On 12-10-17 14:11, Alexander Bokovoy wrote:
> On to, 12 loka 2017, Kees Bakker via FreeIPA-users wrote: >> Hey, >> >> This week I tried to install Samba (which failed because of Ubuntu, but that's >> another story). >> >> One of the steps was to do ipa-adtrust-install. It created a cifs/myhost pricipal >> on my IPA master server. >> >> But now it keeps switching my default pricipal to cifs/myhost@MYREALM (and >> in this case I'm root). > What is your distribution?
Ubuntu 16.04

> > The reason I ask is because on Fedora, RHEL 7, and CentOS 7 we do have > Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba
Yes, that's probably it. (See response to Sumit)

> > line in smb.service (and in winbind.service): > > # systemctl cat winbind.service |grep krb5cc_samba > Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba > > This forces smbd and winbindd to use a specific Kerberos ccache file > instead of a default one. Since they run as root their default ccache > would otherwise be the one that root as user uses.
Samba is not setup via systemd on Ubuntu. But I certainly can
figure out what to do. Thanks anyway.

> >> >> Next I do destroy -A, and a new kinit admin. >> >> root@rotte:~# kdestroy -A >> root@rotte:~# klist >> klist: Credentials cache keyring 'persistent:0:krb_ccache_SF0wnkh' not found >> root@rotte:~# kinit admin >> Password for admin@GHS.NL: >> root@rotte:~# klist >> Ticket cache: KEYRING:persistent:0:krb_ccache_SF0wnkh >> Default principal: admin@GHS.NL >> >> Valid starting Expires Service principal >> 12-10-17 11:39:10 13-10-17 11:39:05 krbtgt/GHS.NL@GHS.NL >> >> Great, this is what I expected. But ... within 5 minutes >> >> root@rotte:~# klist >> Ticket cache: KEYRING:persistent:0:krb_ccache_SF0wnkh >> Default principal: cifs/rotte.ghs.nl@GHS.NL >> >> Valid starting Expires Service principal >> 12-10-17 11:42:10 13-10-17 11:42:10 ldap/rotte.ghs.nl@GHS.NL >> 12-10-17 11:42:10 13-10-17 11:42:10 krbtgt/GHS.NL@GHS.NL >> >> Argh, who/what is doing this? >> -- >> Kees Bakker >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org >