<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000'><font face="arial, helvetica, sans-serif" size="2">Yesterday I installed the FreeIPA client on machine and after the installation the login with password worked fine. After that I tried to login with a valid Kerberos ticket and it failed. First i traced the ssh login:</font><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">ssh -vvv david@test.example.com</div><div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">---cut---</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug2: key: /home/david/.ssh/id_rsa (0x7f2ad3112d80),</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug2: key: /home/david/.ssh/id_dsa ((nil)),</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug2: key: /home/david/.ssh/id_ecdsa ((nil)),</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: authmethod_lookup gssapi-keyex</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: authmethod_is_enabled gssapi-keyex</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: Next authentication method: gssapi-keyex</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: No valid Key exchange context</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug2: we did not send a packet, disable method</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: authmethod_lookup gssapi-with-mic</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: remaining preferred: publickey,keyboard-interactive,password</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: authmethod_is_enabled gssapi-with-mic</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: Next authentication method: gssapi-with-mic</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug2: we sent a gssapi-with-mic packet, wait for reply</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug2: we sent a gssapi-with-mic packet, wait for reply</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug2: we sent a gssapi-with-mic packet, wait for reply</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug2: we sent a gssapi-with-mic packet, wait for reply</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug2: we did not send a packet, disable method</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: authmethod_lookup publickey</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: remaining preferred: keyboard-interactive,password</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: authmethod_is_enabled publickey</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: Next authentication method: publickey</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: Offering RSA public key: /home/david/.ssh/id_rsa</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: send_pubkey_test</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug2: we sent a publickey packet, wait for reply</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: Trying private key: /home/david/.ssh/id_dsa</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: no such identity: /home/david/.ssh/id_dsa: No such file or directory</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: Trying private key: /home/david/.ssh/id_ecdsa</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug3: no such identity: /home/david/.ssh/id_ecdsa: No such file or directory</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug2: we did not send a packet, disable method</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">debug1: No more authentication methods to try.</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">Permission denied (publickey,gssapi-keyex,gssapi-with-mic).</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">---cut---</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">Then I enabled the log for SSH on the IPA client machine and faced following error:</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">---cut---</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div>Apr 16 23:43:18 infra01 sshd[9941]: debug1: attempt 0 failures 0</div><div>Apr 16 23:43:18 infra01 sshd[9940]: debug1: PAM: initializing for "david"</div><div>Apr 16 23:43:18 infra01 sshd[9940]: debug1: PAM: setting PAM_RHOST to "10.100.3.2"</div><div>Apr 16 23:43:18 infra01 sshd[9940]: debug1: PAM: setting PAM_TTY to "ssh"</div><div>Apr 16 23:43:18 infra01 sshd[9941]: debug1: userauth-request for user david service ssh-connection method gssapi-with-mic</div><div>Apr 16 23:43:18 infra01 sshd[9941]: debug1: attempt 1 failures 0</div><div>Apr 16 23:43:18 infra01 sshd[9940]: debug1: Unspecified GSS failure. Minor code may provide more information\nNo key table entry found matching host/infra01@\n</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">---cut---</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">Unspecified GSS failure. Minor code may provide more information.No key table entry found matching host/infra01@\n.</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">After that I tried to receive a ticket on the IPA client machine and everything worked fine:</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">kinit <user></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">klist</div><div><div><font face="arial, helvetica, sans-serif" size="2">Ticket cache: FILE:/tmp/krb5cc_0</font></div><div><font face="arial, helvetica, sans-serif" size="2">Default principal: david@<realm>.INFO</font></div><div><font face="arial, helvetica, sans-serif" size="2"><br></font></div><div><font face="arial, helvetica, sans-serif" size="2">Valid starting Expires Service principal</font></div><div><font face="arial, helvetica, sans-serif" size="2">04/16/14 23:24:51 04/17/14 23:24:47 krbtgt/...</font></div><div><font face="arial, helvetica, sans-serif" size="2">04/16/14 23:25:51 04/17/14 23:24:47 host/...</font></div></div><div><font face="arial, helvetica, sans-serif" size="2"><br></font></div><div><div>kvno -k /etc/krb5.keytab host/...</div><div>host/...: kvno = 1, keytab entry valid</div></div><div><br></div><div>So the Kerberos setup on the machine seems to be fine, but still the login SSH using Keberos is not working. GSSAPI is correctly enabled in the sshd configuration file. Any hint is highly appreciated. Thanks.</div><div><br></div><div>David</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div></div></div></body></html>