We've also found that this allows login too:

$ ssh testuser@lander.local
testuser@lander.local's password: <Enter>
testuser@lander.local's password: <Enter>
testuser@lander.local's password: <Enter>
First Factor: <First Factor>
Second Factor (optional): <Second Factor>

However, afterwards MobaXterm's file browser asks for it's own credentials

Oops, used my not $work account

I believe the issue is between sssd and sftp-server and internal-sftp in OpenSSH's sshd

The issue remains if either of thes sftp configurations are used in /etc/ssh/sshd_conf

Subsystem      sftp    /usr/libexec/openssh/sftp-server

or

Subsystem sftp internal-sftp

There was an issue recently with password changes or expired passwords with 2FA. But, System Error more or less means "Unhandled exception", IOW, sssd couldn't figure out a better, more human-readable error code to return, so it just throws its hands in the air and gives up.

Any chance you could attach the SSSD logs? See https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html

We've also found that this allows login too:
$ ssh testuser@lander.local
testuser@lander.local's password: <Enter>
testuser@lander.local's password: <Enter>
testuser@lander.local's password: <Enter>
First Factor: <First Factor>
Second Factor (optional): <Second Factor>

This looks like another PAM module asks for credentials before pam_sss, how does your PAM configuration looks like?

However, afterwards MobaXterm's file browser asks for it's own credentials

I guess for SFTP a new connection is opened which needs authentication. Since you are using one-time passwords you have to enter new credentials for each new connection. Using ssh-keys or single-sign-on with Kerberos/GSSAPI might be an alternative here.

And yes, please attach logs.

I don't think it's PAM asking first, I think its the sshd subsystem call to sftp triggering another authentication process. I think SCP is working because it doesn't require re-authentication.

All our logs in /var/log/sssd are pretty much empty, only contain restart messages. I've emailed them to Sumit rather than upload them.

I'm hoping the least we can get from this is a better error message like "sshd subsystem failed authentication" from sssd, as I expect the real issue is the sftp server built into OpenSSH

There was an issue recently with password changes or expired passwords with 2FA.

I suspect this could be related, it's possible that setting up the sftp channel is interrupting the workflow for resetting an expired password with 2FA, esp. as it seems sftp doesn't handle 2FA well.

Thank you for taking time to submit this request for SSSD. Unfortunately this issue was not given priority and the team lacks the capacity to work on it at this time.

Given that we are unable to fulfill this request I am closing the issue as wontfix.

If the issue still persist on recent SSSD you can request re-consideration of this decision by reopening this issue. Please provide additional technical details about its importance to you.

Thank you for understanding.

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4818

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.