AD域服务器SSH登录报错pam_setcred(): Permission denied求助

服务器已加入AD域（realm），仅允许指定用户组通过SSH访问。我属于其中一个组，另有两名用户属于另一组。我与其中一名用户可正常SSH登录，但另一名用户登录失败，相关日志及域配置信息如下：

/var/log/secure 日志内容 #

Jan 11 12:53:34 StorrsOOD sshd[2789625]: starting Duo Unix: PAM Duo
Jan 11 12:53:34 StorrsOOD sshd[2789625]: pam_duo(sshd:auth): conversation failed
Jan 11 12:53:34 StorrsOOD sshd[2789625]: Aborted Duo login for 'anl14042admin' from 137.99.80.134: Error gathering user response
Jan 11 12:53:34 StorrsOOD sshd[2789625]: starting Duo Unix: PAM Duo
Jan 11 12:53:35 StorrsOOD sshd[2789625]: pam_duo(sshd:auth): conversation failed
Jan 11 12:53:35 StorrsOOD sshd[2789625]: Aborted Duo login for 'anl14042admin' from 137.99.80.134: Error gathering user response
Jan 11 12:53:37 StorrsOOD sshd[2789625]: Failed password for anl14042admin from 137.99.80.134 port 50494 ssh2


pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.99.80.134 user=anl14042admin
Jan 11 12:53:47 StorrsOOD sshd[2789700]: starting Duo Unix: PAM Duo
Jan 11 12:53:48 StorrsOOD sshd[2789625]: Postponed keyboard-interactive/pam for anl14042admin from 137.99.80.134 port 50494 ssh2 [preauth]
Jan 11 12:53:55 StorrsOOD sshd[2789700]: Successful Duo login for 'anl14042admin' from 137.99.80.134
Jan 11 12:53:55 StorrsOOD sshd[2789625]: Postponed keyboard-interactive/pam for anl14042admin from 137.99.80.134 port 50494 ssh2 [preauth]
Jan 11 12:53:55 StorrsOOD sshd[2789625]: Accepted keyboard-interactive/pam for anl14042admin from 137.99.80.134 port 50494 ssh2
Jan 11 12:53:55 StorrsOOD sshd[2789625]: fatal: PAM: pam_setcred(): Permission denied

域配置信息（realm list输出） #

[root@StorrsOOD alf02013admin]# realm list
grove.ad.uconn.edu
  type: kerberos
  realm-name: GROVE.AD.UCONN.EDU
  domain-name: grove.ad.uconn.edu
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common-tools
  login-formats: %U
  login-policy: allow-permitted-logins
  permitted-logins: 
  permitted-groups: ms.UITS.server.admins, ms.ITS.StorrsOOD.admins

排查方向及可能原因 #

• Kerberos凭证缓存问题：pam_setcred()负责初始化用户Kerberos凭证缓存，可能该用户的缓存目录（/tmp/krb5cc_*）权限异常，或AD账户的Kerberos票据配置（如有效期、续订规则）冲突，导致系统无法创建/写入缓存文件。
• SSSD配置限制：检查/etc/sssd/sssd.conf，确认是否存在限制凭证设置的参数（如no_setcred），或SSSD服务权限不足，无法为用户处理凭证操作。
• PAM配置顺序错误：查看/etc/pam.d/sshd，确认pam_sss.so和pam_duo.so的加载顺序，若pam_sss.so被标记为no_setcred，会直接阻止凭证设置。
• 用户账户属性差异：对比同组可登录用户，检查该用户是否真的在ms.UITS.server.admins/ms.ITS.StorrsOOD.admins组中（用getent group <组名>验证），是否存在账户过期、登录工作站限制，或UID冲突（用getent passwd anl14042admin查看）。
• Duo与SSSD交互干扰：临时禁用Duo模块测试登录，排除二次验证模块对凭证设置流程的干扰。

内容的提问来源于stack exchange，提问作者Angelo Fazzina