<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000066">
On 03/01/2012 02:24 PM, Jan Zelený wrote:
<blockquote cite="mid:201203011424.22588.jzeleny@redhat.com"
type="cite">
<blockquote type="cite">
<pre wrap="">On 03/01/2012 02:04 PM, Jan Zelený wrote:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">On 03/01/2012 12:21 PM, Ondrej Valousek wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hello,
I am running sssd on RHEL-6 with AD and recently found out, that I can
no longer authenticate via ssh. The message is:
pam_krb5[27045]: TGT failed verification using keytab and key for
'<a class="moz-txt-link-abbreviated" href="mailto:nfs/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM">nfs/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM</a>': Wrong principal
in request
My krb5.keytab file has been created using Samba with "net ads join".
I can still run 'kinit<username>' to obtain a TGT.
Does anyone know what is going on here? Why is sshd verifying the TGT
via just the nfs/ service principal?
Sorry for a bit off-topic question, but I hoped someone in this list
might point me in the right direction.
Ondrej
</pre>
</blockquote>
<pre wrap="">
Note that with:
kinit -S <a class="moz-txt-link-abbreviated" href="mailto:nfs/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM">nfs/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM</a> ondrejv
I am able to successfully obtain the nfs/ principal - so it looks like a
bug in pam_krb5, right?
</pre>
</blockquote>
<pre wrap="">
You should also try kinit -k to see if kinit with the keytab is ok.
Thanks
Jan
</pre>
</blockquote>
<pre wrap="">
kinit -k -S <a class="moz-txt-link-abbreviated" href="mailto:nfs/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM">nfs/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM</a> draco$
works fine, too.
So I am probably going to file a bugreport, right?
</pre>
</blockquote>
<pre wrap="">
Just to be sure, try klist -k and send me the result.
Thanks
Jan
</pre>
</blockquote>
Just a plain kinit -k does not work here:<br>
[root@draco ~]# kinit -k<br>
kinit: Client '<a class="moz-txt-link-abbreviated" href="mailto:host/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM">host/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM</a>'
not found in Kerberos database while getting initial credentials<br>
<br>
... but this is pretty much normal as I am using AD based KDC.<br>
This works fine though:<br>
<br>
[root@draco ~]# kinit -k draco$<br>
<br>
Another strange thing is that sshd complains when I attempt to log
in via GSSAPI & existing Kerberos TGT. It says:<br>
<br>
debug1: Unspecified GSS failure. Minor code may provide more
information<br>
No key table entry found for
<a class="moz-txt-link-abbreviated" href="mailto:host/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM">host/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM</a><br>
<br>
But again,<br>
<pre wrap="">kinit -S <a class="moz-txt-link-abbreviated" href="mailto:host/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM">host/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM</a> ondrejv
Works just fine (just need to type my password).
Ondrej
</pre>
<br>
</body>
</html>