<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:10pt"><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;">Hi Alexander</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">Thank you very much it worked.</div><div style="background-color: transparent;"><font size="2">its fantastic and I really appreciate your help.</font></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"> </div><div><font size="2">but this scenario is to use the kerboros ticket for each time to login</font></div><div><font size="2"><br></font></div><div><font size="2"> what we are trying to establish is </font></div><div><font size="2">users will have priviate and public ssh keys</font></div><div><font size="2">public sssh keys will be updated to the freeipa server and </font></div><div><font size="2"><br></font></div><div><span style="font-size: 13px;">then users will connect to the remotes servers via the private ssh keys, remote servers need to authenticate via the keys recieved from the freeipa server</span><br></div><div><font size="2"><br></font></div><div><font size="2">but the present working condition doesn't satisfy this as user needs to get the kerborse ticket every life time.</font></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><span style="background-color: rgb(0, 255, 255);">remote server getting the keys from free ipa</span></div><div><div><font size="2" style="background-color: rgb(0, 255, 255);">[root@ldap1-eng-switchlab-net ipa]# /usr/bin/sss_ssh_authorizedkeys np</font></div><div><font size="2" style="background-color: rgb(0, 255, 255);">ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxOZ37IUe5gvlhO1i+bMhj8vhwlKZN6OKeMW6AM37aJhd7jxhz1R+Cod18YTB+gHkrfwe75kkEKfVyvTjpp9j5DRPeTyGMyWt4VbbyYq1Po4BZT7wOtUjwFq320QD5QnNKU6nbQKsB61xCMQy1Peu0nV/33dQTWHzlGi4uV0MN/KBvaWHmTwN6ZJ34uyEQ8kQ+fStd9XNFREw0iYglk42mNd/SA35njqNlsUbtBAR9ZokruAwAVVZqrfQw== np@ldap.eng.switchlab.net</font></div><div><font size="2" style="background-color: rgb(0, 255, 255);">ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxDS69+CH89z5ftzZZCmohY89y2AsJXfA0piHxg2XE+n np@ubuntu</font></div><div><font size="2" style="background-color: rgb(0, 255, 255);">ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFyO8uxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxMLGVqIwR8Ps5m6sYsB/hx3gm2fIoKq6fm0g976L26oAmclDi12CpVFYbI/osIjsq6mIpr9de5Qus/n9kIoxTZLHTRuoCEj7xc4PSPG78oE7JoWKLMvBDiwyhXNa+O9X1RgYhfYmS2m+1nGJYC9DG4xo7K60nO6WogBg3T+EwuDjYrVIfB5Rfe4D8iWKqOTNlJ+MzK4Dk8W8hqSJvuQFq5155DsbeqDy00EY1dMaGYVUq81lHEM91oz np@ldap0.eng.switchlab.net</font></div><div><font size="2" style="background-color: rgb(0, 255, 255);">[root@ldap1-eng-switchlab-net ipa]#</font></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;">debug log of present ssh session</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div></div><div><div><span style="font-size: 13px;">debug2<span style="background-color: rgb(255, 255, 0);">: key: /home/np/.ssh/id_rsa (0x7f495ef25d60)</span></span></div><div><span style="font-size: 13px;">debug2: key: /home/np/.ssh/id_dsa ((nil))</span></div><div><span style="font-size: 13px;">debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password</span></div><div><span style="font-size: 13px;">debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password</span></div><div><span style="font-size: 13px;">debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password</span></div><div><span style="font-size: 13px;">debug3: authmethod_lookup gssapi-keyex</span></div><div><span style="font-size: 13px;">debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password</span></div><div><span style="font-size: 13px;">debug3: authmethod_is_enabled gssapi-keyex</span></div><div><span style="font-size: 13px;">debug1: Next authentication method: gssapi-keyex</span></div><div><span style="font-size: 13px;">debug1: No valid Key exchange context</span></div><div><span style="font-size: 13px;">debug2: we did not send a packet, disable method</span></div><div><span style="font-size: 13px;">debug3: authmethod_lookup gssapi-with-mic</span></div><div><span style="font-size: 13px;">debug3: remaining preferred: publickey,keyboard-interactive,password</span></div><div><span style="font-size: 13px;">debug3: authmethod_is_enabled gssapi-with-mic</span></div><div><span style="font-size: 13px;">debug1: Next authentication method: gssapi-with-mic</span></div><div><span style="font-size: 13px;">debug2: we sent a gssapi-with-mic packet, wait for reply</span></div><div><span style="font-size: 13px;">debug1: Delegating credentials</span></div><div><span style="font-size: 13px;">debug1: Delegating credentials</span></div><div><span style="font-size: 13px;">debug1: <span style="background-color: rgb(255, 255, 0);">Authentication succeeded (</span>gssapi-with-mic).</span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;">Nareshchandra Paturi<br><br>14, St. Augustine’s Court, <br>Mornington Road,<br>london.<br>E11 3BQ.<br>Mob:07466666001,07856918100<br>Ph:02082579579<br></div> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> Alexander Bokovoy <abokovoy@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> naresh reddy <nareshbtech@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> Jan Cholasta <jcholast@redhat.com>; "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, April 26, 2013 11:44 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] Freeipa -ssh keys<br> </font> </div> <div class="y_msg_container"><br>On Fri, 26 Apr 2013, naresh reddy wrote:<br>>Hi Alex <br>><br>>I had tried tshoot and so i have changed GSSAPIAuthentication to no <br>>because i was getting<br>>debug1: Unspecified GSS failure. Minor code may provide more information<br>>Ticket expired<br>^^^ Ticket expired means your ticket on the machine from which you are<br>trying to connect to ssh server.<br><br>You need to maintain actual credentials:<br>[client]$ kinit <a ymailto="mailto:np@eng.switchlab.net" href="mailto:np@eng.switchlab.net">np@eng.switchlab.net</a><br>Password: <...><br>[client]$ ssh -K -l <a ymailto="mailto:np@eng.switchlab.net" href="mailto:np@eng.switchlab.net">np@eng.switchlab.net</a> ldap1.eng.switchlab.net<br><br>You can read basics about Kerberos here:<br><a href="http://www.kerberos.org/software/tutorial.html" target="_blank">http://www.kerberos.org/software/tutorial.html</a><br><br>-- <br>/ Alexander Bokovoy<br><br><br></div> </div> </div> </div></body></html>