8.4
Security Related Troubleshooting Information
User Authorization Issues
While logging on to Urika-GX (either a tenant or a physical node), the system may return the following message:
You are not authorized to log into this system -- to obtain access please
contact your system administrator
This can mean several things. The administrator should review the logs found in
/var/log/secure
on the node
where the message was seen and look for log messages from the
pam_cray_utp
PAM module. These will have
the string
pam_cray_utp
as a prefix to the log message.
●
If the system returns the following message:
pam_cray_utp: look up of user '<username> on LDAP server with local_ldap_host = 'login1', \
local_ldap_port number = 389 and local_ldap_base_dn = 'ou=crayusers,dc=urika,dc=com' produced an empty result
The user is not yet registered in the user authorization list. Refer to
Authentication and Authorization
175 for more information. If the user is supposed to be authorized and this is a physical node (e.g. a login
node), add the user to the user authorization list as follows:
smw#
ux-tenant-add-user -u username
smw#
ux-tenant-relax username
If this was seen on a tenant VM and the user is supposed to be authorized for that tenant, add the user to the
user authorization list as follows:
smw#
ux-tenant-add-user -u username tenant-name
The user will be added as a member of the tenant and restricted from logging on to physical nodes.
●
If the system returns the following message:
pam_cray_utp: user '<username>' attempted to log into Tenant VM 'tenant-name' \
but does not have a matching crayTenant attribute: failing account authorization
The user is in the authorized user list, but is not yet a member of the tenant who owns the VM. If the user is
supposed to be authorized for this tenant, add the user to the tenant as follows:
smw#
ux-tenant-add-user -u username tenant-name
The user will be added as a member of the tenant and restricted from logging on to physical nodes.
User Access Issues
A user may attempt to log on to a physical node (e.g. a login node) and appear to be logged in but then be
dropped out again with the following message:
interactive login not permitted
Troubleshooting
S3016
250
