To keep it short, I recently stood up a RHEL 7 server and enrolled it in FreeIPA. All other enrolled servers can SSH to each other without any issue using just the hostname, authenticating with gssapi-with-mic, but this one seems to have something configured wrong, and falls back to password authentication. Specifically, it appears to be attempting to use the short hostname vs the FQDN of the remote server, unless I explicitly ssh to the FQDN.
If I ssh using the FQDN, i.e.
everything works fine. If I don't, i.e.
I'm prompted for a password. Enabling ssh debug gives the following:
debug3: authmethod_is_enabled gssapi-with-mic debug1: Next authentication method: gssapi-with-mic debug1: Unspecified GSS failure. Minor code may provide more information Server host/remote-hostname@REALM.COM not found in Kerberos database
nslookup correctly gives the server's FQDN:
[kevin@local-hostname ~]$ nslookup remote-hostname Server: x.x.x.x Address: x.x.x.x#53 Name: remote-hostname.domain.com Address: x.x.x.x
The local server's domain seems to be set correctly:
[kevin@local-hostname ~]$ hostname local-hostname [kevin@local-hostname ~]$ hostname -f local-hostname.domain.com
I'm a bit stumped as to where to go from here. Can someone tell me why sshing to the remote hostname might not be working? Unfortunately I'm new to Kerberos and don't really know where to look, besides verifying that the /etc/krb5.conf file on the new server matches that on other working servers.