<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 04/16/2014 04:28 PM, David Kreuter
wrote:<br>
</div>
<blockquote
cite="mid:7d23415c-64c7-4173-99d2-b974c38fe1dd@zimbra.bytesource.net"
type="cite">
<style type="text/css">p { margin: 0; }</style>
<div style="font-family: arial,helvetica,sans-serif; font-size:
10pt; color: #000000"><font face="arial, helvetica, sans-serif"
size="2">On client side the valid Kerberos ticket is present.
The following SSH configuration is used on the machine where
the IPA client is running:</font>
<div style="color: rgb(0, 0, 0); font-family: arial, helvetica,
sans-serif; font-size: 10pt;"><br>
</div>
<div><font face="arial, helvetica, sans-serif" size="2">/etc/ssh/sshd_config</font></div>
<div><font face="arial, helvetica, sans-serif" size="2">---cut---</font></div>
<div><font face="arial, helvetica, sans-serif" size="2">PasswordAuthentication
yes</font></div>
<div>
<div style="color: rgb(0, 0, 0); font-family: arial,
helvetica, sans-serif; font-size: 10pt;">KerberosAuthentication
no</div>
<div style="color: rgb(0, 0, 0); font-family: arial,
helvetica, sans-serif; font-size: 10pt;">PubkeyAuthentication
yes</div>
<div style="color: rgb(0, 0, 0); font-family: arial,
helvetica, sans-serif; font-size: 10pt;">UsePAM yes</div>
<div style="color: rgb(0, 0, 0); font-family: arial,
helvetica, sans-serif; font-size: 10pt;">GSSAPIAuthentication
yes</div>
<div style="color: rgb(0, 0, 0); font-family: arial,
helvetica, sans-serif; font-size: 10pt;">AuthorizedKeysCommand
/usr/bin/sss_ssh_authorizedkeys</div>
<div style="color: rgb(0, 0, 0); font-family: arial,
helvetica, sans-serif; font-size: 10pt;">---cut---</div>
<div style="color: rgb(0, 0, 0); font-family: arial,
helvetica, sans-serif; font-size: 10pt;"><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: arial,
helvetica, sans-serif; font-size: 10pt;">Just checked the
machine again, password authentication is used as fallback,
because the Keberos setup on this machine seems to be messed
up. I have tried to uninstall the client and reinstalled it.
During the installation I'm getting following message:</div>
<div style="color: rgb(0, 0, 0); font-family: arial,
helvetica, sans-serif; font-size: 10pt;"><br>
</div>
<div><font face="arial, helvetica, sans-serif" size="2">"A RA
is not configured on the server. Not requesting host
certificate."</font></div>
<div><font face="arial, helvetica, sans-serif" size="2"><br>
</font></div>
<div><font face="arial, helvetica, sans-serif" size="2">Trying
to request the certificate manually leads in:</font></div>
<div><font face="arial, helvetica, sans-serif" size="2"><br>
</font></div>
<div><font face="arial, helvetica, sans-serif" size="2">ipa-getcert
request -d /etc/pki/nssdb -n Server-Cert -K
HOST/<host> -N 'CN=<host>,O=EXAMPLE.INFO' -v </font></div>
<div><font face="arial, helvetica, sans-serif" size="2"><br>
</font></div>
<div><font face="arial, helvetica, sans-serif" size="2">Error
org.fedorahosted.certmonger.duplicate: Certificate at same
location is already used by request with nickname
"20140416200517"</font></div>
</div>
</div>
</blockquote>
<br>
When you removed the client certmonger was still tracking certs from
the previous install.<br>
Use cermonger to un-track old cert(s) and try to re-install again.
That should solve this problem.<br>
I think is fixed in the latest version of IPA client.<br>
<br>
As for SSH I think a quick search on the net renders several guides
that show how to setup OpenSSH with GSSAPI.<br>
<br>
<br>
<blockquote
cite="mid:7d23415c-64c7-4173-99d2-b974c38fe1dd@zimbra.bytesource.net"
type="cite">
<div style="font-family: arial,helvetica,sans-serif; font-size:
10pt; color: #000000">
<div>
<div><font face="arial, helvetica, sans-serif" size="2"><br>
</font></div>
<div><font face="arial, helvetica, sans-serif" size="2">So to
certificate is already there. Do you have some hints?</font></div>
<div><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: arial,
helvetica, sans-serif; font-size: 10pt;"><br>
</div>
<hr id="zwchr" style="color: rgb(0, 0, 0); font-family: arial,
helvetica, sans-serif; font-size: 10pt;">
<div style="color: rgb(0, 0, 0); font-family: Helvetica,
Arial, sans-serif; font-size: 12pt; font-weight: normal;
font-style: normal; text-decoration: none;"><b>From: </b>"Simo
Sorce" <a class="moz-txt-link-rfc2396E" href="mailto:simo@redhat.com"><simo@redhat.com></a><br>
<b>To: </b>"David Kreuter"
<a class="moz-txt-link-rfc2396E" href="mailto:david.kreuter@bytesource.net"><david.kreuter@bytesource.net></a><br>
<b>Cc: </b><a class="moz-txt-link-abbreviated" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>
<b>Sent: </b>Wednesday, 16 April, 2014 8:50:39 PM<br>
<b>Subject: </b>Re: [Freeipa-users] PasswordAuthentication
option for SSH<br>
<br>
On Wed, 2014-04-16 at 20:08 +0200, David Kreuter wrote:<br>
> Hi, <br>
> <br>
> <br>
> Today I faced the issue that Kerberos authentication
stopped working<br>
> after disabling PasswordAuthentication in
/etc/ssh/sshd_config on a<br>
> FreeIPA client. The deactivation of this option was
done due to<br>
> security issues. <br>
> <br>
> <br>
> Is it really necessary to have this option set to yes
when using<br>
> Keberos authentication? <br>
<br>
No, GSSAPI authentication does not need
PasswordAuthentication, of<br>
course it requires valid kerberos credentials on the client
and a valid<br>
keytab on the server.<br>
<br>
Simo.<br>
<br>
-- <br>
Simo Sorce * Red Hat, Inc * New York<br>
<br>
</div>
<br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>