On Tue, Jun 02, 2015 at 09:43:48AM +0200, Christopher Lamb wrote: > Hi Jakub > > The same user / password works with all our FreeIPA hosts - just this one > box is the problem. So the password should be good. Of course a type is > always possible (especially for strong passwords), but I have tried many > times which should eliminate the odd password typo. The user / password > should also be good for both the old and the new FreeIPA Server.
Interesting, can you add debug_level=10 to the domain section of sssd.conf? Then krb5_child.log should show Kerberos tracing info including which exact KDC SSSD was talking to. > > As I can neither log in direct, or via ssh to this box with my FreeIPA > user, I assume Kinit with my user won't work- i will try later in the day. Well, login as a UNIX user (root) should work.. > > My working assumption is that the problem is related in some way to the > fact the host originally was a FreeIPA 3.3.3 client, updated to FreeIPA > 4.1, and switched between 2 FreeIPA servers. I am currently setting up 2 > throwaway EL 7.1 VMs to better test this. On one I will first install > 3.3.3, then upgrade to 4.1. The second will have a direct install of 4.1 > client. > > Cheers > > Chris > > > > From: Jakub Hrozek <[email protected]> > To: [email protected] > Date: 02.06.2015 09:22 > Subject: Re: [Freeipa-users] Fw: ssh problem with migrated FreeIPA > client on EL7.1 -->Not Solved > Sent by: [email protected] > > > > On Mon, Jun 01, 2015 at 07:35:11PM +0200, Christopher Lamb wrote: > > > > Hi All > > > > Bad news. > > > > Over the weekend I was able to get the original problem EL7.1 / FreeIPA > 4.1 > > host (FreeIPA client) to authenticate FreeiPA users (my test being ssh > > remote login with FreeIPA user and password). > > > > Today I tried a second machine, and had the same problem, ssh connections > > with FreeIPA user cause "[sssd[krb5_child[3445]]]: Decrypt integrity > check > > failed" > > This really just means wrong password, can you kinit as that user using > the same password? > > > > > Ahh I thought, I have a solution for that: just remove ipa-client and > > reinstall via yum, register with the new FreeIPA server .... > > > > Only with this second machine I still can't ssh in with a FreeIPA user. > > Argg..... > > > > b.t.w, as this machine is a real physical server, I was able to try > logging > > in direct with my FreeIPA user --> "Authentication Failure" > > > > I now have > > * a whole bunch of EL6.5 / FreeIPA 3.3.3 hosts that migrated from the old > > FreeIPA server to the new without a hitch (i.e. they successfully > > authenticate FreeIPA users.) > > * one migrated EL7.1 / FreeIPA 4.1 host that I was able to migrate, but > > with problems > > * one migrated EL7.1 / FreeIPA 4.1 host that so far defies all attempts > to > > authenticate with a FreeIPA user > > * one EL7.1 / FreeIPA 4.1 host that was only ever registered with the new > > FreeIPA server, and successfully authenticates FreeIPA users. > > > > Any ideas? > > > > Chris > > > > > > ----- Forwarded by Christopher Lamb/Switzerland/IBM on 01.06.2015 19:17 > > ----- > > > > From: Christopher Lamb/Switzerland/IBM@IBMCH > > To: Alexander Bokovoy <[email protected]>, > > [email protected] > > Date: 30.05.2015 18:52 > > Subject: Re: [Freeipa-users] ssh problem with migrated FreeIPA > client on > > EL7.1 --> Solved > > Sent by: [email protected] > > > > > > > > Hi All > > > > It gives me pleasure to report the problem is solved - a minute ago I was > > able to login via ssh with my FreeIPA user to the problem server, while > > sitting on my terrace with a glass of wine! > > > > Thanks to Alexander for his helpful advice - we had some mail exchange > > outside the user list as I did not wish to broadcast content of keys, > > config files etc. > > > > Regardless of what I did with commands like klist, kvno everything seemed > > "ok", but I still could not ssh in. Even a ipa-getkeytab did not help. > > > > Therefore I decided to opt for brute force and (partial) ignorance. I > > completely uninstalled the FreeIPA client, and then reinstalled, > configured > > - ét voilà I could ssh in! > > > > This leaves the enigma: what caused the problem? I suspect the following: > > > > The host is an EL 7.1, but the first FreeIPA client installed was version > > 3.3.3 (installed as set of standard packages that we bung on all our > > servers). > > > > This worked fine to authenticate against our "old" 3.x FreeIPA server, > but > > did not work against the "new" 4.1 FreeIPA Server. > > > > When I realised I could not ssh in, one of the first things I did was to > > yum update the FreeIPA client from 3.3.3 to 4.1 - but that did not help. > > The solution was to yum remove the FreeIPA client, then yum install the > 4.1 > > client. > > > > I have some more EL 7.1 servers with the FreeIPA 3.3.3 client installed, > so > > it will be interesting to see it the problem can be reproduced. > > > > Keep up the good work, > > > > Chris > > > > > > > > > > > > > > > > > > From: Alexander Bokovoy > > <[email protected]> > > To: Christopher Lamb/Switzerland/IBM@IBMCH > > Cc: [email protected] > > Date: 29.05.2015 18:04 > > Subject: Re: [Freeipa-users] ssh problem with > migrated FreeIPA > > client on > > EL7.1 > > > > > > > > On Fri, 29 May 2015, Christopher Lamb wrote: > > > > > >Hi All > > > > > >Some weeks ago I setup a new FreeIPA 4.1.0 on an OEL 7.1 server to > replace > > >the existing FreeIPA 3.0.0 running on OEL 6.5, and successfully migrated > > >across the users. > > > > > >We have 50 odd Servers that are FreeIPA clients. Today I started > migrating > > >these one-by-one from the old FreeIPA 3.x server to the new FreeIPA 4 > > >server by doing an ipa-client-install --uninstall from the old, and > > >ipa-client-install to register with the new 4.1.0 server. > > > > > >Most of the FreeIPA clients are running OEL 6.5, and for these the > > >migration process above worked perfectly. After migrating the server, I > > >could ssh in with my FreeIPA user. > > > > > >Then I migrated an OEL 7.1 server. The migration itself seemed to work, > > and > > >getent passwd was successful for my FreeIPA user. However when I try and > > >ssh in, my FreeIPA user / password is not accepted. > > > > > >Before the migration I could ssh into the problem server (though > evidently > > >it was using my FreeIPA user from the old FreeIPA server). > > > > > >I can ssh in with a local (non ldap) user, so ssh is running and > working. > > > > > >>From user root I can successfully su to my FreeIPA user. > > > > > >Further investigation showed that version of ipa-client installed was > > >3.3.3, so I yum updated this to 4.1.0. > > > > > >However I still cannot ssh into the OEL 7.1 box with my FreeIPA user. > The > > >same user continues to work for the 6.5 boxes. > > > > > >A colleague tried to ssh in with his FreeIPA user, and was also > rejected, > > >so the problem is not my user, but is probably for all FreeIPA users. > > > > > >A failed ssh login attempt causes the following error > in /var/log/messages > > > > > >[sssd[krb5_child[5393]]]: Decrypt integrity check failed > > It means /etc/krb5.keytab contains keys from older system and SSSD > > picks them up. > > Can you show output of 'klist -kKet'? > > -- > > / Alexander Bokovoy > > > > > > > > > > > > -- > > Manage your subscription for the Freeipa-users mailing list: > > https://www.redhat.com/mailman/listinfo/freeipa-users > > Go to http://freeipa.org for more info on the project > > > > > > > > > > -- > > Manage your subscription for the Freeipa-users mailing list: > > https://www.redhat.com/mailman/listinfo/freeipa-users > > Go to http://freeipa.org for more info on the project > > -- > Manage your subscription for the Freeipa-users mailing list: > https://www.redhat.com/mailman/listinfo/freeipa-users > Go to http://freeipa.org for more info on the project > > > > -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
