Hello list.
I'm a new user of FreeIPA trying to use it to manage SSH user
authentication in a cluster of CentOS machines.
I built a server dedicated to run FreeIPA server and have successfully
set it up. I'm able to get the web UI from it, and everything seems as
expected based on the docs.
I tried to enroll a CentOS 7 client to the new FreeIPA server so that I
can login to this client via SSH using the user accounts I created on
the FreeIPA server. This is where I hit a roadblock. The freeipa-client
install went as per the docs, but I'm unable to login via SSH.
Note:
My FreeIPA server is in a different domain than the client. and the
server and client are served by different DNS servers.
FreeIPA server: freeipa1.nghpc.dk
served by a DNS server ns1.nghpc.dk
resolves to an internal ip address 10.x.x.x
reverse lookup is also successful.
FreeIPA client: c10b01.ctrl.ghpc.dk
served by a DNS server dns.ghpc.dk
resolves to an internal ip address 10.x.x.x
reverse lookup is successful.
Added an additional DNS A record to the freeipa server and the client
can successfully resolve freeipa1.nghpc.dk
Trying to login to the newly enrolled client:
localmachine > ssh admin@c10b01
Password:
Password:
Password:
It keeps repeating the password prompts in spite of supplying the
correct password. No meaningful errors thrown either.
On the client,
here is how the krb5.conf looks like:
cat /etc/krb5.conf
#File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = NGHPC.DK
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
NGHPC.DK = {
kdc = freeipa1.nghpc.dk:88
master_kdc = freeipa1.nghpc.dk:88
admin_server = freeipa1.nghpc.dk:749
kpasswd_server = freeipa1.nghpc.dk:464
default_domain = nghpc.dk
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.nghpc.dk = NGHPC.DK
nghpc.dk = NGHPC.DK
c10b01.ctrl.ghpc.dk = NGHPC.DK
.ctrl.ghpc.dk = NGHPC.DK
ctrl.ghpc.dk = NGHPC.DK
I do not see any errors in any of the logs at /var/log/ and
/var/log/sssd/
However, if I'm logged in as root on the client box, I can see that the
users I created on FreeIPA exist and are accessible.
[root@c10b01 ~]# id nasampath
uid=29756(nasampath) gid=1517 groups=1517
[root@c10b01 ~]# id admin
uid=1768600000(admin) gid=1768600000(admins) groups=1768600000(admins)
I can su into them fine. but not login as them over SSH.
I'm lost trying to troubleshoot this. Appreciate any help figuring out
where to look to understand what is going on..
Thanks,
--
Aravindh Sampathkumar
aravi...@fastmail.com
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
