On 03/01/2012 12:21 PM, Ondrej Valousek wrote:
Hello,
I am running sssd on RHEL-6 with AD and recently found out, that I
can no longer authenticate via ssh.
The message is:
pam_krb5[27045]: TGT failed verification using keytab and key for
'nfs/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM':
Wrong principal in request
My krb5.keytab file has been created using Samba with "net ads
join".
I can still run 'kinit <username>' to obtain a TGT.
Does anyone know what is going on here? Why is sshd verifying the
TGT via just the nfs/ service principal?
Sorry for a bit off-topic question, but I hoped someone in this
list might point me in the right direction.
Ondrej
Note that with:
kinit -S nfs/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM ondrejv
I am able to successfully obtain the nfs/ principal - so it looks
like a bug in pam_krb5, right?
Many thanks,
Ondrej