<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;">From what I understand from your email, <br><br>You don't have kerberos credentials that's why its complaining about not being able to read the file /tmp/krb5cc_0. <br><br>Firstly, do the admin account in ipaclient.example.com exist. And if so, can you get a kerberos ticket for admin from node.example.com. <br><br>You should have a minimally working kerberos client configuration for node.example.com i.e. krb5.conf. <br><br>John Robert Mendoza<br><br>--- On <b>Sat, 1/23/10, Michael Kang <i><wxiluo@gmail.com></i></b> wrote:<br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"><br>From: Michael Kang <wxiluo@gmail.com><br>Subject: Re: [Freeipa-users] Configuring Client SSH Access Failure<br>To: "Scott" <scott.kaminski@gmail.com><br>Cc: "freeipa-users" <freeipa-users@redhat.com><br>Date:
Saturday, 23 January, 2010, 1:12 PM<br><br><div id="yiv588773818">DNS is OK.<br><br>I run kinit on <a rel="nofollow" target="_blank" href="http://client.example.com">client.example.com</a>.<br>Access <a rel="nofollow" target="_blank" href="http://client.example.com">client.example.com</a> from <a rel="nofollow" target="_blank" href="http://node.example.com">node.example.com</a>:<br>
<blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote">ssh -v <a rel="nofollow" ymailto="mailto:admin@client.example.com" target="_blank" href="/mc/compose?to=admin@client.example.com">admin@client.example.com</a><br>debug1: Authentications that can continue: publickey,gssapi-with-mic,password<br>
debug1: Next authentication method: gssapi-with-mic<br>debug1: Unspecified GSS failure. Minor code may provide more information<br>Credentials cache file '/tmp/krb5cc_0' not found<br><br>debug1: Unspecified GSS failure. Minor code may provide more information<br>
Credentials cache file '/tmp/krb5cc_0' not found<br><br>debug1: Unspecified GSS failure. Minor code may provide more information<br></blockquote><br>It seems the ssh-client was trying to load /tmp/krb5cc_0. I don't run kinit on <a rel="nofollow" target="_blank" href="http://node.example.com">node.example.com</a>, so there is such file. But I can find it on the <a rel="nofollow" target="_blank" href="http://client.example.com">client.example.com</a>.<br>
<br>Can <a rel="nofollow" target="_blank" href="http://node.example.com">node.example.com</a> access <a rel="nofollow" target="_blank" href="http://client.example.com">client.example.com</a> without any ipa configuration?<br><br>Do I need to install ipa-client on the <a rel="nofollow" target="_blank" href="http://node.example.com">node.example.com</a>? The document is wrong?<br>
<br><div class="gmail_quote">On Sat, Jan 23, 2010 at 11:54 AM, Scott <span dir="ltr"><<a rel="nofollow" ymailto="mailto:scott.kaminski@gmail.com" target="_blank" href="/mc/compose?to=scott.kaminski@gmail.com">scott.kaminski@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div><br>first I would verify that dns is functional both forward and reverse. </div><div><br></div><div>If that is okay try doing a kinit first then try to connect. </div><div><br></div><div><br>Sent from my iPhone</div>
<div><div></div><div class="h5"><div><br>On Jan 22, 2010, at 7:34 PM, Michael Kang <<a rel="nofollow" ymailto="mailto:wxiluo@gmail.com" target="_blank" href="/mc/compose?to=wxiluo@gmail.com">wxiluo@gmail.com</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div>
Hi all,<br><br>I'm trying to configure client ssh access on Fedora 12 and I can't access ipaclient without password.<br><br>I'm following this document:<br><a rel="nofollow" target="_blank" href="http://freeipa.org/docs/1.2/Client_Setup_Guide/en-US/html/sect-Client_Configuration_Guide-Configuring_Fedora_as_an_IPA_Client-Configuring_Client_SSH_Access.html"></a><a rel="nofollow" target="_blank" href="http://freeipa.org/docs/1.2/Client_Setup_Guide/en-US/html/sect-Client_Configuration_Guide-Configuring_Fedora_as_an_IPA_Client-Configuring_Client_SSH_Access.html">http://freeipa.org/docs/1.2/Client_Setup_Guide/en-US/html/sect-Client_Configuration_Guide-Configuring_Fedora_as_an_IPA_Client-Configuring_Client_SSH_Access.html</a><br>
<br>At the end of this document:<br><blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote"><div>
The IPA client should now be fully configured to accept incoming <code>SSH</code> connections and authenticate with the user's <code>Kerberos</code>
credentials. Use the following command on another machine to test the
configuration. This should succeed without asking for a password. </div></blockquote><div>
<blockquote><code> # ssh <a rel="nofollow" ymailto="mailto:admin@ipaclient.example.com" target="_blank" href="/mc/compose?to=admin@ipaclient.example.com"></a><a rel="nofollow" ymailto="mailto:admin@ipaclient.example.com" target="_blank" href="/mc/compose?to=admin@ipaclient.example.com">admin@ipaclient.example.com</a> </code></blockquote>
</div>As I see it, another machine don't need to install any ipa software and it can access ipaclient without password.<br><br>I have three Fedora machine:<br><ul><li><a rel="nofollow" target="_blank" href="http://ipa.example.com"></a><a rel="nofollow" target="_blank" href="http://ipa.example.com">ipa.example.com</a>(IPA Server)</li>
<li><a rel="nofollow" target="_blank" href="http://client.example.com"></a><a rel="nofollow" target="_blank" href="http://client.example.com">client.example.com</a>(IPA Client)</li><li><a rel="nofollow" target="_blank" href="http://node.example.com"></a><a rel="nofollow" target="_blank" href="http://node.example.com">node.example.com</a>(another machine which was not installed ipa-client or ipa-server)</li>
</ul>The <a rel="nofollow" target="_blank" href="http://client.example.com"></a><a rel="nofollow" target="_blank" href="http://client.example.com">client.example.com</a> can access <a rel="nofollow" target="_blank" href="http://ipa.example.com"></a><a rel="nofollow" target="_blank" href="http://ipa.example.com">ipa.example.com</a> without password. But the <a rel="nofollow" target="_blank" href="http://node.example.com"></a><a rel="nofollow" target="_blank" href="http://node.example.com">node.example.com</a> can't access <a rel="nofollow" target="_blank" href="http://client.example.com"></a><a rel="nofollow" target="_blank" href="http://client.example.com">client.example.com</a>.<br>
<br>Do I misunderstand the document or configure incorrect?<br><br>Thanks,<br>Michael<br clear="all"><br>-- <br>Michael Kang（康上明学）<br>There is a giant asleep within every man. When the giant awakens,miracles happen.<br><br>
Personal blog: <a rel="nofollow" target="_blank" href="http://ufusion.org"></a><a rel="nofollow" target="_blank" href="http://ufusion.org">http://ufusion.org</a> - United Fusion<br>
</div></blockquote></div></div><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Freeipa-users mailing list</span><br><span><a rel="nofollow" ymailto="mailto:Freeipa-users@redhat.com" target="_blank" href="/mc/compose?to=Freeipa-users@redhat.com">Freeipa-users@redhat.com</a></span><br>
<span><a rel="nofollow" target="_blank" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></span></div></blockquote></div></blockquote></div><br><br clear="all"><br>-- <br>
Michael Kang（康上明学）<br>There is a giant asleep within every man. When the giant awakens,miracles happen.<br><br>Personal blog: <a rel="nofollow" target="_blank" href="http://ufusion.org">http://ufusion.org</a> - United Fusion<br>
</div><br>-----Inline Attachment Follows-----<br><br><div class="plainMail">_______________________________________________<br>Freeipa-users mailing list<br><a ymailto="mailto:Freeipa-users@redhat.com" href="/mc/compose?to=Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a></div></blockquote></td></tr></table><br>
<hr size=1> <a href="http://us.lrd.yahoo.com/_ylc=X3oDMTFnNHZxc2k1BHRtX2RtZWNoA1RleHQgTGluawR0bV9sbmsDVTExMDM0NjUEdG1fbmV0A1lhaG9vIQ--/SIG=11k7khaee/**http%3A//downloads.yahoo.com/sg/internetexplorer/"> Open emails faster. </a><br> Yahoo! recommends that you upgrade your browser to the new Internet Explorer 8 optimized for Yahoo!.<a href="http://us.lrd.yahoo.com/_ylc=X3oDMTFnNHZxc2k1BHRtX2RtZWNoA1RleHQgTGluawR0bV9sbmsDVTExMDM0NjUEdG1fbmV0A1lhaG9vIQ--/SIG=11k7khaee/**http%3A//downloads.yahoo.com/sg/internetexplorer/">Get it here! (It's free)</a>