<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000066">
On 03/01/2012 12:21 PM, Ondrej Valousek wrote:
<blockquote cite="mid:4F4F5BB2.8030103@s3group.cz" type="cite">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
Hello,<br>
<br>
I am running sssd on RHEL-6 with AD and recently found out, that I
can no longer authenticate via ssh.<br>
The message is:<br>
pam_krb5[27045]: TGT failed verification using keytab and key for
'<a moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:nfs/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM">nfs/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM</a>':
Wrong principal in request<br>
<br>
My krb5.keytab file has been created using Samba with "net ads
join".<br>
I can still run 'kinit <username>' to obtain a TGT.<br>
<br>
Does anyone know what is going on here? Why is sshd verifying the
TGT via just the nfs/ service principal?<br>
<br>
Sorry for a bit off-topic question, but I hoped someone in this
list might point me in the right direction.<br>
<br>
Ondrej<br>
<br>
</blockquote>
Note that with:<br>
kinit -S <a class="moz-txt-link-abbreviated" href="mailto:nfs/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM">nfs/draco.prague.s3group.com@DUBLIN.AD.S3GROUP.COM</a> ondrejv<br>
<br>
I am able to successfully obtain the nfs/ principal - so it looks
like a bug in pam_krb5, right?<br>
<br>
Many thanks,<br>
Ondrej<br>
</body>
</html>