<html><body><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000"><div data-marker="__QUOTED_TEXT__"><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;">After we installed a new set of IPA servers for prod, and joined AD using username and password to have AD create a correct suffix routing everythin seems to work, and the suffix routing is created correctly on AD.<br data-mce-bogus="1"></div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;"><br data-mce-bogus="1"></div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;">However, trying to SSH from Windows using Putty and kerberos fails:<br><br><div>Putty log shows:</div><div>Event Log: GSSAPI authentication initialisation failed<br>Event Log: No authority could be contacted for authentication.The domain name of the authenticating party could be wrong, the domain could be unreachable, or there might have been a trust relationship failure.<br></div></div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;"><br data-mce-bogus="1"></div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;">DNS is on AD (manually added, and IPA have no DNS installed.<br data-mce-bogus="1"></div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;"><br data-mce-bogus="1"></div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;">Kerberos DNS is correct:<br data-mce-bogus="1"></div><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000;"><br><div># dig _kerberos._tcp.lx.dr.dk SRV<br>....<br>;; ANSWER SECTION:<br>_kerberos._tcp.lx.dr.dk. 3600 IN SRV 0 100 88 ipa01.lx.dr.dk.<br>_kerberos._tcp.lx.dr.dk. 3600 IN SRV 0 100 88 ipa02.lx.dr.dk.<br><br>;; ADDITIONAL SECTION:<br>ipa01.lx.dr.dk. 3600 IN A x.y.z.135<br>ipa02.lx.dr.dk. 3600 IN A x.y.z.134<br><br></div><br><div># dig _kerberos._tcp.dc._msdcs.lx.dr.dk SRV<br>...<br>;; ANSWER SECTION:<br>_kerberos._tcp.dc._msdcs.lx.dr.dk. 3600 IN SRV 0 100 88 ipa02.lx.dr.dk.<br>_kerberos._tcp.dc._msdcs.lx.dr.dk. 3600 IN SRV 0 100 88 ipa01.lx.dr.dk.<br><br>;; ADDITIONAL SECTION:<br>ipa02.lx.dr.dk. 3600 IN A x.y.z.134<br>ipa01.lx.dr.dk. 3600 IN A x.y.z.135<br></div><br><br><div>Klist on Windows shows I have a TGT for the LX domain (but only a TGT), sorry for the danish.</div><div><br>#0> Klient: drextrha @ NET.DR.DK<br> Server: krbtgt/LX.DR.DK @ PLACE.DR.DK<br> KerbTicket-krypteringstype: AES-256-CTS-HMAC-SHA1-96<br> Billetflag 0x40a50000 -> forwardable renewable pre_authent ok_as_delegate name_canonicalize<br> Starttidspunkt: 9/21/2016 14:58:36 (lokal)<br> Sluttidspunkt: 9/21/2016 23:16:09 (lokal)<br> Fornyelsestidspunkt: 9/28/2016 13:16:09 (lokal)<br> Sessionsnøgletype: AES-256-CTS-HMAC-SHA1-96<br><br></div></div><br></div><div data-marker="__QUOTED_TEXT__">I can't see whats wrong and can't seem to find out whats wrong?<br data-mce-bogus="1"></div><div data-marker="__QUOTED_TEXT__">Suggestions welcome :-)<br data-mce-bogus="1"></div></div></body></html>