Hello, I've done a fresh install of a Centos7 container and the problem was seen again. The lxc build installed the files as described within the enclosed txt file.
For versions: # yum --showduplicates list ipa-client ipa-client-common ipa-common python2-ipalib python2-ipaclient Installed Packages ipa-client.x86_64 4.4.0-14.el7.centos.4 @updates ipa-client-common.noarch 4.4.0-14.el7.centos.4 @updates ipa-common.noarch 4.4.0-14.el7.centos.4 @updates python2-ipaclient.noarch 4.4.0-14.el7.centos.4 @updates python2-ipalib.noarch 4.4.0-14.el7.centos.4 @updates Available Packages ipa-client.x86_64 4.4.0-12.el7.centos base ipa-client.x86_64 4.4.0-14.el7.centos updates ipa-client.x86_64 4.4.0-14.el7.centos.1.1 updates ipa-client.x86_64 4.4.0-14.el7.centos.4 updates ipa-client-common.noarch 4.4.0-12.el7.centos base ipa-client-common.noarch 4.4.0-14.el7.centos updates ipa-client-common.noarch 4.4.0-14.el7.centos.1.1 updates ipa-client-common.noarch 4.4.0-14.el7.centos.4 updates ipa-common.noarch 4.4.0-12.el7.centos base ipa-common.noarch 4.4.0-14.el7.centos updates ipa-common.noarch 4.4.0-14.el7.centos.1.1 updates ipa-common.noarch 4.4.0-14.el7.centos.4 updates python2-ipaclient.noarch 4.4.0-12.el7.centos base python2-ipaclient.noarch 4.4.0-14.el7.centos updates python2-ipaclient.noarch 4.4.0-14.el7.centos.1.1 updates python2-ipaclient.noarch 4.4.0-14.el7.centos.4 updates python2-ipalib.noarch 4.4.0-12.el7.centos base python2-ipalib.noarch 4.4.0-14.el7.centos updates python2-ipalib.noarch 4.4.0-14.el7.centos.1.1 updates python2-ipalib.noarch First downgrade: # yum downgrade ipa-client ipa-client-common ipa-common python2-ipalib python2-ipaclient Removed: ipa-client.x86_64 0:4.4.0-14.el7.centos.4 ipa-client-common.noarch 0:4.4.0-14.el7.centos.4 ipa-common.noarch 0:4.4.0-14.el7.centos.4 python2-ipaclient.noarch 0:4.4.0-14.el7.centos.4 python2-ipalib.noarch 0:4.4.0-14.el7.centos.4 Installed: ipa-client.x86_64 0:4.4.0-14.el7.centos.1.1 ipa-client-common.noarch 0:4.4.0-14.el7.centos.1.1 ipa-common.noarch 0:4.4.0-14.el7.centos.1.1 python2-ipaclient.noarch 0:4.4.0-14.el7.centos.1.1 python2-ipalib.noarch 0:4.4.0-14.el7.centos.1.1 Problem still present. Second downgrade: Removed: ipa-client.x86_64 0:4.4.0-14.el7.centos.1.1 ipa-client-common.noarch 0:4.4.0-14.el7.centos.1.1 ipa-common.noarch 0:4.4.0-14.el7.centos.1.1 python2-ipaclient.noarch 0:4.4.0-14.el7.centos.1.1 python2-ipalib.noarch 0:4.4.0-14.el7.centos.1.1 Installed: ipa-client.x86_64 0:4.4.0-14.el7.centos ipa-client-common.noarch 0:4.4.0-14.el7.centos ipa-common.noarch 0:4.4.0-14.el7.centos python2-ipaclient.noarch 0:4.4.0-14.el7.centos python2-ipalib.noarch 0:4.4.0-14.el7.centos Problem still present. Third downgrade: Removed: ipa-client.x86_64 0:4.4.0-14.el7.centos ipa-client-common.noarch 0:4.4.0-14.el7.centos ipa-common.noarch 0:4.4.0-14.el7.centos python2-ipaclient.noarch 0:4.4.0-14.el7.centos python2-ipalib.noarch 0:4.4.0-14.el7.centos Installed: ipa-client.x86_64 0:4.4.0-12.el7.centos ipa-client-common.noarch 0:4.4.0-12.el7.centos ipa-common.noarch 0:4.4.0-12.el7.centos python2-ipaclient.noarch 0:4.4.0-12.el7.centos python2-ipalib.noarch 0:4.4.0-12.el7.centos Problem still present. There is not any downgrade available on repo to go lower. The error is still the same. It would appear to be outside of the ipa package range. Feb 15 11:05:38 ipatest sshd[231]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.16.0.6 user=nuno Feb 15 11:05:39 ipatest sshd[231]: pam_sss(sshd:account): Access denied for user nuno: 4 (System error) Feb 15 11:05:39 ipatest sshd[229]: error: PAM: User account has expired for nuno from 172.16.0.6 Feb 15 11:05:42 ipatest sshd[229]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.16.0.6 user=nuno Feb 15 11:05:42 ipatest sshd[229]: Failed password for nuno from 172.16.0.6 port 54450 ssh2 Feb 15 11:05:42 ipatest sshd[229]: fatal: Access denied for user nuno by PAM account configuration [preauth] I tried to downgrade sssd but was unable to for lack of dependencies. Thanks. Nuno -----Original Message----- From: Lukas Slebodnik [mailto:lsleb...@redhat.com] Sent: quarta-feira, 15 de fevereiro de 2017 09:16 To: Nuno Higgs Cc: freeipa-users@redhat.com Subject: Re: [Freeipa-users] Cannot login after patching on LXC Container On (14/02/17 20:06), Nuno Higgs wrote: >Hello all, > >I will reproduce the issue tomorrow morning on a fresh LXC container. >For the sestatus: > ># sestatus >SELinux status: disabled > >That isn’t surprising for the host is not se-enabled, or even a RHEL/CentOS. >The underlining distro supports apparmor profiles. FYI: It is not about distribution but about kernel. >The crappy part is before we did this patch update, everything worked >perfectly, although with SE Disabled. > >I will keep you posted on the LXC test > It would be good to find out which package/update broke it. LS -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project