<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:10pt"><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><span>Hi Rob</span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span><br></span></div><div style="background-color: transparent;"><span><font size="2">I am sorry for coming back again</font></span></div><div style="background-color: transparent;"><font size="2">i can see client can get the ssh keys from the server but still fails </font></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><font size="2">please suggest.</font></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"> </div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div><div><div><font size="2">[root@ldap1 ssh]# /usr/bin/sss_ssh_authorizedkeys test@eng</font></div><div><font size="2">ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAzvp0xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxDW9X6hJjbcoaY25HrzYvfNOZ37IUe5gvlhO1i+bMhj8vhwlKZN6OKeMW6AM37aJhd7jxhz1R+Cod18YTB+gHkrfwe75kkEKfVyvTjpp9j5DRPeTyGMyWt4VbbyYq1Po4BZT7wOtUjwFq320QD5QnNKU6nbQKsB61xCMQy1Peu0nV/33dQTWHzlGi4uV0MN/KBvaWHmTwN6ZJ34uyEQ8kQ+fStd9XNFREw0iYglk42mNd/SA35njqNlsUbtBAR9ZokruAwAVVZqrfQw== tesst@ldap.eng.</font></div><div><font size="2">ssh-rsa AAAAB3NzaC1yc2EAAAAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx4yb3prkr4oobGuyKJj/yd+S4Pf7OUzZT2xXzpy0TZAjiLnqlioxnhyZqgLO/Rdg5o+wt3R7H7L9kGDfMtAyBqUBrRqQeYgfGWvoVrm2UhkTcq/jxxACbYZq0Jg7OTFXodV40uAuRKqVgev6W4V+ozrTxpeVRElqTM4cEJ96V0UxLUpZUHvT1exFKk4F1crZ2hLEuPVWOlOj8NS/sQX3DDuDS69+CH89z5ftzZZCmohY89y2AsJXfA0piHxg2XE+n test@ubuntu</font></div><div><font size="2">ssh-rsa AAAAB3NzaC1yc2EAAAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxsYsB/hx3gm2fIoKq6fm0g976L26oAmclDi12CpVFYbI/osIjsq6mIpr9de5Qus/n9kIoxTZLHTRuoCEj7xc4PSPG78oE7JoWKLMvBDiwyhXNa+O9X1RgYhfYmS2m+1nGJYC9DG4xo7K60nO6WogBg3T+EwuDjYrVIfB5Rfe4D8iWKqOTNlJ+MzK4Dk8W8hqSJvuQFq5155DsbeqDy00EY1dMaGYVUq81lHEM91oz test@ldap0.eng.</font></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div><div><div><font size="2"># $OpenBSD: sshd_config,v 1.87 2012/07/10 02:19:15 djm Exp $</font></div><div><font size="2"><br></font></div><div><font size="2"># This is the sshd server system-wide configuration file. See</font></div><div><font size="2"># sshd_config(5) for more information.</font></div><div><font size="2"><br></font></div><div><font size="2"># This sshd was compiled with PATH=/usr/local/bin:/usr/bin</font></div><div><font size="2"><br></font></div><div><font size="2"># The strategy used for options in the default sshd_config shipped with</font></div><div><font size="2"># OpenSSH is to specify options with their default value where</font></div><div><font size="2"># possible, but leave them commented. Uncommented options override the</font></div><div><font size="2"># default value.</font></div><div><font size="2"><br></font></div><div><font size="2"># If you want to change the port on a SELinux system, you have to tell</font></div><div><font size="2"># SELinux about this change.</font></div><div><font size="2"># semanage port -a -t ssh_port_t -p tcp #PORTNUMBER</font></div><div><font size="2">#</font></div><div><font size="2">Port 22</font></div><div><font size="2">#AddressFamily any</font></div><div><font size="2">#ListenAddress 0.0.0.0</font></div><div><font size="2">#ListenAddress ::</font></div><div><font size="2"><br></font></div><div><font size="2"># The default requires explicit activation of protocol 1</font></div><div><font size="2">#Protocol 2</font></div><div><font size="2"><br></font></div><div><font size="2"># HostKey for protocol version 1</font></div><div><font size="2">#HostKey /etc/ssh/ssh_host_key</font></div><div><font size="2"># HostKeys for protocol version 2</font></div><div><font size="2">#HostKey /etc/ssh/ssh_host_rsa_key</font></div><div><font size="2">#HostKey /etc/ssh/ssh_host_dsa_key</font></div><div><font size="2">#HostKey /etc/ssh/ssh_host_ecdsa_key</font></div><div><font size="2"><br></font></div><div><font size="2"># Lifetime and size of ephemeral version 1 server key</font></div><div><font size="2">#KeyRegenerationInterval 1h</font></div><div><font size="2">#ServerKeyBits 1024</font></div><div><font size="2"><br></font></div><div><font size="2"># Logging</font></div><div><font size="2"># obsoletes QuietMode and FascistLogging</font></div><div><font size="2">#SyslogFacility AUTH</font></div><div><font size="2">SyslogFacility AUTHPRIV</font></div><div><font size="2">#LogLevel INFO</font></div><div><font size="2"><br></font></div><div><font size="2"># Authentication:</font></div><div><font size="2"><br></font></div><div><font size="2">#LoginGraceTime 2m</font></div><div><font size="2">#PermitRootLogin yes</font></div><div><font size="2">#StrictModes yes</font></div><div><font size="2">#MaxAuthTries 6</font></div><div><font size="2">#MaxSessions 10</font></div><div><font size="2"><br></font></div><div><font size="2">#RSAAuthentication yes</font></div><div><font size="2">#PubkeyAuthentication yes</font></div><div><font size="2"><br></font></div><div><font size="2"># The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2</font></div><div><font size="2"># but this is overridden so installations will only check .ssh/authorized_keys</font></div><div><font size="2">AuthorizedKeysFile .ssh/authorized_keys</font></div><div><font size="2"><br></font></div><div><font size="2">#AuthorizedKeysCommand none</font></div><div><font size="2">AuthorizedKeysCommandUser nobody</font></div><div><font size="2"><br></font></div><div><font size="2">#AuthorizedPrincipalsFile none</font></div><div><font size="2"><br></font></div><div><font size="2"># For this to work you will also need host keys in /etc/ssh/ssh_known_hosts</font></div><div><font size="2">#RhostsRSAAuthentication no</font></div><div><font size="2"># similar for protocol version 2</font></div><div><font size="2">#HostbasedAuthentication no</font></div><div><font size="2"># Change to yes if you don't trust ~/.ssh/known_hosts for</font></div><div><font size="2"># RhostsRSAAuthentication and HostbasedAuthentication</font></div><div><font size="2">#IgnoreUserKnownHosts no</font></div><div><font size="2"># Don't read the user's ~/.rhosts and ~/.shosts files</font></div><div><font size="2">#IgnoreRhosts yes</font></div><div><font size="2"><br></font></div><div><font size="2"># To disable tunneled clear text passwords, change to no here!</font></div><div><font size="2">#PasswordAuthentication yes</font></div><div><font size="2">#PermitEmptyPasswords no</font></div><div><font size="2">PasswordAuthentication yes</font></div><div><font size="2"><br></font></div><div><font size="2"># Change to no to disable s/key passwords</font></div><div><font size="2">#ChallengeResponseAuthentication yes</font></div><div><font size="2">ChallengeResponseAuthentication no</font></div><div><font size="2"><br></font></div><div><font size="2"># Kerberos options</font></div><div><font size="2">#KerberosAuthentication no</font></div><div><font size="2">#KerberosOrLocalPasswd yes</font></div><div><font size="2">#KerberosTicketCleanup yes</font></div><div><font size="2">#KerberosGetAFSToken no</font></div><div><font size="2">#KerberosUseKuserok yes</font></div><div><font size="2"><br></font></div><div><font size="2"># GSSAPI options</font></div><div><font size="2">#GSSAPIAuthentication yes</font></div><div><font size="2">#GSSAPICleanupCredentials yes</font></div><div><font size="2">GSSAPICleanupCredentials yes</font></div><div><font size="2">#GSSAPIStrictAcceptorCheck yes</font></div><div><font size="2">#GSSAPIKeyExchange no</font></div><div><font size="2"><br></font></div><div><font size="2"># Set this to 'yes' to enable PAM authentication, account processing,</font></div><div><font size="2"># and session processing. If this is enabled, PAM authentication will</font></div><div><font size="2"># be allowed through the ChallengeResponseAuthentication and</font></div><div><font size="2"># PasswordAuthentication. Depending on your PAM configuration,</font></div><div><font size="2"># PAM authentication via ChallengeResponseAuthentication may bypass</font></div><div><font size="2"># the setting of "PermitRootLogin without-password".</font></div><div><font size="2"># If you just want the PAM account and session checks to run without</font></div><div><font size="2"># PAM authentication, then enable this but set PasswordAuthentication</font></div><div><font size="2"># and ChallengeResponseAuthentication to 'no'.</font></div><div><font size="2"># WARNING: 'UsePAM no' is not supported in Fedora and may cause several</font></div><div><font size="2"># problems.</font></div><div><font size="2">#UsePAM no</font></div><div><font size="2"><br></font></div><div><font size="2">#AllowAgentForwarding yes</font></div><div><font size="2">#AllowTcpForwarding yes</font></div><div><font size="2">#GatewayPorts no</font></div><div><font size="2">#X11Forwarding no</font></div><div><font size="2">X11Forwarding yes</font></div><div><font size="2">#X11DisplayOffset 10</font></div><div><font size="2">#X11UseLocalhost yes</font></div><div><font size="2">#PrintMotd yes</font></div><div><font size="2">#PrintLastLog yes</font></div><div><font size="2">#TCPKeepAlive yes</font></div><div><font size="2">#UseLogin no</font></div><div><font size="2">UsePrivilegeSeparation sandbox # Default for new installations.</font></div><div><font size="2">#PermitUserEnvironment no</font></div><div><font size="2">#Compression delayed</font></div><div><font size="2">#ClientAliveInterval 0</font></div><div><font size="2">#ClientAliveCountMax 3</font></div><div><font size="2">#ShowPatchLevel no</font></div><div><font size="2">#UseDNS yes</font></div><div><font size="2">#PidFile /var/run/sshd.pid</font></div><div><font size="2">#MaxStartups 10</font></div><div><font size="2">#PermitTunnel no</font></div><div><font size="2">#ChrootDirectory none</font></div><div><font size="2">#VersionAddendum none</font></div><div><font size="2"><br></font></div><div><font size="2"># no default banner path</font></div><div><font size="2">#Banner none</font></div><div><font size="2"><br></font></div><div><font size="2"># Accept locale-related environment variables</font></div><div><font size="2">AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES</font></div><div><font size="2">AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT</font></div><div><font size="2">AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE</font></div><div><font size="2">AcceptEnv XMODIFIERS</font></div><div><font size="2"><br></font></div><div><font size="2"># override default of no subsystems</font></div><div><font size="2">Subsystem sftp /usr/libexec/openssh/sftp-server</font></div><div><font size="2"><br></font></div><div><font size="2"># Uncomment this if you want to use .local domain</font></div><div><font size="2">#Host *.local</font></div><div><font size="2"># CheckHostIP no</font></div><div><font size="2"><br></font></div><div><font size="2"># Example of overriding settings on a per-user basis</font></div><div><font size="2">#Match User anoncvs</font></div><div><font size="2"># X11Forwarding no</font></div><div><font size="2"># AllowTcpForwarding no</font></div><div><font size="2"># ForceCommand cvs server</font></div><div><font size="2">KerberosAuthentication no</font></div><div><font size="2">PubkeyAuthentication yes</font></div><div><font size="2">UsePAM yes</font></div><div><font size="2">GSSAPIAuthentication yes</font></div><div><font size="2">AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys</font></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;">Nareshchandra Paturi<br><br>14, St. Augustine’s Court, <br>Mornington Road,<br>london.<br>E11 3BQ.<br>Mob:07466666001,07856918100<br>Ph:02082579579<br></div> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> Rob Crittenden <rcritten@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> naresh reddy <nareshbtech@yahoo.com>; "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, April 23, 2013 4:14 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] Freeipa -ssh keys<br> </font> </div> <div class="y_msg_container"><br> naresh reddy wrote:<br>> Hi Rob<br>><br>> Thank you very much<br>> but i tried the same with two fedora systems<br>> and got the similar issue<br>><br>> i think the error is due to kerberos not installed but i can see it is<br>> installed on the client and sever<br>> please suggest.<br><br>sssd needs to look up the keys in IPA so the client needs to be enrolled <br>for this to work.<br><br>rob<br><br>><br>> [np@ldap ~]$ ssh -vvv <a ymailto="mailto:np@eng.switchlab.net" href="mailto:np@eng.switchlab.net">np@eng.switchlab.net</a>@ldap1.eng.switchlab.net<br>> OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010<br>> debug1: Reading configuration data /etc/ssh/ssh_config<br>> debug1: Applying options for *<br>> debug2: ssh_connect: needpriv 0<br>> debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy<br>> -p 22 <a target="_blank" href="http://ldap1.eng.switchlab.net/">ldap1.eng.switchlab.net</a><br>> debug1: identity file /home/np/.ssh/identity type -1<br>> debug3: Not a RSA1 key file /home/np/.ssh/id_rsa.<br>> debug2: key_type_from_name: unknown key type '-----BEGIN'<br>> debug3: key_read: missing keytype<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug3: key_read: missing whitespace<br>> debug2: key_type_from_name: unknown key type '-----END'<br>> debug3: key_read: missing keytype<br>> debug1: identity file /home/np/.ssh/id_rsa type 1<br>> debug1: identity file /home/np/.ssh/id_dsa type -1<br>> debug1: permanently_drop_suid: 501<br>> debug1: Remote protocol version 2.0, remote software version OpenSSH_6.1<br>> debug1: match: OpenSSH_6.1 pat OpenSSH*<br>> debug1: Enabling compatibility mode for protocol 2.0<br>> debug1: Local version string SSH-2.0-OpenSSH_5.3<br>> debug2: fd 5 setting O_NONBLOCK<br>> debug2: fd 4 setting O_NONBLOCK<br>> debug1: SSH2_MSG_KEXINIT sent<br>> debug3: Wrote 792 bytes for a total of 813<br>> debug1: SSH2_MSG_KEXINIT received<br>> debug2: kex_parse_kexinit:<br>> diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1<br>> debug2: kex_parse_kexinit: ssh-rsa,ssh-dss<br>> debug2: kex_parse_kexinit:<br>> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a ymailto="mailto:rijndael-cbc@lysator.liu.se" href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a><br>> debug2: kex_parse_kexinit:<br>> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a ymailto="mailto:rijndael-cbc@lysator.liu.se" href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a><br>> debug2: kex_parse_kexinit:<br>> hmac-md5,hmac-sha1,<a ymailto="mailto:umac-64@openssh.com" href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,hmac-ripemd160,<a ymailto="mailto:hmac-ripemd160@openssh.com" href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96<br>> debug2: kex_parse_kexinit:<br>> hmac-md5,hmac-sha1,<a ymailto="mailto:umac-64@openssh.com" href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,hmac-ripemd160,<a ymailto="mailto:hmac-ripemd160@openssh.com" href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96<br>> debug2: kex_parse_kexinit: none,<a ymailto="mailto:zlib@openssh.com" href="mailto:zlib@openssh.com">zlib@openssh.com</a>,zlib<br>> debug2: kex_parse_kexinit: none,<a ymailto="mailto:zlib@openssh.com" href="mailto:zlib@openssh.com">zlib@openssh.com</a>,zlib<br>> debug2: kex_parse_kexinit:<br>> debug2: kex_parse_kexinit:<br>> debug2: kex_parse_kexinit: first_kex_follows 0<br>> debug2: kex_parse_kexinit: reserved 0<br>> debug2: kex_parse_kexinit:<br>> diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1<br>> debug2: kex_parse_kexinit: ssh-rsa,ssh-dss<br>> debug2: kex_parse_kexinit:<br>> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a ymailto="mailto:rijndael-cbc@lysator.liu.se" href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a><br>> debug2: kex_parse_kexinit:<br>> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a ymailto="mailto:rijndael-cbc@lysator.liu.se" href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a><br>> debug2: kex_parse_kexinit:<br>> hmac-md5,hmac-sha1,<a ymailto="mailto:umac-64@openssh.com" href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,<a ymailto="mailto:hmac-ripemd160@openssh.com" href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96<br>> debug2: kex_parse_kexinit:<br>> hmac-md5,hmac-sha1,<a ymailto="mailto:umac-64@openssh.com" href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,<a ymailto="mailto:hmac-ripemd160@openssh.com" href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96<br>> debug2: kex_parse_kexinit: none,<a ymailto="mailto:zlib@openssh.com" href="mailto:zlib@openssh.com">zlib@openssh.com</a><br>> debug2: kex_parse_kexinit: none,<a ymailto="mailto:zlib@openssh.com" href="mailto:zlib@openssh.com">zlib@openssh.com</a><br>> debug2: kex_parse_kexinit:<br>> debug2: kex_parse_kexinit:<br>> debug2: kex_parse_kexinit: first_kex_follows 0<br>> debug2: kex_parse_kexinit: reserved 0<br>> debug2: mac_setup: found hmac-md5<br>> debug1: kex: server->client aes128-ctr hmac-md5 none<br>> debug2: mac_setup: found hmac-md5<br>> debug1: kex: client->server aes128-ctr hmac-md5 none<br>> debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent<br>> debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP<br>> debug3: Wrote 24 bytes for a total of 837<br>> debug2: dh_gen_key: priv key bits set: 144/256<br>> debug2: bits set: 516/1024<br>> debug1: SSH2_MSG_KEX_DH_GEX_INIT sent<br>> debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY<br>> debug3: Wrote 144 bytes for a total of 981<br>> debug3: check_host_in_hostfile: filename /home/np/.ssh/known_hosts<br>> debug3: check_host_in_hostfile: match line 2<br>> debug1: Host 'ldap1.eng.switchlab.net' is known and matches the RSA host<br>> key.<br>> debug1: Found key in /home/np/.ssh/known_hosts:2<br>> debug2: bits set: 499/1024<br>> debug1: ssh_rsa_verify: signature correct<br>> debug2: kex_derive_keys<br>> debug2: set_newkeys: mode 1<br>> debug1: SSH2_MSG_NEWKEYS sent<br>> debug1: expecting SSH2_MSG_NEWKEYS<br>> debug3: Wrote 16 bytes for a total of 997<br>> debug2: set_newkeys: mode 0<br>> debug1: SSH2_MSG_NEWKEYS received<br>> debug1: SSH2_MSG_SERVICE_REQUEST sent<br>> debug3: Wrote 48 bytes for a total of 1045<br>> debug2: service_accept: ssh-userauth<br>> debug1: SSH2_MSG_SERVICE_ACCEPT received<br>> debug2: key: /home/np/.ssh/identity ((nil))<br>> debug2: key: /home/np/.ssh/id_rsa (0x7f9ee71687b0)<br>> debug2: key: /home/np/.ssh/id_dsa ((nil))<br>> debug3: Wrote 80 bytes for a total of 1125<br>> debug1: Authentications that can continue:<br>> publickey,gssapi-keyex,gssapi-with-mic,password<br>> debug3: start over, passed a different list<br>> publickey,gssapi-keyex,gssapi-with-mic,password<br>> debug3: preferred<br>> gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password<br>> debug3: authmethod_lookup gssapi-keyex<br>> debug3: remaining preferred:<br>> gssapi-with-mic,publickey,keyboard-interactive,password<br>> debug3: authmethod_is_enabled gssapi-keyex<br>> debug1: Next authentication method: gssapi-keyex<br>> debug1: No valid Key exchange context<br>> debug2: we did not send a packet, disable method<br>> debug3: authmethod_lookup gssapi-with-mic<br>> debug3: remaining preferred: publickey,keyboard-interactive,password<br>> debug3: authmethod_is_enabled gssapi-with-mic<br>> debug1: Next authentication method: gssapi-with-mic<br>> debug1: Unspecified GSS failure. Minor code may provide more information<br>> Credentials cache file '/tmp/krb5cc_501' not found<br>><br>> debug1: Unspecified GSS failure. Minor code may provide more information<br>> Credentials cache file '/tmp/krb5cc_501' not found<br>><br>> debug1: Unspecified GSS failure. Minor code may provide more information<br>><br>><br>> debug1: Unspecified GSS failure. Minor code may provide more information<br>> Credentials cache file '/tmp/krb5cc_501' not found<br>><br>> debug2: we did not send a packet, disable method<br>> debug3: authmethod_lookup publickey<br>> debug3: remaining preferred: keyboard-interactive,password<br>> debug3: authmethod_is_enabled publickey<br>> debug1: Next authentication method: publickey<br>> debug1: Trying private key: /home/np/.ssh/identity<br>> debug3: no such identity: /home/np/.ssh/identity<br>> debug1: Offering public key: /home/np/.ssh/id_rsa<br>> debug3: send_pubkey_test<br>> debug2: we sent a publickey packet, wait for reply<br>> debug3: Wrote 384 bytes for a total of 1509<br>> debug1: Authentications that can continue:<br>> publickey,gssapi-keyex,gssapi-with-mic,password<br>> debug1: Trying private key: /home/np/.ssh/id_dsa<br>> debug3: no such identity: /home/np/.ssh/id_dsa<br>> debug2: we did not send a packet, disable method<br>> debug3: authmethod_lookup password<br>> debug3: remaining preferred: ,password<br>> debug3: authmethod_is_enabled password<br>> debug1: Next authentication method: password<br>> <a ymailto="mailto:np@eng.switchlab.net" href="mailto:np@eng.switchlab.net">np@eng.switchlab.net</a>@ldap1.eng.switchlab.net's password:<br>> debug3: packet_send2: adding 48 (len 75 padlen 5 extra_pad 64)<br>> debug2: we sent a password packet, wait for reply<br>> debug3: Wrote 144 bytes for a total of 1653<br>> debug1: Authentication succeeded (password).<br>> debug1: channel 0: new [client-session]<br>> debug3: ssh_session2_open: channel_new: 0<br>> debug2: channel 0: send open<br>> debug1: Requesting <a ymailto="mailto:no-more-sessions@openssh.com" href="mailto:no-more-sessions@openssh.com">no-more-sessions@openssh.com</a><br>> debug1: Entering interactive session.<br>> debug3: Wrote 128 bytes for a total of 1781<br>> debug2: callback start<br>> debug2: client_session2_setup: id 0<br>> debug2: channel 0: request pty-req confirm 1<br>> debug1: Sending environment.<br>> debug3: Ignored env HOSTNAME<br>> debug3: Ignored env SHELL<br>> debug3: Ignored env TERM<br>> debug3: Ignored env HISTSIZE<br>> debug3: Ignored env USER<br>> debug3: Ignored env LS_COLORS<br>> debug3: Ignored env MAIL<br>> debug3: Ignored env PATH<br>> debug3: Ignored env PWD<br>> debug1: Sending env LANG = en_US.UTF-8<br>> debug2: channel 0: request env confirm 0<br>> debug3: Ignored env HISTCONTROL<br>> debug3: Ignored env SHLVL<br>> debug3: Ignored env HOME<br>> debug3: Ignored env LOGNAME<br>> debug3: Ignored env CVS_RSH<br>> debug3: Ignored env LESSOPEN<br>> debug3: Ignored env G_BROKEN_FILENAMES<br>> debug3: Ignored env _<br>> debug2: channel 0: request shell confirm 1<br>> debug2: callback done<br>> debug2: channel 0: open confirm rwindow 0 rmax 32768<br>> debug3: Wrote 448 bytes for a total of 2229<br>> debug2: channel_input_status_confirm: type 99 id 0<br>> debug2: PTY allocation request accepted on channel 0<br>> debug2: channel 0: rcvd adjust 2097152<br>> debug2: channel_input_status_confirm: type 99 id 0<br>> debug2: shell request accepted on channel 0<br>> Last failed login: Tue Apr 23 14:37:59 BST 2013 from 10.30.2.177 on<br>> ssh:notty<br>> There were 8 failed login attempts since the last successful login.<br>> -sh-4.2$ debug3: Wrote 48 bytes for a total of 2277<br>> edebug3: Wrote 48 bytes for a total of 2325<br>> xdebug3: Wrote 48 bytes for a total of 2373<br>> idebug3: Wrote 48 bytes for a total of 2421<br>> tdebug3: Wrote 48 bytes for a total of 2469<br>><br>> logout<br>> debug2: channel 0: rcvd eof<br>> debug2: channel 0: output open -> drain<br>> debug2: channel 0: obuf empty<br>> debug2: channel 0: close_write<br>> debug2: channel 0: output drain -> closed<br>> debug1: client_input_channel_req: channel 0 rtype exit-status reply 0<br>> debug1: client_input_channel_req: channel 0 rtype <a ymailto="mailto:eow@openssh.com" href="mailto:eow@openssh.com">eow@openssh.com</a> reply 0<br>> debug2: channel 0: rcvd eow<br>> debug2: channel 0: close_read<br>> debug2: channel 0: input open -> closed<br>> debug2: channel 0: rcvd close<br>> debug3: channel 0: will not send data after close<br>> debug2: channel 0: almost dead<br>> debug2: channel 0: gc: notify user<br>> debug2: channel 0: gc: user detached<br>> debug2: channel 0: send close<br>> debug2: channel 0: is dead<br>> debug2: channel 0: garbage collecting<br>> debug1: channel 0: free: client-session, nchannels 1<br>> debug3: channel 0: status: The following connections are open:<br>> #0 client-session (t4 r0 i3/0 o3/0 fd -1/-1 cfd -1)<br>><br>> debug3: channel 0: close_fds r -1 w -1 e 7 c -1<br>> debug3: Wrote 32 bytes for a total of 2501<br>> debug3: Wrote 64 bytes for a total of 2565<br>> Connection to ldap1.eng.switchlab.net closed.<br>> Transferred: sent 2288, received 2656 bytes, in 1.5 seconds<br>> Bytes per second: sent 1563.3, received 1814.8<br>> debug1: Exit status 0<br>><br>> Nareshchandra Paturi<br>><br>> 14, St. Augustine’s Court,<br>> Mornington Road,<br>> london.<br>> E11 3BQ.<br>> Mob:07466666001,07856918100<br>> Ph:02082579579<br>> ------------------------------------------------------------------------<br>> *From:* Rob Crittenden <<a ymailto="mailto:rcritten@redhat.com" href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>><br>> *To:* Naresh Chandra R Paturi <<a ymailto="mailto:nareshbtech@yahoo.com" href="mailto:nareshbtech@yahoo.com">nareshbtech@yahoo.com</a>>;<br>> <a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>> *Sent:* Saturday, April 20, 2013 8:11 PM<br>> *Subject:* Re: [Freeipa-users] Freeipa -ssh keys<br>><br>> Naresh Chandra R Paturi wrote:<br>> > Hi all<br>> ><br>> > I am new to freeipa<br>> > we have a group of linux servers where we are tyring to establish<br>> > password less logins, in order to do this we need to copy ssh keys of<br>> > all uses to each and every cleint server . so we are trying to establish<br>> > freeipa central server where we store the keys of all the users.<br>> > we got free ipa working with passwords but trying to authenticate with<br>> > keys.<br>> > is this achievable. if you please kindly direct me.<br>><br>> With IPA 3.0 this is configured for you automatically by default on<br>> RHEL/Fedora systems.<br>><br>> <a href="https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/Identity_Management_Guide/index.html#user-keys" target="_blank">https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/Identity_Management_Guide/index.html#user-keys</a><br>><br>> I believe you will need an openssh patch for this to work on a<br>> Debian/Ubuntu client. I believe it also requires sssd.<br>><br>> rob<br>><br>><br><br><br><br></div> </div> </div> </div></body></html>