[SSSD] SSSD GSSAPI Question
Simo Sorce
simo at redhat.com
Tue Feb 5 15:39:17 UTC 2013
On Mon, 2013-02-04 at 09:38 -0500, Derek Page wrote:
> I can,
>
> But kerberos rejects it. As stated before I think Its due to
> subdomains. At this point I think this is past SSSD and is more of a
> kerberos config issue.
>
> Thanks for your replys.
I do not understand what would prevent you from using CNAMEs, what
matters to you however is that ultimately the A name your client is
going to resolve *MUST* match the fqdn the sshd daemon you are hitting
has in the keytab.
Anything else will just fail.
If you want to use the same A name for all machines it means you need to
create a service name for host/A-name and then distribute the same
keytab to all hosts. However that is a bad idea, in general because the
host/ key should really not be shared between multiple hosts as
compromising one will compromise all of them.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list