Hello,
sssd does not go offline, at least when I type service sssd status everything seems to be
ok.
When I do an su and type klist, or login locally, I get the ticket without the suffix.
When I login via ssh and type klist, I get the ticket without the suffix.
In most cases ssh is used.
I dont use FreeIPA, my machines are joined into AD via "net ads join"
Distribution is Opensuse 13.1
--- Ursprüngliche Nachricht ---
Von: Jakub Hrozek <jhrozek(a)redhat.com>
Datum: 06.01.2016 14:15:38
An: sssd-users(a)lists.fedorahosted.org
Betreff: [SSSD-users] Re: several kerberos issues
On Wed, Jan 06, 2016 at 12:58:53PM +0100, Peter Tulpen wrote:
> Hello,
> The server with the home directories is mounted before with this line:
linfile1:/ifs/data /media/linfile1 nfs defaults,sec=krb5,auto 0 0, but of
course only accessible when a user is logged in with a corresponding ticket
> I already set the interval (to who didn’t know this: the krb5_renew_interval
is necessary!)
>
> The reneval seems to work in some cases and in some not
I wonder if sssd goes offline in the meantime..when renewal does not
work, does it help to lock the screen and log back for instance?
> I also have now different ticket caches, like /tmp/krb5cc_59406_KO7sqV
and /tmp/krb5cc_59406
> The one without the random suffix seems not to be refreshed
I don't think this should happen, the non-random ccache should not be
used. Does klist really print /tmp/krb5cc_59406 without the random
suffix as your ccache? Can you catch that issue with logs enabled?
Also, what is your IPA client OS and version? (Newer sssd/RHEL versions
default to keyring ccache..)
>
> @Baldwin: It was a requirement by our security department.
> Before using Kerberos, everything went fine with onefs and sssd (and
sssd is in my opinion the easiest solution)
> We are using Version 7.2 and the AD provider of isilon.
>
> Best regards,
> Peter
>
>
> --- Ursprüngliche Nachricht ---
> Von: Jakub Hrozek <jhrozek(a)redhat.com>
> Datum: 04.01.2016 07:10:40
> An: Peter Tulpen <ptulpen(a)emailn.de>, End-user discussions
about the System Security Services Daemon <sssd-users(a)lists.fedorahosted.org>
> Betreff: [SSSD-users] Re: several kerberos issues
>
> >
> > > On 27 Dec 2015, at 19:50, Peter Tulpen <ptulpen(a)emailn.de>
wrote:
> > >
> > >
> > >
> >
> > Sorry for the late response, the mail was stuck in the moderation
queue
> > during the Christmas break.
> >
> > > Hello,
> > > Since we were forced to use Kerberos on our isilon nfsshare,
we see
> > several issues and have several use cases, which might all becovered
by sssd,
> > but this is toconfusing for me to cope
> > > What I already understood is, that I have to forget aboutpublic/private
> > key, because of this issue:
https://fedorahosted.org/freeipa/ticket/4000
> > > Also we have the home directories on the kerberized server,so
we get
> > an infinite loop
> >
> > I'm not sure I understand, is the homedir mounted before the user
authenticates?
> >
> > > The 3 use cases:
> > > - Login in linux directly with username andpassword
(ticket
> > creation needed) and login to other servers via sshpassswordless
with this
> > ticket (this works already)
> > > - Login into windows with a smartcard (withgetting
a valid TGT)
> > and loggin into the servers via putty (or somethingsimilar). Also
from here,
> > logon to other servers (works only when there isalready a ticket)
> > > - Services with a default user, which tickets getrefreshed
infinitely
> > (I think I have to use keytabs, but the refreshing doesnot work)
> > >
> > > So can I achieve, that in every case sssd refreshes the tickets.
Or
> > do I have to combine sssd with something like krenew?
> >
> > Please take a look at options like krb5_renew_interval, do these
help?
> >
> > > Do I have to switch Kerberos on or of in the ssh config (Ifind
different
> > opinions about that online)
> > > I attached the ssh krb and sssd configs
> > > Best regards ,
> > > Peter
> > >
> > >
> > >
> > > Versendet mit Emailn.de - Freemail
> > >
> > > * Unbegrenzt Speicherplatz
> > > * Eigenes Online-Büro
> > > * 24h besten Mailempfang
> > > * Spamschutz, Adressbuch
> > >
> > > _______________________________________________
> > > sssd-users mailing list
> > > sssd-users(a)lists.fedorahosted.org
> > >
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> > _______________________________________________
> > sssd-users mailing list
> > sssd-users(a)lists.fedorahosted.org
> >
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
>
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org