<div dir="ltr">Hello.<div><br></div><div>Im trying to set up a redhat 6.1 to ipaserver.</div><div><br></div><div style>What i have done.....</div><div style><br></div><div style>On the Ipaserver<br></div><div style><div><br>
</div><div>#ipa host-add --force --ip-address=192.168.237.1 seadv-.<a href="http://d1.gameop.net">d1.gameop.net</a></div><div><br></div><div>#kinit admin</div><div><br></div><div>#ipa host-add-managedby --hosts=<a href="http://ipaserver.d1.gameop.net">ipaserver.d1.gameop.net</a> <a href="http://seadv-237-1.d1.gameop.net">seadv-237-1.d1.gameop.net</a></div>
<div><br></div><div><br></div><div>#ipa-getkeytab -s <a href="http://ipaserver.d1.gameop.net">ipaserver.d1.gameop.net</a> -p host/<a href="http://seadv-237-1.d1.gameop.net">seadv-237-1.d1.gameop.net</a> -k /tmp/seadv-.keytab</div>
<div><br></div><div>#scp client1.keytab seadv-237-1.d1.gameop.net:/tmp</div><div><br></div><div>On Client 6.1</div><div><br></div><div>#yum install krb5-workstation oddjob-mkhomedir</div><div>#mv /tmp/client1.keytab /etc/krb5.keytab</div>
<div><br></div><div>#vim /etc/krb5.conf<br></div><div><br></div><div>[libdefaults]</div><div> default_realm = <a href="http://D1.GAMEOP.NET">D1.GAMEOP.NET</a></div><div> dns_lookup_realm = false</div><div> dns_lookup_kdc = false</div>
<div> rdns = false</div><div> ticket_lifetime = 24h</div><div> forwardable = yes</div><div><br></div><div>[realms]</div><div> <a href="http://D1.GAMEOP.NET">D1.GAMEOP.NET</a> = {</div><div> kdc = <a href="http://ipaserver.d1.gameop.net:88">ipaserver.d1.gameop.net:88</a></div>
<div> admin_server = <a href="http://ipaserver.d1.gameop.net:749">ipaserver.d1.gameop.net:749</a></div><div> default_domain = <a href="http://d1.gameop.net">d1.gameop.net</a></div><div> pkinit_anchors = FILE:/etc/ipa/ca.crt</div>
<div> }</div><div><br></div><div>[domain_realm]</div><div> .<a href="http://d1.gameop.net">d1.gameop.net</a> = <a href="http://D1.GAMEOP.NET">D1.GAMEOP.NET</a></div><div> <a href="http://d1.gameop.net">d1.gameop.net</a> = <a href="http://D1.GAMEOP.NET">D1.GAMEOP.NET</a></div>
<div><br></div><div><br></div><div>#cd /etc/pam.d/</div><div><br></div><div>#vim fingerprint-auth</div><div><br></div><div>auth required pam_env.so</div><div>auth sufficient pam_fprintd.so</div><div>
auth required pam_deny.so</div><div><br></div><div>account required pam_unix.so</div><div>account sufficient pam_localuser.so</div><div>account sufficient pam_succeed_if.so uid < 500 quiet</div>
<div>account [default=bad success=ok user_unknown=ignore] pam_sss.so</div><div>account required pam_permit.so</div><div><br></div><div>password required pam_deny.so</div><div><br></div><div>session optional pam_keyinit.so revoke</div>
<div>session required pam_limits.so</div><div>session optional pam_oddjob_mkhomedir.so</div><div>session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid</div><div>session required pam_unix.so</div>
<div>session optional pam_sss.so</div><div><br></div><div>#vim password-auth</div><div><br></div><div>auth required pam_env.so</div><div>auth sufficient pam_unix.so nullok try_first_pass</div>
<div>auth requisite pam_succeed_if.so uid >= 500 quiet</div><div>auth sufficient pam_sss.so use_first_pass</div><div>auth required pam_deny.so</div><div><br></div><div>account required pam_unix.so</div>
<div>account sufficient pam_localuser.so</div><div>account sufficient pam_succeed_if.so uid < 500 quiet</div><div>account [default=bad success=ok user_unknown=ignore] pam_sss.so</div><div>account required pam_permit.so</div>
<div><br></div><div>password requisite pam_cracklib.so try_first_pass retry=3 type=</div><div>password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok</div><div>password sufficient pam_sss.so use_authtok</div>
<div>password required pam_deny.so</div><div><br></div><div>session optional pam_keyinit.so revoke</div><div>session required pam_limits.so</div><div>session optional pam_oddjob_mkhomedir.so</div>
<div>session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid</div><div>session required pam_unix.so</div><div>session optional pam_sss.so</div><div><br></div><div>#vim smartcard-auth</div>
<div><br></div><div>auth required pam_env.so</div><div>auth [success=done ignore=ignore default=die] pam_pkcs11.so wait_for_card card_only</div><div>auth required pam_deny.so</div><div><br></div>
<div>account required pam_unix.so</div><div>account sufficient pam_localuser.so</div><div>account sufficient pam_succeed_if.so uid < 500 quiet</div><div>account [default=bad success=ok user_unknown=ignore] pam_sss.so</div>
<div>account required pam_permit.so</div><div><br></div><div>password required pam_pkcs11.so</div><div><br></div><div>session optional pam_keyinit.so revoke</div><div>session required pam_limits.so</div>
<div>session optional pam_oddjob_mkhomedir.so</div><div>session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid</div><div>session required pam_unix.so</div><div>session optional pam_sss.so</div>
<div><br></div><div>#vim system-auth</div><div><br></div><div>auth required pam_env.so</div><div>auth sufficient pam_fprintd.so</div><div>auth sufficient pam_unix.so nullok try_first_pass</div>
<div>auth requisite pam_succeed_if.so uid >= 500 quiet</div><div>auth sufficient pam_sss.so use_first_pass</div><div>auth required pam_deny.so</div><div><br></div><div>account required pam_unix.so</div>
<div>account sufficient pam_localuser.so</div><div>account sufficient pam_succeed_if.so uid < 500 quiet</div><div>account [default=bad success=ok user_unknown=ignore] pam_sss.so</div><div>account required pam_permit.so</div>
<div><br></div><div>password requisite pam_cracklib.so try_first_pass retry=3 type=</div><div>password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok</div><div>password sufficient pam_sss.so use_authtok</div>
<div>password required pam_deny.so</div><div><br></div><div>session optional pam_keyinit.so revoke</div><div>session required pam_limits.so</div><div>session optional pam_oddjob_mkhomedir.so</div>
<div>session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid</div><div>session required pam_unix.so</div><div>session optional pam_sss.so</div><div><br></div><div><br></div>
<div>#vim /etc/sssd/sssd.conf</div><div><br></div><div>[domain/<a href="http://d1.gameop.net">d1.gameop.net</a>]</div><div><br></div><div>cache_credentials = True</div><div>krb5_store_password_if_offline = True</div><div>
ipa_domain = <a href="http://d1.gameop.net">d1.gameop.net</a></div><div>id_provider = ipa</div><div>auth_provider = ipa</div><div>access_provider = ipa</div><div>chpass_provider = ipa</div><div>ipa_server = _srv_, <a href="http://ipaserver.d1.gameop.net">ipaserver.d1.gameop.net</a></div>
<div>ldap_tls_cacert = /etc/ipa/ca.crt</div><div><br></div><div>[sssd]</div><div>config_file_version = 2</div><div><br></div><div>reconnection_retries = 3</div><div><br></div><div>sbus_timeout = 30</div><div>services = nss, pam</div>
<div><br></div><div>domains = <a href="http://d1.gameop.net">d1.gameop.net</a></div><div><br></div><div>[nss]</div><div>filter_groups = root</div><div>filter_users = root</div><div>reconnection_retries = 3</div><div><br></div>
<div>[pam]</div><div>reconnection_retries = 3</div><div><br></div><div>#chmod 0600 sssd.conf</div><div><br></div><div>#vim /etc/nsswitch.conf</div><div><br></div><div>passwd: files sss</div><div>shadow: files sss</div>
<div>group: files sss</div><div><br></div><div>hosts: files dns</div><div><br></div><div>bootparams: nisplus [NOTFOUND=return] files</div><div><br></div><div>ethers: files</div><div>netmasks: files</div><div>
networks: files</div><div>protocols: files</div><div>rpc: files</div><div>services: files</div><div><br></div><div>netgroup: files sss</div><div><br></div><div>publickey: nisplus</div><div><br></div><div>automount: files</div>
<div>aliases: files nisplus</div><div><br></div><div><br></div><div style>Now I can do </div><div style>#kinit admin </div><div style>#klist</div><div>Ticket cache: FILE:/tmp/krb5cc_0</div><div>Default principal: <a href="mailto:admin@D1.GAMEOP.NET">admin@D1.GAMEOP.NET</a></div>
<div><br></div><div>Valid starting Expires Service principal</div><div>04/29/13 13:41:37 04/30/13 13:41:35 krbtgt/<a href="mailto:D1.GAMEOP.NET@D1.GAMEOP.NET">D1.GAMEOP.NET@D1.GAMEOP.NET</a></div><div><br>
</div><div style>and when i try to do ID acke or ssh <a href="mailto:acke@seadv-237-1.d1.gameop.net">acke@seadv-237-1.d1.gameop.net</a>.</div><div style><br></div><div style>I get nothing...</div><div style><br></div><div style>
My dns records for my dns that i want to use.<br></div><div style><br></div><div style><a href="http://ipaserver.d1.gameop.net">ipaserver.d1.gameop.net</a> A 192.168.232.41</div><div style><a href="http://ipareplica.d1.gameop.net">ipareplica.d1.gameop.net</a> A 192.168.235.181</div>
<div style><br></div><div>_ldap._<a href="http://tcp.d1.gameop.net">tcp.d1.gameop.net</a> SRV 100 389 ipaserver<br></div><div>_ldap._<a href="http://tcp.d1.gameop.net">tcp.d1.gameop.net</a> SRV 100 389 ipareplica<br>
</div><div><br></div><div>_kerberos TXT <a href="http://d1.gameop.net">d1.gameop.net</a><br></div><div style>_kerberos._<a href="http://tcp.d1.gameop.net">tcp.d1.gameop.net</a> SRV 100 88 ipaserver</div>
<div style>_kerberos._<a href="http://udp.d1.gameop.net">udp.d1.gameop.net</a> SRV 100 88 ipaserver</div><div style>_kerberos-master._<a href="http://tcp.d1.gameop.net">tcp.d1.gameop.net</a> SRV 100 88 ipaserver</div><div style>
_kerberos-master._<a href="http://udp.d1.gameop.net">udp.d1.gameop.net</a> SRV 100 88 ipaserver</div><div style>_kpasswd._<a href="http://tcp.d1.gameop.net">tcp.d1.gameop.net</a> SRV 100 88 ipaserver</div><div style>_kpasswd._<a href="http://udp.d1.gameop.net">udp.d1.gameop.net</a> SRV 100 88 ipaserver</div>
<div style><br></div><div style>This setup do not work whit my dns i want. But if i change my resolve.conf to </div><div style><br></div><div style>nameserver 192.168.232.41</div><div style><br></div><div style>I can id and ssh...</div>
<div style><br></div><div style>So have i missed somthing whit the dns?</div><div style><br></div><div style>I have tried to have the SRV records to only _ldap._tcp and _kerberos._tcp but that dont work either.</div><div style>
<br></div><div style><br></div><div style>Thanks </div><div style><br></div><div style>PS </div><div style><br></div><div style>My first mailinglist sorry if I dont follow some kind of standard </div><div style><br></div>
<div style><br></div><div style><br></div><div style><br></div><div style><br></div><div style><br></div><div><br></div><div><br></div><div><br></div><div> </div><div><br></div></div></div>