[SSSD] SSSD GSSAPI Question

Simo Sorce simo at redhat.com
Tue Feb 5 15:39:17 UTC 2013


On Mon, 2013-02-04 at 09:38 -0500, Derek Page wrote:
> I can,
> 
> But kerberos rejects it. As stated before I think Its due to
> subdomains. At this point I think this is past SSSD and is more of a
> kerberos config issue.
> 
> Thanks for your replys.

I do not understand what would prevent you from using CNAMEs, what
matters to you however is that ultimately the A name your client is
going to resolve *MUST* match the fqdn the sshd daemon you are hitting
has in the keytab.
Anything else will just fail.

If you want to use the same A name for all machines it means you need to
create a service name for host/A-name and then distribute the same
keytab to all hosts. However that is a bad idea, in general because the
host/ key should really not be shared between multiple hosts as
compromising one will compromise all of them.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list