DNS is OK.<br><br>I run kinit on <a href="http://client.example.com">client.example.com</a>.<br>Access <a href="http://client.example.com">client.example.com</a> from <a href="http://node.example.com">node.example.com</a>:<br>
<blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote">ssh -v <a href="mailto:admin@client.example.com">admin@client.example.com</a><br>debug1: Authentications that can continue: publickey,gssapi-with-mic,password<br>
debug1: Next authentication method: gssapi-with-mic<br>debug1: Unspecified GSS failure. Minor code may provide more information<br>Credentials cache file '/tmp/krb5cc_0' not found<br><br>debug1: Unspecified GSS failure. Minor code may provide more information<br>
Credentials cache file '/tmp/krb5cc_0' not found<br><br>debug1: Unspecified GSS failure. Minor code may provide more information<br></blockquote><br>It seems the ssh-client was trying to load /tmp/krb5cc_0. I don't run kinit on <a href="http://node.example.com">node.example.com</a>, so there is such file. But I can find it on the <a href="http://client.example.com">client.example.com</a>.<br>
<br>Can <a href="http://node.example.com">node.example.com</a> access <a href="http://client.example.com">client.example.com</a> without any ipa configuration?<br><br>Do I need to install ipa-client on the <a href="http://node.example.com">node.example.com</a>? The document is wrong?<br>
<br><div class="gmail_quote">On Sat, Jan 23, 2010 at 11:54 AM, Scott <span dir="ltr"><<a href="mailto:scott.kaminski@gmail.com">scott.kaminski@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#FFFFFF"><div><br>first I would verify that dns is functional both forward and reverse. </div><div><br></div><div>If that is okay try doing a kinit first then try to connect. </div><div><br></div><div><br>Sent from my iPhone</div>
<div><div></div><div class="h5"><div><br>On Jan 22, 2010, at 7:34 PM, Michael Kang <<a href="mailto:wxiluo@gmail.com" target="_blank">wxiluo@gmail.com</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div>
Hi all,<br><br>I'm trying to configure client ssh access on Fedora 12 and I can't access ipaclient without password.<br><br>I'm following this document:<br><a href="http://freeipa.org/docs/1.2/Client_Setup_Guide/en-US/html/sect-Client_Configuration_Guide-Configuring_Fedora_as_an_IPA_Client-Configuring_Client_SSH_Access.html" target="_blank"></a><a href="http://freeipa.org/docs/1.2/Client_Setup_Guide/en-US/html/sect-Client_Configuration_Guide-Configuring_Fedora_as_an_IPA_Client-Configuring_Client_SSH_Access.html" target="_blank">http://freeipa.org/docs/1.2/Client_Setup_Guide/en-US/html/sect-Client_Configuration_Guide-Configuring_Fedora_as_an_IPA_Client-Configuring_Client_SSH_Access.html</a><br>
<br>At the end of this document:<br><blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote"><div>
The IPA client should now be fully configured to accept incoming <code>SSH</code> connections and authenticate with the user's <code>Kerberos</code>
credentials. Use the following command on another machine to test the
configuration. This should succeed without asking for a password. </div></blockquote><div>
<blockquote><code> # ssh <a href="mailto:admin@ipaclient.example.com" target="_blank"></a><a href="mailto:admin@ipaclient.example.com" target="_blank">admin@ipaclient.example.com</a> </code></blockquote>
</div>As I see it, another machine don't need to install any ipa software and it can access ipaclient without password.<br><br>I have three Fedora machine:<br><ul><li><a href="http://ipa.example.com" target="_blank"></a><a href="http://ipa.example.com" target="_blank">ipa.example.com</a>(IPA Server)</li>
<li><a href="http://client.example.com" target="_blank"></a><a href="http://client.example.com" target="_blank">client.example.com</a>(IPA Client)</li><li><a href="http://node.example.com" target="_blank"></a><a href="http://node.example.com" target="_blank">node.example.com</a>(another machine which was not installed ipa-client or ipa-server)</li>
</ul>The <a href="http://client.example.com" target="_blank"></a><a href="http://client.example.com" target="_blank">client.example.com</a> can access <a href="http://ipa.example.com" target="_blank"></a><a href="http://ipa.example.com" target="_blank">ipa.example.com</a> without password. But the <a href="http://node.example.com" target="_blank"></a><a href="http://node.example.com" target="_blank">node.example.com</a> can't access <a href="http://client.example.com" target="_blank"></a><a href="http://client.example.com" target="_blank">client.example.com</a>.<br>
<br>Do I misunderstand the document or configure incorrect?<br><br>Thanks,<br>Michael<br clear="all"><br>-- <br>Michael Kang（康上明学）<br>There is a giant asleep within every man. When the giant awakens,miracles happen.<br><br>
Personal blog: <a href="http://ufusion.org" target="_blank"></a><a href="http://ufusion.org" target="_blank">http://ufusion.org</a> - United Fusion<br>
</div></blockquote></div></div><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Freeipa-users mailing list</span><br><span><a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a></span><br>
<span><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a></span></div></blockquote></div></blockquote></div><br><br clear="all"><br>-- <br>
Michael Kang（康上明学）<br>There is a giant asleep within every man. When the giant awakens,miracles happen.<br><br>Personal blog: <a href="http://ufusion.org">http://ufusion.org</a> - United Fusion<br>