2

To keep it short, I recently stood up a RHEL 7 server and enrolled it in FreeIPA. All other enrolled servers can SSH to each other without any issue using just the hostname, authenticating with gssapi-with-mic, but this one seems to have something configured wrong, and falls back to password authentication. Specifically, it appears to be attempting to use the short hostname vs the FQDN of the remote server, unless I explicitly ssh to the FQDN.

If I ssh using the FQDN, i.e.

ssh remote-hostname.domain.com

everything works fine. If I don't, i.e.

ssh remote-hostname

I'm prompted for a password. Enabling ssh debug gives the following:

debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
Server host/remote-hostname@REALM.COM not found in Kerberos database

nslookup correctly gives the server's FQDN:

[kevin@local-hostname ~]$ nslookup remote-hostname
Server:     x.x.x.x
Address:    x.x.x.x#53

Name:   remote-hostname.domain.com
Address: x.x.x.x

The local server's domain seems to be set correctly:

[kevin@local-hostname ~]$ hostname
local-hostname
[kevin@local-hostname ~]$ hostname -f
local-hostname.domain.com

I'm a bit stumped as to where to go from here. Can someone tell me why sshing to the remote hostname might not be working? Unfortunately I'm new to Kerberos and don't really know where to look, besides verifying that the /etc/krb5.conf file on the new server matches that on other working servers.

3

The issue was actually a difference in /etc/krb5.conf I managed to overlook - my new server had

dns_canonicalize_hostname = false

set, which - exactly as you might expect - caused the hostname to not be canonicalized to the FQDN. According to the man page, this option defaults to "true," so I'm not exactly sure why it was changed. The file has the comment

#File modified by ipa-client-install

making me believe it was the IPA enrollment that did it. Setting the option to "true" (or removing the line) fixes everything. I'll leave the question open for a bit in case anyone has some better insight.

  • It's probably disabled for performance reasons, just guessing. – Brian Topping Jan 16 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.