-serveropendirectory

Trying to troubleshoot a user who is unable to log into our server from a client. Client is bound to server and other users can authenticate.

ApplePasswordServer.Server.log says the following when user in question tries to log in from a terminal:

Jul 26 2009 17:42:26    AUTH2: {0x473633ea7bc7fcaa0000000553400871, jeffb} DIGEST-MD5 authentication succeeded.
Jul 26 2009 17:42:26    AUTH2: {0x473633ea7bc7fcaa0000000553400871, jeffb} DIGEST-MD5 authentication succeeded.
Jul 26 2009 17:42:26    GETPOLICY: user {0x473633ea7bc7fcaa0000000553400871, jeffb}.
Jul 26 2009 17:42:31    KERBEROS-LOGIN-CHECK: user {0x473633ea7bc7fcaa0000000553400871, jeffb} is in good standing.
Jul 26 2009 17:42:31    KERBEROS-LOGIN-CHECK: user {0x473633ea7bc7fcaa0000000553400871, jeffb} authentication succeeded.
Jul 26 2009 17:42:31    AUTH2: {0x473633ea7bc7fcaa0000000553400871, jeffb} DIGEST-MD5 authentication succeeded.
Jul 26 2009 17:42:31    AUTH2: {0x473633ea7bc7fcaa0000000553400871, jeffb} DIGEST-MD5 authentication succeeded.

We are immediately kicked out with rather abrupt response:

macx42:~ weston$ ssh jeffb@xserver
Password:
Connection closed by 10.0.1.32

Edit: We have tried changing the user's password with Workgroup Manager to no avail…

Edit 2: Responding to comment…I DO see the failed attempt logged in /var/log/secure.log:

Jul 26 17:42:23 xserver sshd[498]: /etc/sshd_config line 70: Unsupported option KerberosGetAFSToken
Jul 26 17:42:26 xserver com.apple.SecurityServer[34]: checkpw() succeeded, creating credential for user jeffb
Jul 26 17:42:26 xserver com.apple.SecurityServer[34]: checkpw() succeeded, creating shared credential for user jeffb
Jul 26 17:42:26 xserver com.apple.SecurityServer[34]: Succeeded authorizing right system.login.tty by client /usr/sbin/sshd for au
thorization created by /usr/sbin/sshd.
Jul 26 17:42:26 xserver sshd[498]: error: PAM: User account has expired for jeffb from bigmac.demetrioi.com
Jul 26 17:42:31 xserver com.apple.SecurityServer[34]: checkpw() succeeded, creating credential for user jeffb
Jul 26 17:42:31 xserver com.apple.SecurityServer[34]: checkpw() succeeded, creating shared credential for user jeffb
Jul 26 17:42:31 xserver com.apple.SecurityServer[34]: Succeeded authorizing right system.login.tty by client /usr/sbin/sshd for au
thorization created by /usr/sbin/sshd.
Jul 26 17:42:31 xserver sshd[498]: Failed password for jeffb from 10.0.1.201 port 54698 ssh2

Edit 3 – Results of dirt:

xserver:~ weston$ dirt -u jeffb -p ********
Call to dsGetRecordList returned count = 1 with Status : eDSNoErr : (0)

Call to checkpw(): Success

path: /LDAPv3/127.0.0.1
Username: jeffb
Password: ********
Success

Best Answer

Maybe it has something to do with this line from your log :

Jul 26 17:42:26 xserver sshd[498]: error: PAM: User account has expired for jeffb from bigmac.demetrioi.com

Looking at this i think the shell for your user is not in /etc/shells

For all OS X accounts

pwpolicy doesnt work for local accounts on OS X client. BUT You can use the dscl command to directly edit these authentication settings. This method is guaranteed to work for user-level OS X accounts (Guest, admin and other regular accounts which you would see listed on the login window). With this approach it doesn't matter whether the account is managed with OS-X Server / LDAP account. This method also works for all OSX System Accounts (which you would otherwise disable their login shells).

Here's how:

# Read the AuthenticationAuthority key
dscl . -read /Users/username AuthenticationAuthority

AuthenticationAuthority: ;Kerberosv5;; \
username@LKDC:SHA1.41BE28E3B64EB62A42D0673968B9591DE18210F5; \
LKDC:SHA1.07264456235E49D45C4B99FC9549FC366CE32343; ; \
ShadowHash;HASHLIST:<SALTED-SHA1>

Disable

If not already disabled, then append DisabledUser to this key's value. With a semicolon for the field seperator. Excess / empty ; ; fields are ignored.

dscl . -append /Users/username AuthenticationAuthority ";DisabledUser;"

Check

To check an account's enabled / disabled status:

dscl . -read /Users/username AuthenticationAuthority | grep DisabledUser

For OSX System accounts: These accounts don't have an AuthenticationAuthority key to begin with. Therefore to check their enabled / disabled status is determined by whether the UserShell attribute has a valid login shell. So check the shell when AuthenticationAuthority doesn't exist.

Enable

To re-enable the user account we just remove DisabledUser sub-string from the AuthenticationAuthority entry. We use then use the dscl . -create cmd and write-back the whole thing.

dscl . -read /Users/username AuthenticationAuthority | \
sed 's/AuthenticationAuthority: //;s/DisabledUser//g;s/[; ]*$//' | \
xargs dscl . -create /Users/username AuthenticationAuthority

Get the AuthenticationAuthority credentials for all users:

dscl . -list /Users AuthenticationAuthority

System accounts: Just remember that a system account must also have a valid login shell.

Svn – Mac OS X Server add server user

You can add accounts with the dscl command line utility. Depending on where you want to add users (just on that server, or on all machines via OpenDirectory), you can pass an argument to it.

For a standard OD, adding a user looks like: dscl -u USERNAME -P Password /LDAPv3/127.0.0.1 -create /Users/USERNAME UniqueID <put unique ID here>

For a local user, like this: dscl -u USERNAME -P Password / -create /Users/USERNAME UniqueID <put unique ID here>

You'll need a different dscl command for various user attributes. There is a guide for a standard-type user account here: http://osxdaily.com/2007/10/29/how-to-add-a-user-from-the-os-x-command-line-works-with-leopard/

And as always, man dscl!

Best Answer

Related Solutions

How to disable a User Account from the CLI with Mac OS X Server

For all OS X accounts

Disable

Check

Enable

Svn – Mac OS X Server add server user

Related Topic