<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:10pt"><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><span>Hi Jan</span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span><br></span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">I tried to flow this</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><a href="https://fedoraproject.org/wiki/QA:Testcase_FreeIPA_realmd_ssh">https://fedoraproject.org/wiki/QA:Testcase_FreeIPA_realmd_ssh</a><br></div><div style="font-family: 'times new roman', 'new
york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><a href="https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/openssh-sssd.html">https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/openssh-sssd.html</a><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">still unable to loggin via ssh keys</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">Please kindly suggest</div><div style="background-color:
transparent;"><div style="background-color: transparent;"><font size="2"><br></font></div><div style="background-color: transparent;"><font size="2">OpenSSH_6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013</font></div><div style="background-color: transparent;"><font size="2">debug1: Reading configuration data /etc/ssh/ssh_config</font></div><div style="background-color: transparent;"><font size="2">debug1: /etc/ssh/ssh_config line 55: Applying options for *</font></div><div style="background-color: transparent;"><font size="2">debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 22 -d ENG.SWITCHLAB.COM ldap1.eng.switchlab.net --debug 40</font></div><div style="background-color: transparent;"><font size="2">debug1: identity file /home/np/.ssh/id_rsa type 1</font></div><div style="background-color: transparent;"><font size="2">debug1: identity file /home/np/.ssh/id_rsa-cert type -1</font></div><div style="background-color:
transparent;"><font size="2">debug1: identity file /home/np/.ssh/id_dsa type -1</font></div><div style="background-color: transparent;"><font size="2">debug1: identity file /home/np/.ssh/id_dsa-cert type -1</font></div><div style="background-color: transparent;"><font size="2">debug1: permanently_drop_suid: 1000</font></div><div style="background-color: transparent;"><font size="2">(Thu Apr 25 17:45:58:088846 2013) [/usr/bin/sss_ssh_knownhostsproxy] [main] (0x0040): sss_ssh_get_ent() failed (2): No such file or directory</font></div><div style="background-color: transparent;"><font size="2">debug1: Remote protocol version 2.0, remote software version OpenSSH_6.1</font></div><div style="background-color: transparent;"><font size="2">debug1: match: OpenSSH_6.1 pat OpenSSH*</font></div><div style="background-color: transparent;"><font size="2">debug1: Enabling compatibility mode for protocol 2.0</font></div><div style="background-color: transparent;"><font
size="2">debug1: Local version string SSH-2.0-OpenSSH_6.1</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_KEXINIT sent</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_KEXINIT received</font></div><div style="background-color: transparent;"><font size="2">debug1: kex: server->client aes128-ctr hmac-md5 none</font></div><div style="background-color: transparent;"><font size="2">debug1: kex: client->server aes128-ctr hmac-md5 none</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent</font></div><div style="background-color: transparent;"><font size="2">debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_KEX_DH_GEX_INIT sent</font></div><div style="background-color: transparent;"><font size="2">debug1: expecting
SSH2_MSG_KEX_DH_GEX_REPLY</font></div><div style="background-color: transparent;"><font size="2">debug1: Server host key: RSA 22:fd:38:1c:25:80:fc:15:87:31:7b:b9:7b:59:f6:07</font></div><div style="background-color: transparent;"><font size="2">debug1: Host 'ldap1.eng.switchlab.net' is known and matches the RSA host key.</font></div><div style="background-color: transparent;"><font size="2">debug1: Found key in /home/np/.ssh/known_hosts:1</font></div><div style="background-color: transparent;"><font size="2">debug1: ssh_rsa_verify: signature correct</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_NEWKEYS sent</font></div><div style="background-color: transparent;"><font size="2">debug1: expecting SSH2_MSG_NEWKEYS</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_NEWKEYS received</font></div><div style="background-color: transparent;"><font size="2">debug1: Roaming not allowed
by server</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_SERVICE_REQUEST sent</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_SERVICE_ACCEPT received</font></div><div style="background-color: transparent;"><font size="2">debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic</font></div><div style="background-color: transparent;"><font size="2">debug1: Next authentication method: gssapi-keyex</font></div><div style="background-color: transparent;"><font size="2">debug1: No valid Key exchange context</font></div><div style="background-color: transparent;"><font size="2">debug1: Next authentication method: gssapi-with-mic</font></div><div style="background-color: transparent;"><font size="2">debug1: Unspecified GSS failure. Minor code may provide more information</font></div><div style="background-color: transparent;"><font size="2">Ticket
expired</font></div><div style="background-color: transparent;"><font size="2"><br></font></div><div style="background-color: transparent;"><font size="2">debug1: Unspecified GSS failure. Minor code may provide more information</font></div><div style="background-color: transparent;"><font size="2">Ticket expired</font></div><div style="background-color: transparent;"><font size="2"><br></font></div><div style="background-color: transparent;"><font size="2">debug1: Unspecified GSS failure. Minor code may provide more information</font></div><div style="background-color: transparent;"><font size="2"><br></font></div><div style="background-color: transparent;"><font size="2"><br></font></div><div style="background-color: transparent;"><font size="2">debug1: Unspecified GSS failure. Minor code may provide more information</font></div><div style="background-color: transparent;"><font size="2">Matching credential not found</font></div><div
style="background-color: transparent;"><font size="2"><br></font></div><div style="background-color: transparent;"><font size="2">debug1: Next authentication method: publickey</font></div><div style="background-color: transparent;"><font size="2">debug1: Offering RSA public key: /home/np/.ssh/id_rsa</font></div><div style="background-color: transparent;"><font size="2">debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic</font></div><div style="background-color: transparent;"><font size="2">debug1: Trying private key: /home/np/.ssh/id_dsa</font></div><div style="background-color: transparent;"><font size="2">debug1: No more authentication methods to try.</font></div><div style="background-color: transparent;"><font size="2">Permission denied (publickey,gssapi-keyex,gssapi-with-mic).</font></div><div style="background-color: transparent;"><font size="2">[np@ldap0 ~]$ ssh -v
np@eng.switchlab.net@ldap1.eng.switchlab.net</font></div><div style="background-color: transparent;"><font size="2">OpenSSH_6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013</font></div><div style="background-color: transparent;"><font size="2">debug1: Reading configuration data /etc/ssh/ssh_config</font></div><div style="background-color: transparent;"><font size="2">debug1: /etc/ssh/ssh_config line 55: Applying options for *</font></div><div style="background-color: transparent;"><font size="2">debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 22 -d ENG.SWITCHLAB.COM ldap1.eng.switchlab.net --debug 40</font></div><div style="background-color: transparent;"><font size="2">debug1: identity file /home/np/.ssh/id_rsa type 1</font></div><div style="background-color: transparent;"><font size="2">debug1: identity file /home/np/.ssh/id_rsa-cert type -1</font></div><div style="background-color: transparent;"><font size="2">debug1: identity
file /home/np/.ssh/id_dsa type -1</font></div><div style="background-color: transparent;"><font size="2">debug1: identity file /home/np/.ssh/id_dsa-cert type -1</font></div><div style="background-color: transparent;"><font size="2">debug1: permanently_drop_suid: 1000</font></div><div style="background-color: transparent;"><font size="2">(Thu Apr 25 18:06:04:463614 2013) [/usr/bin/sss_ssh_knownhostsproxy] [main] (0x0040): sss_ssh_get_ent() failed (2): No such file or directory</font></div><div style="background-color: transparent;"><font size="2">debug1: Remote protocol version 2.0, remote software version OpenSSH_6.1</font></div><div style="background-color: transparent;"><font size="2">debug1: match: OpenSSH_6.1 pat OpenSSH*</font></div><div style="background-color: transparent;"><font size="2">debug1: Enabling compatibility mode for protocol 2.0</font></div><div style="background-color: transparent;"><font size="2">debug1: Local version string
SSH-2.0-OpenSSH_6.1</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_KEXINIT sent</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_KEXINIT received</font></div><div style="background-color: transparent;"><font size="2">debug1: kex: server->client aes128-ctr hmac-md5 none</font></div><div style="background-color: transparent;"><font size="2">debug1: kex: client->server aes128-ctr hmac-md5 none</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent</font></div><div style="background-color: transparent;"><font size="2">debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_KEX_DH_GEX_INIT sent</font></div><div style="background-color: transparent;"><font size="2">debug1: expecting
SSH2_MSG_KEX_DH_GEX_REPLY</font></div><div style="background-color: transparent;"><font size="2">debug1: Server host key: RSA 22:fd:38:1c:25:80:fc:15:87:31:7b:b9:7b:59:f6:07</font></div><div style="background-color: transparent;"><font size="2">debug1: Host 'ldap1.eng.switchlab.net' is known and matches the RSA host key.</font></div><div style="background-color: transparent;"><font size="2">debug1: Found key in /home/np/.ssh/known_hosts:1</font></div><div style="background-color: transparent;"><font size="2">debug1: ssh_rsa_verify: signature correct</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_NEWKEYS sent</font></div><div style="background-color: transparent;"><font size="2">debug1: expecting SSH2_MSG_NEWKEYS</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_NEWKEYS received</font></div><div style="background-color: transparent;"><font size="2">debug1: Roaming not allowed
by server</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_SERVICE_REQUEST sent</font></div><div style="background-color: transparent;"><font size="2">debug1: SSH2_MSG_SERVICE_ACCEPT received</font></div><div style="background-color: transparent;"><font size="2">debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic</font></div><div style="background-color: transparent;"><font size="2">debug1: Next authentication method: gssapi-keyex</font></div><div style="background-color: transparent;"><font size="2">debug1: No valid Key exchange context</font></div><div style="background-color: transparent;"><font size="2">debug1: Next authentication method: gssapi-with-mic</font></div><div style="background-color: transparent;"><font size="2">debug1: Unspecified GSS failure. Minor code may provide more information</font></div><div style="background-color: transparent;"><font size="2">Ticket
expired</font></div><div style="background-color: transparent;"><font size="2"><br></font></div><div style="background-color: transparent;"><font size="2">debug1: Unspecified GSS failure. Minor code may provide more information</font></div><div style="background-color: transparent;"><font size="2">Ticket expired</font></div><div style="background-color: transparent;"><font size="2"><br></font></div><div style="background-color: transparent;"><font size="2">debug1: Unspecified GSS failure. Minor code may provide more information</font></div><div style="background-color: transparent;"><font size="2"><br></font></div><div style="background-color: transparent;"><font size="2"><br></font></div><div style="background-color: transparent;"><font size="2">debug1: Unspecified GSS failure. Minor code may provide more information</font></div><div style="background-color: transparent;"><font size="2">Matching credential not found</font></div><div
style="background-color: transparent;"><font size="2"><br></font></div><div style="background-color: transparent;"><font size="2">debug1: Next authentication method: publickey</font></div><div style="background-color: transparent;"><font size="2">debug1: Offering RSA public key: /home/np/.ssh/id_rsa</font></div><div style="background-color: transparent;"><font size="2">debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic</font></div><div style="background-color: transparent;"><font size="2">debug1: Trying private key: /home/np/.ssh/id_dsa</font></div><div style="background-color: transparent;"><font size="2">debug1: No more authentication methods to try.</font></div><div style="background-color: transparent;"><font size="2">Permission denied (publickey,gssapi-keyex,gssapi-with-mic).</font></div><div style="color: rgb(0, 0, 0); font-family: 'times new roman', 'new york', times, serif; font-size: 13px; font-style:
normal;"><br></div></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"> </div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;">Nareshchandra Paturi<br><br>14, St. Augustine’s Court, <br>Mornington Road,<br>london.<br>E11 3BQ.<br>Mob:07466666001,07856918100<br>Ph:02082579579<br></div> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> naresh reddy <nareshbtech@yahoo.com><br> <b><span style="font-weight: bold;">To:</span></b> Jan Cholasta <jcholast@redhat.com> <br><b><span style="font-weight: bold;">Cc:</span></b> Rob Crittenden
<rcritten@redhat.com>; "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Thursday, April 25, 2013 4:24 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] Freeipa -ssh keys<br> </font> </div> <div class="y_msg_container"><br><div id="yiv8211745348"><div><div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"><span>Hi Jan</span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span><br></span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style:
normal;"><span>yes thats correct clinet is ldap1 and server is ldap1.</span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 13px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span><br></span></div><div style="background-color:transparent;"><span><div style="background-color:transparent;"><div style="
background-color:transparent;"><div style="background-color:transparent;"><font size="2">root@ldap1 ssh]# /usr/bin/sss_ssh_knownhostsproxy -p 22 ldap1.eng.switchlab.net --debug 10</font></div><div style="background-color:transparent;"><font size="2">SSH-2.0-OpenSSH_6.1</font></div><div style="background-color:transparent;"><font size="2"><br></font></div><div style="background-color:transparent;"><font size="2">Protocol mismatch.</font></div><div><span style="font-size:13px;background-color:transparent;">[root@ldap1 ssh]# /usr/bin/sss_ssh_authorizedkeys test@eng</span><br></div></div></div><div style="color: rgb(0, 0, 0); font-family: 'times new roman', 'new york', times, serif; font-size: 13px; font-style: normal;"><div><div><font size="2">ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAQEAzvp0xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxDW9X6hJjbcoaY25HrzYvfNOZ37IUe5gvlhO1i+bMhj8vhwlKZN6OKeMW6AM37aJhd7jxhz1R+Cod18YTB+gHkrfwe75kkEKfVyvTjpp9j5DRPeTyGMyWt4VbbyYq1Po4BZT7wOtUjwFq320QD5QnNKU6nbQKsB61xCMQy1Peu0nV/33dQTWHzlGi4uV0MN/KBvaWHmTwN6ZJ34uyEQ8kQ+fStd9XNFREw0iYglk42mNd/SA35njqNlsUbtBAR9ZokruAwAVVZqrfQw== tesst@ldap.eng.</font></div><div><font size="2">ssh-rsa AAAAB3NzaC1yc2EAAAAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx4yb3prkr4oobGuyKJj/yd+S4Pf7OUzZT2xXzpy0TZAjiLnqlioxnhyZqgLO/Rdg5o+wt3R7H7L9kGDfMtAyBqUBrRqQeYgfGWvoVrm2UhkTcq/jxxACbYZq0Jg7OTFXodV40uAuRKqVgev6W4V+ozrTxpeVRElqTM4cEJ96V0UxLUpZUHvT1exFKk4F1crZ2hLEuPVWOlOj8NS/sQX3DDuDS69+CH89z5ftzZZCmohY89y2AsJXfA0piHxg2XE+n test@ubuntu</font></div><div><font size="2">ssh-rsa
AAAAB3NzaC1yc2EAAAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxsYsB/hx3gm2fIoKq6fm0g976L26oAmclDi12CpVFYbI/osIjsq6mIpr9de5Qus/n9kIoxTZLHTRuoCEj7xc4PSPG78oE7JoWKLMvBDiwyhXNa+O9X1RgYhfYmS2m+1nGJYC9DG4xo7K60nO6WogBg3T+EwuDjYrVIfB5Rfe4D8iWKqOTNlJ+MzK4Dk8W8hqSJvuQFq5155DsbeqDy00EY1dMaGYVUq81lHEM91oz test@ldap0.eng.</font></div><div style="font-size:10pt;"><br></div></div></div></span></div><div><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;">Nareshchandra Paturi<br><br>14, St. Augustine’s Court, <br>Mornington Road,<br>london.<br>E11 3BQ.<br>Mob:07466666001,07856918100<br>Ph:02082579579<br></div> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 10pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> Jan Cholasta
<jcholast@redhat.com><br> <b><span style="font-weight:bold;">To:</span></b> naresh reddy <nareshbtech@yahoo.com> <br><b><span style="font-weight:bold;">Cc:</span></b> Rob Crittenden <rcritten@redhat.com>; "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight:bold;">Sent:</span></b> Wednesday, April 24, 2013 11:30 AM<br> <b><span style="font-weight:bold;">Subject:</span></b> Re: [Freeipa-users] Freeipa -ssh keys<br> </font> </div> <div class="yiv8211745348y_msg_container"><br>On 23.4.2013 20:20, naresh reddy wrote:<br>> Hi Rob<br>><br>> I am sorry for coming back again<br>> i can see client can get the ssh keys from the server but still fails<br>> please suggest.<br>><br>><br><br>By "client" you mean the machine that you are trying to ssh to, i.e. the <br>machine that has sshd running? If not, make sure sss_ssh_authorizedkeys <br>works on the machine with sshd, because that's
the one
that matters here.<br><br>Also, what version of OpenSSH do you have installed?<br><br>Honza<br><br>-- <br>Jan Cholasta<br><br><br></div> </div> </div> </div></div></div><br><br></div> </div> </div> </div></body></html>