2

We've been having trouble with users logging in to our Linux machines and the username part of their Kerberos principal being in uppercase. This is a disaster for the security policies on our Hadoop cluster which expects lowercase usernames.

Background is that we have CentOS 7.3 machines which are contacting a Windows AD.

I've found the circumstances under which this happens. I ssh into one of the Linux machines. I'm not using my SSH key so I have to enter my password. When I do this I get the username of the Kerberos principal in uppercase:

[root@machine1 ~]# ssh jasbre@machine2
jasbre@machine2's password:
Last login: Mon Sep 18 12:06:13 2017 from machine1
[jasbre@machine ~]$ klist
Ticket cache: FILE:/tmp/krb5cc_1379946670
Default principal: JASBRE@XXX.YYY.COM

Valid starting       Expires              Service principal
09/18/2017 12:13:21  09/18/2017 22:13:21  krbtgt/XXX.YYY.COM@XXX.YYY.COM
        renew until 09/25/2017 12:13:21

Now I login with my SSH key and don't have a Kerberos ticket when I log in (since I haven't entered a password). I then do a kinit and I get the lowercase username in the principal:

[jasbre@machine2 ~]$ kinit
Password for jasbre@XXX.YYY.COM:
[jasbre@machine2 ~]$ klist
Ticket cache: FILE:/tmp/krb5cc_1379946670
Default principal: jasbre@XXX.YYY.COM

Valid starting       Expires              Service principal
09/18/2017 12:14:13  09/18/2017 22:14:13  krbtgt/XXX.YYY.COM@XXX.YYY.COM
        renew until 09/25/2017 12:14:07

What's going on here? I assume it is just something that I'm getting back from the domain controller. Can I somewhere steer this with my sssd.conf file on the Linux machine? I'm already have case_sensitive = false in sssd.conf.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.