I am encountering the following problem: I am trying to connect from a client VM to a server VM using SSH with Kerberos authentication, but SSH still asking me for password. Obviously, I modified the /etc/ssh/sshd_config file, on server side, to enable: GSSAPIAuthentication yes and GSSAPICleanupC...
I have just tried, but ssh still asking for password. micheleclient@client:~$ sudo kinit michele [sudo] password di micheleclient: Password for michele@SERVER.COM: micheleclient@client:~$ sudo klist -ef Ticket cache: FILE:/tmp/krb5cc_1002 Default principal: michele@SERVER.COM Valid starting Expires Service principal 07/05/2018 09:43:48 08/05/2018 09:43:48 krbtgt/SERVER.COM@SERVER.COM Flags: FPI, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 micheleclient@client:~$ ssh michele@server.com michele@server's password:
I also made same changes: adding the row default_ccache_name = /tmp/krb5cc_1002 in the krb5.conf file to force the access to that cache, and verified the permission on that file: micheleclient@client:/tmp$ ls -l krb5cc_1002 -rw------- 1 root root 695 mag 7 09:43 krb5cc_1002 and looking at ssh debug I get: Unspecified GSS failure. Minor code may provide more information No Kerberos credentials available: Credentials cache permissions incorrect (filename: /tmp/krb5cc_1002) before askin for password. Something went wrong with credentials.
Well, I used sudo just because the user registered in the SERVER.COM (my realm) realm is michele (michele@SERVER.COM) and not micheleclient. By typing su michele, and using kinit (without sudo) I get michele@client:~$ kinit Password for michele@SERVER.COM: kinit: Failed to store credentials: Internal credentials cache error (filename: /tmp/krb5cc_1002) while getting initial credentials
you mean, remove the /tmp/krb5cc_1002 file stored on the client machine?
Dear Sebastian, I am getting crazy. I have been trying for many days. Sorry if I text you...
I removed the krb5cc_1002 file in the /tmp directory and I got the ticket!
I have just typed: ssh -v server.com (server.com is the hostname of server machine and the IP address was added in the /etc/host file), but it still asking me for password and debug gets me: debug1: Delegating credentials debug1: Delegating credentials debug1: Unspecified GSS failure. Minor code may provide more information The ticket isn't for us
And I want to say you that I found the following on google: The ticket isn't for us
Ticket/authenticator don't match
Cause: There was a mismatch between the ticket and authenticator. The principal name in the request might not have matched the service principal's name, because the ticket was being sent with an FQDN name of the principal while the service expected non-FQDN, or vice versa.
Solution: If you get this error when you are running applications other than kprop, investigate whether the server's keytab file is correct.
/tmp$ ssh -vv server.com OpenSSH_7.5p1 Ubuntu-10ubuntu0.1, OpenSSL 1.0.2g 1 Mar 2016 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for server.com debug1: /etc/ssh/ssh_config line 33: Applying options for * debug2: resolving "server" port 22 debug2: ssh_connect_direct: needpriv 0 debug1: Connecting to server [192.168.56.4] port 22. debug1: Connection established. debug1: key_load_public: No such file or directory debug1: identity file /home/michele/.ssh/id_rsa type -1
that's all
what kind of social account you have? just for further help, but I don't want to give you troubles
Discussion between michele_ub and Seb…
Discussion between michele_ub and Seb…