On Wed, Apr 20, 2016 at 09:03:54PM -0700, Ray Van Dolson wrote:
RHEL7 w/ sssd 1.13.0-40.el7_2.2. Connecting via SSH from PuTTY from
a
Windows box. GSSAPI is set up and also configured to allow credential
delegation. When I connect, I am not prompted for a password and get
into the system just fine.
However, klist shows nothing in my credential cache:
$ klist
klist: Credentials cache file '/tmp/krb5cc_1766242567' not found
(I also see no other differently named krb5cc file under /tmp).
RHEL7 should by default use Kernel keyring based ccaches.
If I first SSH into a host runing winbind from the same PuTTY, I
properly get a cached ticket there and can then ssh to the RHEL7 host
and the ticket is properly forwarded across (klist shows it in the
output).
$ klist
Ticket cache: FILE:/tmp/krb5cc_1766242567_CMtqGFX6EG
Default principal: username(a)DOMAIN.COM
Valid starting Expires Service principal
04/20/2016 20:57:41 04/21/2016 03:04:48 krbtgt/DOMAIN.COM(a)DOMAIN.COM
renew until 04/27/2016 17:04:48
Have run sssd in foreground w/ debug and looked for krb5 message, but
not even seeing it attempt to create or use ccache.
In this case SSSD has nothing to do with ccache handling, everything is
done by sshd.
Figured someone here might be able to set me down the right course?
If you enable debug logging with sshd e.g. by setting 'LogLevel DEBUG3'
in /etc/ssh/sshd_config the output in /var/log/secure should tell you
where sshd stores the ticket. I see messages like:
Apr 21 09:47:42 ipa-devel sshd[6044]: debug1: ssh_krb5_cc_gen: Setting ccname to
KEYRING:persistent:1140000000
Apr 21 09:47:43 ipa-devel sshd[6052]: debug1: Setting KRB5CCNAME to
KEYRING:persistent:1140000000:1140000000
Apr 21 09:47:43 ipa-devel sshd[6052]: debug3: Copy environment:
KRB5CCNAME=KEYRING:persistent:1140000000:1140000000
HTH
bye,
Sumit
>
> Thanks in advance.
>
> Ray
>
> My sssd.conf:
>
> [sssd]
> config_file_version = 2
> domains =
domain.com
> services = nss, pam
> debug_level = 0
> override_space = _
> [nss]
> debug_level = 0
> override_shell = /bin/bash
> allowed_shells = /bin/bash, /bin/tcsh
> vetoed_shells = /bin/csh
> shell_fallback = /bin/bash
> [pam]
> debug_level = 0
> [
domain/domain.com]
> debug_level = 0
> id_provider = ad
> access_provider = ad
> ignore_group_members = true
> cache_credentials = True
> ldap_group_nesting_level = 5
> ldap_idmap_range_min = 200000
> ldap_idmap_range_max = 2000200000
> ldap_idmap_range_size = 500000
> krb5_realm =
DOMAIN.COM
> override_homedir = /home/%u
> ldap_referrals = false
> #krb5_ccachedir = /tmp
> #krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
> krb5_renewable_lifetime = 12h
> krb5_renew_interval = 1h
> krb5_store_password_if_offline = True
>
> krb5.conf:
>
> [logging]
> default = FILE:/var/log/krb5libs.log
> kdc = FILE:/var/log/krb5kdc.log
> admin_server = FILE:/var/log/kadmind.log
>
> [libdefaults]
> default_realm =
DOMAIN.COM
> dns_lookup_realm = true
> dns_lookup_kdc = true
> ticket_lifetime = 24h
> renew_lifetime = 7d
> rdns = false
> forwardable = true
> #default_ccache_name =
>
> [realms]
>
DOMAIN.COM = {
> #kdc =
kerberos.example.com
> #admin_server =
kerberos.example.com
> }
>
> [domain_realm]
> .domain.com =
DOMAIN.COM
>
domain.com =
DOMAIN.COM
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org