RHEL7 w/ sssd 1.13.0-40.el7_2.2. Connecting via SSH from PuTTY from a
Windows box. GSSAPI is set up and also configured to allow credential
delegation. When I connect, I am not prompted for a password and get
into the system just fine.
However, klist shows nothing in my credential cache:
$ klist
klist: Credentials cache file '/tmp/krb5cc_1766242567' not found
(I also see no other differently named krb5cc file under /tmp).
If I first SSH into a host runing winbind from the same PuTTY, I
properly get a cached ticket there and can then ssh to the RHEL7 host
and the ticket is properly forwarded across (klist shows it in the
output).
$ klist
Ticket cache: FILE:/tmp/krb5cc_1766242567_CMtqGFX6EG
Default principal: username(a)DOMAIN.COM
Valid starting Expires Service principal
04/20/2016 20:57:41 04/21/2016 03:04:48 krbtgt/DOMAIN.COM(a)DOMAIN.COM
renew until 04/27/2016 17:04:48
Have run sssd in foreground w/ debug and looked for krb5 message, but
not even seeing it attempt to create or use ccache.
Figured someone here might be able to set me down the right course?
Thanks in advance.
Ray
My sssd.conf:
[sssd]
config_file_version = 2
domains =
domain.com
services = nss, pam
debug_level = 0
override_space = _
[nss]
debug_level = 0
override_shell = /bin/bash
allowed_shells = /bin/bash, /bin/tcsh
vetoed_shells = /bin/csh
shell_fallback = /bin/bash
[pam]
debug_level = 0
[
domain/domain.com]
debug_level = 0
id_provider = ad
access_provider = ad
ignore_group_members = true
cache_credentials = True
ldap_group_nesting_level = 5
ldap_idmap_range_min = 200000
ldap_idmap_range_max = 2000200000
ldap_idmap_range_size = 500000
krb5_realm =
DOMAIN.COM
override_homedir = /home/%u
ldap_referrals = false
#krb5_ccachedir = /tmp
#krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
krb5_renewable_lifetime = 12h
krb5_renew_interval = 1h
krb5_store_password_if_offline = True
krb5.conf:
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm =
DOMAIN.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
rdns = false
forwardable = true
#default_ccache_name =
[realms]
DOMAIN.COM = {
#kdc =
kerberos.example.com
#admin_server =
kerberos.example.com
}
[domain_realm]
.domain.com =
DOMAIN.COM
domain.com =
DOMAIN.COM