We have been using PAM_SMB for awhile now in our various linux servers for authenticating against our AD. I've had no issues in the few years that I've been dealing with this...until now.

I'm running RHEL5.

So, I added a number of local accounts to a box, and one is having some major issues, it just won't authenticate. Unfortunately, I'm not 100% clear on how PAM_SMB achieves its authentication, so I'm at a loss of how to deep dive this situation. So, I was hoping someone might be able to provide some suggestions and insight into how I might effectively proceed.

Here is the log snippet:

Bad (using known pass):
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=blah user=blah
sshd[25521]: pam_smb: Incorrect NT password for username : blah
sshd[25521]: Failed password for blah from xx.xx.xx.xx port 2682 ssh2
sshd[25522]: Received disconnect from xx.xx.xx.xx: 13: The user canceled authentication.

Now, this looks very much like a badly entered password, but I can assure that I have carefully entered the password, but I still get this issue.

I tested by adding her to various machines that have been working for years, and the only unique thing in this situation is the users account, which consistently fails authentication through PAM_SMB (local passwords work fine). So, I'm ready to toss this back to our AD/IT admins with that caveat, but I'd prefer to do so with some leads to where we think the issue is.

Thanks for any thoughts or advice.