On 03/01/2012 02:04 PM, Jan Zelený wrote:
> On 03/01/2012 12:21 PM, Ondrej Valousek wrote:
>> Hello,
>>
>> I am running sssd on RHEL-6 with AD and recently found out, that I can no
>> longer authenticate via ssh. The message is:
>> pam_krb5[27045]: TGT failed verification using keytab and key for
>> 'nfs/draco.prague.s3group.com(a)DUBLIN.AD.S3GROUP.COM': Wrong principal in
>> request
>>
>> My krb5.keytab file has been created using Samba with "net ads join".
>> I can still run 'kinit<username>' to obtain a TGT.
>>
>> Does anyone know what is going on here? Why is sshd verifying the TGT via
>> just the nfs/ service principal?
>>
>> Sorry for a bit off-topic question, but I hoped someone in this list
>> might point me in the right direction.
>>
>> Ondrej
> Note that with:
> kinit -S nfs/draco.prague.s3group.com(a)DUBLIN.AD.S3GROUP.COM ondrejv
>
> I am able to successfully obtain the nfs/ principal - so it looks like a
> bug in pam_krb5, right?
You should also try kinit -k to see if kinit with the keytab is ok.
Thanks
Jan
kinit -k -S nfs/draco.prague.s3group.com(a)DUBLIN.AD.S3GROUP.COM draco$
works fine, too.
So I am probably going to file a bugreport, right?
Ondrej