<html dir="ltr"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" id="owaParaStyle"></style> </head> <body fpstyle="1" ocsi="0"> <div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Hi, <div><br> </div> <div>I have a IPA server, NFS4 Server sharing home directories with autofs and krb5p as only valid authentication.</div> <div>Mail Postfix/Dovecot both with startTLS and GSSAPI.</div> <div>All servers and clients are Red Hat 6.3 and updated with latest kernel and everything else.</div> <div><br> </div> <div>If i start and log in locally as user1 on a IPA Client machine everything works perfect including mail and home directory initially.</div> <div>I then start experience errors when trying to ssh other servers as ssh user1@mail.example.com.</div> <div>Nothing happens, no password question, nothing until i have to ctrl-c (tried leaving it overnight - still same).</div> <div>Mail stops working, thunderbird complain about expired credentials.</div> <div>If i use ssh as root to the server and then try either: su user1 or su - user1 both get same result as ssh user1.</div> <div>Sometimes a su have actually worked and i can browse to my mounted home directory but get permission denied when trying to access.</div> <div>id works and permissions on home directory shows ok but can't access anyway.</div> <div><br> </div> <div>The only thing i have found helping is to logout user1 on the client, login root and then ssh as user1.</div> <div>In that case i get password question and it works with home directory.</div> <div>If i logout root then, login user1 then mail, ssh and su works again for some time.</div> <div><br> </div> <div>I guess the credential renewal works in that case.</div> <div><br> </div> <div>Firewalls turned off, tried setenforce=0 and autofs on debug log mode but find nothing.</div> <div><br> </div> <div>Even sshd logging on and verbose ssh shows nothing wrong.</div> <div>It is like everything works but a expired ticket or something similar generate the error, tickets are new though and should be valid.</div> <div><br> </div> <div>Only error messages i have been able to find is:</div> <div><br> </div> <div><span style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;">IPA server /var/log/messages show:</span><br style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;"> <span style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;">rpc.gssd[1116]: Error doing stat on file '/tmp/krb5cc_48' </span></div> <div><span style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;"><br> </span></div> <div><span style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;">automount[1197]: sasl_log_func:98: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket expired)</span></div> <div><span style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;"><br> </span></div> <div><span style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;">Anyone have a idea what this could be and how to solve it?</span></div> <div><span style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;"><br> </span></div> <div><span style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;">I am really thankful for any help.</span></div> <div><span style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;"><br> </span></div> <div><span style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;">Regards,</span></div> <div><span style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;">Johan.</span></div> <div><span style="font-family: 'Segoe UI', Helvetica, Arial, sans-serif;"><br> </span></div> <div><br> </div> <div><br> </div> <div><br> </div> </div> </body> </html>