<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hello folks,<br>
<br>
I'm setting up an IPA-server instance aimed to be used primarily for
Linux/Unix clients ssh authentication (with kerberos). <br>
I've managed to successfully set up debian clients (via sssd and
also on older debians, through libnss and pam_krb5). But for some
reason I can't authenticate ssh on Solaris10 clients. <br>
On the Solaris box, I've followed the steps outiined here: <br>
<a class="moz-txt-link-freetext" href="http://www.freeipa.org/page/ConfiguringUnixClients">http://www.freeipa.org/page/ConfiguringUnixClients</a><br>
and the nss part works fine (things like getent [group | passwd] and
id <user> work), but unfortunaltely, the ssh user
authentication fails with an error:<br>
sshd auth.error PAM-KRB5 (auth): krb5_verify_init_creds failed: No
such file or directory<br>
<br>
On the solaris clients, does there need to be a keytab in /etc/krb5/
directory copied over from the IPA server? (I didn't have to set up
a keytab file fo the legacy debian clients, and in the
solaris-clients doc previously mentioned, there's no mention of it).
Well, since I read somewhere the keytab file need to be there, I
copied it over from the IPA server to the solaris clients, Then I
get a different error: <br>
PAM-KRB5 (auth): krb5_verify_init_creds failed: Key table entry not
found<br>
<br>
This error seems to indicate that there isn't an matching entry
found in the keytab file, so I added an entry for the solaris
client, but I'm still getting the same 'Key table entry not found'
error (it could be the entry I added is wrong, of course). But, for
now, just want to be sure: On the solaris clients, do I need an
/etc/krb5/krb5.keytab file? (if yes, why not in the non-sssd Debian
hosts then?)<br>
<br>
Thanks in advance,<br>
<div class="moz-signature">-- <br>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<title></title>
<meta name="generator" content="LibreOffice 4.2.3.3 (Linux)">
<meta name="created" content="20140516;0">
<meta name="changed" content="20140516;141206408329958">
<style type="text/css">
<!--
p { color: #000000 }
-->
</style>
<p><font color="#0000cc"><font face="Arial, sans-serif"><font
style="font-size: 11pt" size="2"><b>Gerardo
Padierna Nanclares</b></font></font></font> <font
face="Arial, sans-serif"><br>
</font><font face="Verdana, sans-serif"><font style="font-size:
9pt" size="2">Técnico
de Sistemas (grupo ASL) - </font></font><font
color="#77216f"><font face="Verdana, sans-serif"><font
style="font-size: 9pt" size="2">[Fujitsu
/ Logware]</font></font></font> <br>
<font face="Arial, sans-serif"><font style="font-size: 9pt"
size="2">Servicio
de Sistemas de la Información (DGTI) - Generalitat
Valenciana
<br>
C/.Castan Tobeñas 77 – 46018 Valencia – Edificio A <br>
Tel:
961 208973 <br>
Email: <a href="mailto:asl.gerardo@gmail.com">asl.gerardo@gmail.com</a></font></font>
</p>
</div>
</body>
</html>