Dear all, There are three virtual machines: Name: ipa.aragon.local Address: 192.168.8.88 Name: client.aragon.local Address: 192.168.3.33 Name: node.aragon.local Address: 192.168.4.44 DNS is working well(Both A and PTR records) <div class="gmail_quote">On Wed, Dec 9, 2009 at 8:30 PM, Dan Scott <<a href="mailto:danieljamesscott@gmail.com">danieljamesscott@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Generally, I've found that this is caused by incorrect DNS records. Make sure that your A and PTR records are correct for this host. One other thing, you should be able to run ipa-getkeytab directly on the client. Hope this helps, Dan Scott <a href="http://danieljamesscott.org" target="_blank">http://danieljamesscott.org</a> <div><div></div><div class="h5"> On Wed, Dec 9, 2009 at 02:16, Michael Kang <<a href="mailto:wxiluo@gmail.com">wxiluo@gmail.com</a>> wrote: > Does anyone know what's wrong? > > On Tue, Dec 8, 2009 at 12:35 PM, Michael Kang <<a href="mailto:wxiluo@gmail.com">wxiluo@gmail.com</a>> wrote: >> >> Dear all, >> >> I had setup a FreeIPA server and a FreeIPA client. After using the ktutil >> command to import the keytab, using the following command on another machine >> to test the configuration. This still need passwd. >> >> IPA Server: >>> >>> kinit admin >>> ipa-addservice host/<a href="http://ipaclient.example.com" target="_blank">ipaclient.example.com</a> >>> ipa-getkeytab -s <a href="http://ipaserver.example.com" target="_blank">ipaserver.example.com</a> -p host/<a href="http://ipaclient.example.com" target="_blank">ipaclient.example.com</a> -k >>> /tmp/krb5.keytab >>> scp /tmp/krb5.keytab root@ipaclient.example.com:/tmp/krb5.keytab >> >> IPA client: >>> >>> # ktutil >>> ktutil: read_kt /tmp/krb5.keytab >>> ktutil: write_kt /etc/krb5/krb5.keytab >>> ktutil: q >> >> ssh <a href="mailto:admin@ipaserver.example.com">admin@ipaserver.example.com</a> (This don't need passwd.) >> >> PC or Mac: >> ssh <a href="mailto:admin@ipaclient.example.com">admin@ipaclient.example.com</a> (This still need passwd.) >> >> What should I do? >> >> Best Regards, >> Michael Kang >> -- >> Michael Kang（康上明学） >> There is a giant asleep within every man. When the giant awakens,miracles >> happen. >> >> Personal blog: <a href="http://ufusion.org" target="_blank">http://ufusion.org</a> - United Fusion > > > > -- > Michael Kang（康上明学） > There is a giant asleep within every man. When the giant awakens,miracles > happen. > > Personal blog: <a href="http://ufusion.org" target="_blank">http://ufusion.org</a> - United Fusion > </div></div>> _______________________________________________ > Freeipa-users mailing list > <a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> > </blockquote></div> -- Michael Kang（康上明学） There is a giant asleep within every man. When the giant awakens,miracles happen. Personal blog: <a href="http://ufusion.org">http://ufusion.org</a> - United Fusion