<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000'><font face="arial, helvetica, sans-serif" size="2">On client side the valid Kerberos ticket is present. The following SSH configuration is used on the machine where the IPA client is running:</font><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div><font face="arial, helvetica, sans-serif" size="2">/etc/ssh/sshd_config</font></div><div><font face="arial, helvetica, sans-serif" size="2">---cut---</font></div><div><font face="arial, helvetica, sans-serif" size="2">PasswordAuthentication yes</font></div><div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">KerberosAuthentication no</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">PubkeyAuthentication yes</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">UsePAM yes</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">GSSAPIAuthentication yes</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">---cut---</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">Just checked the machine again, password authentication is used as fallback, because the Keberos setup on this machine seems to be messed up. I have tried to uninstall the client and reinstalled it. During the installation I'm getting following message:</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div><font face="arial, helvetica, sans-serif" size="2">"A RA is not configured on the server. Not requesting host certificate."</font></div><div><font face="arial, helvetica, sans-serif" size="2"><br></font></div><div><font face="arial, helvetica, sans-serif" size="2">Trying to request the certificate manually leads in:</font></div><div><font face="arial, helvetica, sans-serif" size="2"><br></font></div><div><font face="arial, helvetica, sans-serif" size="2">ipa-getcert request -d /etc/pki/nssdb -n Server-Cert -K HOST/<host> -N 'CN=<host>,O=EXAMPLE.INFO' -v </font></div><div><font face="arial, helvetica, sans-serif" size="2"><br></font></div><div><font face="arial, helvetica, sans-serif" size="2">Error org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20140416200517"</font></div><div><font face="arial, helvetica, sans-serif" size="2"><br></font></div><div><font face="arial, helvetica, sans-serif" size="2">So to certificate is already there. Do you have some hints?</font></div><div><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><hr id="zwchr" style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="color: rgb(0, 0, 0); font-family: Helvetica, Arial, sans-serif; font-size: 12pt; font-weight: normal; font-style: normal; text-decoration: none;"><b>From: </b>"Simo Sorce" <simo@redhat.com><br><b>To: </b>"David Kreuter" <david.kreuter@bytesource.net><br><b>Cc: </b>freeipa-users@redhat.com<br><b>Sent: </b>Wednesday, 16 April, 2014 8:50:39 PM<br><b>Subject: </b>Re: [Freeipa-users] PasswordAuthentication option for SSH<br><br>On Wed, 2014-04-16 at 20:08 +0200, David Kreuter wrote:<br>> Hi, <br>> <br>> <br>> Today I faced the issue that Kerberos authentication stopped working<br>> after disabling PasswordAuthentication in /etc/ssh/sshd_config on a<br>> FreeIPA client. The deactivation of this option was done due to<br>> security issues. <br>> <br>> <br>> Is it really necessary to have this option set to yes when using<br>> Keberos authentication? <br><br>No, GSSAPI authentication does not need PasswordAuthentication, of<br>course it requires valid kerberos credentials on the client and a valid<br>keytab on the server.<br><br>Simo.<br><br>-- <br>Simo Sorce * Red Hat, Inc * New York<br><br></div><br></div></div></body></html>