<html><body bgcolor="#FFFFFF"><div><br>first I would verify that dns is functional both forward and reverse. </div><div><br></div><div>If that is okay try doing a kinit first then try to connect. </div><div><br></div><div><br>Sent from my iPhone</div><div><br>On Jan 22, 2010, at 7:34 PM, Michael Kang <<a href="mailto:wxiluo@gmail.com">wxiluo@gmail.com</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div>Hi all,<br><br>I'm trying to configure client ssh access on Fedora 12 and I can't access ipaclient without password.<br><br>I'm following this document:<br><a href="http://freeipa.org/docs/1.2/Client_Setup_Guide/en-US/html/sect-Client_Configuration_Guide-Configuring_Fedora_as_an_IPA_Client-Configuring_Client_SSH_Access.html"><a href="http://freeipa.org/docs/1.2/Client_Setup_Guide/en-US/html/sect-Client_Configuration_Guide-Configuring_Fedora_as_an_IPA_Client-Configuring_Client_SSH_Access.html">http://freeipa.org/docs/1.2/Client_Setup_Guide/en-US/html/sect-Client_Configuration_Guide-Configuring_Fedora_as_an_IPA_Client-Configuring_Client_SSH_Access.html</a></a><br>
<br>At the end of this document:<br><blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote"><div class="para">
The IPA client should now be fully configured to accept incoming <code class="systemitem">SSH</code> connections and authenticate with the user's <code class="systemitem">Kerberos</code>
credentials. Use the following command on another machine to test the
configuration. This should succeed without asking for a password. </div></blockquote><div class="para">
<blockquote><code class="command"> # ssh <a href="mailto:admin@ipaclient.example.com"><a href="mailto:admin@ipaclient.example.com">admin@ipaclient.example.com</a></a> </code></blockquote>
</div>As I see it, another machine don't need to install any ipa software and it can access ipaclient without password.<br><br>I have three Fedora machine:<br><ul><li><a href="http://ipa.example.com"><a href="http://ipa.example.com">ipa.example.com</a></a>(IPA Server)</li>
<li><a href="http://client.example.com"><a href="http://client.example.com">client.example.com</a></a>(IPA Client)</li><li><a href="http://node.example.com"><a href="http://node.example.com">node.example.com</a></a>(another machine which was not installed ipa-client or ipa-server)</li></ul>The <a href="http://client.example.com"><a href="http://client.example.com">client.example.com</a></a> can access <a href="http://ipa.example.com"><a href="http://ipa.example.com">ipa.example.com</a></a> without password. But the <a href="http://node.example.com"><a href="http://node.example.com">node.example.com</a></a> can't access <a href="http://client.example.com"><a href="http://client.example.com">client.example.com</a></a>.<br>
<br>Do I misunderstand the document or configure incorrect?<br><br>Thanks,<br>Michael<br clear="all"><br>-- <br>Michael Kang（康上明学）<br>There is a giant asleep within every man. When the giant awakens,miracles happen.<br><br>
Personal blog: <a href="http://ufusion.org"><a href="http://ufusion.org">http://ufusion.org</a></a> - United Fusion<br>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Freeipa-users mailing list</span><br><span><a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a></span><br><span><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></span></div></blockquote></body></html>