On ke, 08 marras 2017, Pascal Ernster via FreeIPA-users wrote:
[2017-11-07 14:50] Alexander Bokovoy via FreeIPA-users:
> If they all have the same hostname, you are better to enroll and share
> keytab across all configurations. To do so, enroll first time and then
> specify /etc/krb5.keytab from that installation with ipa-client-install
> -k option. See ipa-client-install man page for more details.
Thanks for the advice. Would the kerberos keytab and the SSH host keys
be the only possible/likely causes for problems?
The only thing that would be common
to all these machines is LDAP object
for the machine. It is indexed by the hostname, so having the same
hostname means sharing that LDAP object and all its attributes,
including Kerberos key.
You can have multiple SSHFP entries for the same host, this is normal.
Please note that I run FreeIPA with external nameservers, on which I
added the necessary DNS entries for the FreeIPA servers manually. The
FreeIPA client machines only have their respective A/AAAA records (and
the corresponding reverse DNS records, of course).
How DNS is managed is irrelevant
here.
--
/ Alexander Bokovoy