2

This question already has an answer here:

I am now configuring KDC client and server. My goal is to login to KDC server from KDC client using user1 without password prompt.

However, although I have below configuration, password prompt still comes us when I login from KDC client. Could someone give me advice what went wrong with my configuration?

Client and Server

KDC Client : server1.ywlocal.net (RHEL 7.3)
KDC Server : server2.ywlocal.net (RHEL 7.3)

/etc/hosts

On server1.ywlocal.net :

[root@server1 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

192.168.11.11 server1.ywlocal.net
192.168.11.12 server2.ywlocal.net

On server2.ywlocal.net:

[root@server2 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

192.168.11.11 server1.ywlocal.net
192.168.11.12 server2.ywlocal.net

List of principals

[root@server1 ~]# kadmin -p root/admin
Authenticating as principal root/admin with password.
Password for root/admin@EXAMPLE.COM: 
kadmin:  list_principals
K/M@EXAMPLE.COM
host/server1.ywlocal.net@EXAMPLE.COM
kadmin/admin@EXAMPLE.COM
kadmin/changepw@EXAMPLE.COM
kadmin/server2.ywlocal.net@EXAMPLE.COM
kiprop/server2.ywlocal.net@EXAMPLE.COM
krbtgt/EXAMPLE.COM@EXAMPLE.COM
root/admin@EXAMPLE.COM
user1@EXAMPLE.COM

keytab file on client side created by ktadd host/server1.ywlocal.net

[root@server1 ~]# ls -ltr /etc/krb5.keytab 
-rw-------. 1 root root 658 Jan  4 08:18 /etc/krb5.keytab

Client side TGT list

[user1@server1 ~]$ klist
Ticket cache: KEYRING:persistent:1001:1001
Default principal: user1@EXAMPLE.COM

Valid starting       Expires              Service principal
01/04/2017 08:25:34  01/05/2017 08:25:34  krbtgt/EXAMPLE.COM@EXAMPLE.COM

ssh result

[user1@server1 ~]$ ssh server2.ywlocal.net
user1@server2.ywlocal.net's password: 

Client and Server Side ssh configuration

[root@server1 ~]# egrep "GSSAPIAuthentication|GSSAPIDele"     /etc/ssh/ssh_config 

  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes

[root@server2 ~]# egrep "GSSAPIAuthentication|KerberosAuthentication" /etc/ssh/sshd_config 

KerberosAuthentication yes
GSSAPIAuthentication yes

Client side krb.conf

[root@server1 ~]# cat /etc/krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 default_realm = EXAMPLE.COM
 default_ccache_name = KEYRING:persistent:%{uid}

[realms]
 EXAMPLE.COM = {
  kdc = server2.ywlocal.net
  admin_server = server2.ywlocal.net
  default_domain = ywlocal.net
 }

[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM

ssh client side debug log

debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
Server krbtgt/YWLOCAL.NET@EXAMPLE.COM not found in Kerberos database

debug2: we sent a gssapi-with-mic packet, wait for reply

marked as duplicate by jayhendren, GAD3R, Kusalananda, countermode, Rui F Ribeiro Jan 4 '17 at 12:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Can you add the contents of /etc/krb5.conf on the client? – jayhendren Jan 4 '17 at 0:15
  • @jayhendren Thanks for the comment . I have checked the client side ssh debug log and looks like something is wrong with the ticket sent to server side. I see this in the principal "YWLOCAL.NET@EXAMPLE.COM". This should be "EXAMPLE.COM@EXAMPLE.COM" . I assume that client side is not referring to the ticket I have initiated. – Yu Watanabe Jan 4 '17 at 0:29
  • Actually, that is correct. The client's /etc/krb5.keytab should contain the host principals corresponding to the client. – jayhendren Jan 4 '17 at 0:35
  • If you're SSH'ing as user1@EXAMPLE.COM from one host on the EXAMPLE.COM domain to another host on that domain, then you should kinit user1@EXAMPLE.COM and then ssh user1@host.example.com. – jayhendren Jan 4 '17 at 0:36
  • @jayhendren I got it working . I had to change all the domains in realm from EXAMPLE.COM to YWLOCAL.NET , which is my network domain. I was confused with this. Configuration files I changed was /etc/krb5.conf, /var/kerberos/krb5kdc/kdc.conf, kadm5.acl on server side and /etc/krb5.conf on client side. Thanks for the help! – Yu Watanabe Jan 4 '17 at 23:57

Browse other questions tagged or ask your own question.