Forum Replies Created
NoMachine doesn’t currently support two-factor authentication to Windows machines. We suggest using public-key authentication which provides better security than password auth. This article describes how to set it up:
Can you show us the output of following command ran in terminal on affected machine:
You can also try to reuse SSH PAM configuration with NX protocol.
To do so, run as root in terminal:
cp /etc/pam.d/nx /etc/pam.d/nx.bak
cp /etc/pam.d/sshd /etc/pam.d/nx
Does it solve the issue?
may you please answer to the following questions?
1) Do you use dynamic mounting of user’s home directory?
2) If yes, can you share some details about your configuration?
3) Do you use pam_mount or perhaps AFS?
4) Does the problem occur when SELinux is disabled?
5) Does the problem occur when you’are physically logged-in on the account of the problematic user on server host?
6) To rule out possible problems with domain accounts binding, please execute in a terminal on the server host:
Does it correctly report local ID for user, user’s primary group and all supplementary groups of user, including domain groups?August 30, 2019 at 15:48 in reply to: How to implement LDAP Authentication on a Linux machine? #23475
NoMachine does not make a distinction between domain and local users during authentication process. If you want to perform authentication against LDAP server your system needs to be configured properly. These two articles describe how to setup OpenLDAP server and configure client machine for LDAP authentication.
It’s also possible to integrate Linux with Windows AD domain. Winbind and sssd are examples
of technologies you can use to achieve that.
Logs indicate that there’s a problem with obtaining security context of user nx. This might be related to incorrectly installed nxlsa module.
To reinstall nxlsa module:
1. Start cmd as Administrator.
2. Change directory to bin subdirectory of NoMachine installation directory:
nxservice64.exe –uninstall nxlsa
4. Restart Windows.
5. Repeat points 1. and 2.
nxservice64.exe –install nxlsa
7. Restart Windows.
Alternatively you can simply uninstall NoMachine, perform restart, install NoMachine and restart Windows again.
Let us know if you still experience the issue.
Please make sure that the local account mapping is correctly configured. Specifically, you should look into primary user’s group mapping: “domain firstname.lastname@example.org” looks strange. It appears that user’s process doesn’t have rights to modify permissions on the directory it created.
What’s the output of ‘id <user_name>’ command? Does it correctly report local ID for user, user’s primary group and all supplementary groups of user, including domain groups?
It’s not necessary for your workstation to be running kerberos server. It’s only required that NoMachine client host and NoMachine server host are properly configured members of the same, already existing, kerberos realm. Make sure that NoMachine player has access to valid kerberos ticket and that kerberos authentication is enabled in server.cfg on NoMachine server host.
We reproduced the issue with slow Windows reboot and created the TR:
We’re also keen to fix it 🙂 We’re currently investigating how much faster can we make NoMachine services respond to Windows preshutdown event.
NoMachine’s key authentication can’t be used for domain accounts. This limitation comes from the fact that it’s not possible to create domain user’s security context inside LSA (Local Security Authority) module. The alternative which you could use is Kerberos authentication method. However, this can only work if your client machine is part of the domain. We hope to add support for fingerprint authentication on Windows 10 later this year.
Please execute md5 command on private key files on both client NoMachine hosts, make sure that the results are exactly the same. With the release of version 7.8p1-1, openSSH introduced a new private key format (which is not currently compatible with NoMachine). We have opened a Trouble Report, which you can see here and it includes a workaround.
What’s the header of private key on your Mojave host? On which host did you generate key-pair?
There are few possible reasons of problem with accessing .Xauthority file. Check if you can establish NoMachine session after following instructions for each of the listed scenarios separately.
1. The home directory is not mounted.
Start terminal ssh session to remote node host, to make sure that home directory is mounted.
2. Home directory is mounted, but SELinux is preventing access.
Follow this article to temporarily disable selinux or set it to permissive mode:
3. The file has correct permission, but not the correct owner.
Make sure that the owner of the file is the same as user who attempts to establish NoMachine session.
4. There’s some difference in configuration between server machine and remote node machine.
Look for potential differences in /etc/pam.d directories on ETS and TSN.March 4, 2019 at 12:28 in reply to: "Authentication failed" connecting to v6.4.6 on Ubuntu 18.04.2 LTS #21648
Can you connect to the NoMachine server host using terminal ssh client? Is it possible to establish ssh session for user experiencing the problem with NX? From information gathered so far, it appears that the host is part of the domain. What exact technology do you use? Is it Windows AD, LDAP server or something else? If this is Windows AD, did you make sure that domain group policy settings like, NetworkLogonRight are properly set in domain controller? Does the problem affect all domain users or just this one specific user?February 22, 2019 at 12:11 in reply to: "Authentication failed" connecting to v6.4.6 on Ubuntu 18.04.2 LTS #21557
So now we can see that the problem is ‘access denied’ from pam_sss.
Please apply the instructions from:
and see if this helps.February 21, 2019 at 19:30 in reply to: "Authentication failed" connecting to v6.4.6 on Ubuntu 18.04.2 LTS #21538
Please, run this command from terminal as root user:
cp /etc/pam.d/sshd /etc/pam.d/nx
Reproduce the problem and check again auth.log for nxexec entries.February 20, 2019 at 09:24 in reply to: "Authentication failed" connecting to v6.4.6 on Ubuntu 18.04.2 LTS #21508
Is your Ubuntu host part of Active Directory domain? If that’s the case, you are most likely experiencing the problem with AD Group Policy described here:
If that’s not the case, please check system authentication log (/var/log/auth.log) for entries referencing nxexec. Could you post auth log messages added during failed authentication attempt? You can also send them to forum[at]nomachine[dot]com.