To keep it short, I recently stood up a RHEL 7 server and enrolled it in FreeIPA. All other enrolled servers can SSH to each other without any issue using just the hostname, authenticating with gssapi-with-mic, but this one seems to have something configured wrong, and falls back to password authentication. Specifically, it appears to be attempting to use the short hostname vs the FQDN of the remote server, unless I explicitly ssh to the FQDN.
If I ssh using the FQDN, i.e.
ssh remote-hostname.domain.com
everything works fine. If I don't, i.e.
ssh remote-hostname
I'm prompted for a password. Enabling ssh debug gives the following:
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
Server host/[email protected] not found in Kerberos database
nslookup correctly gives the server's FQDN:
[kevin@local-hostname ~]$ nslookup remote-hostname
Server: x.x.x.x
Address: x.x.x.x#53
Name: remote-hostname.domain.com
Address: x.x.x.x
The local server's domain seems to be set correctly:
[kevin@local-hostname ~]$ hostname
local-hostname
[kevin@local-hostname ~]$ hostname -f
local-hostname.domain.com
I'm a bit stumped as to where to go from here. Can someone tell me why sshing to the remote hostname might not be working? Unfortunately I'm new to Kerberos and don't really know where to look, besides verifying that the /etc/krb5.conf file on the new server matches that on other working servers.
