[28339] in Kerberos
Re: Active Directory LDAP SSH
daemon@ATHENA.MIT.EDU (Michael B Allen)
Tue Sep 4 14:18:30 2007
Message-ID: <78c6bd860709041118x20de954eia45ab978438dc1ff@mail.gmail.com>
Date: Tue, 4 Sep 2007 14:18:05 -0400
From: "Michael B Allen" <ioplex@gmail.com>
To: "Roman S" <kleinerroemer@hotmail.com>
In-Reply-To: <BAY131-W144CCF962CEAF895AD077EBFCA0@phx.gbl>
MIME-Version: 1.0
Content-Disposition: inline
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 9/4/07, Roman S <kleinerroemer@hotmail.com> wrote:
>
> Hey guys!
>
> I've configured a Microsoft Active Directory with LDAP and Kerberos, and some Linux (Redhat) clients who authenticate to it.
> I'm able to get some tickets for the users who are in the Active Directory, but SSH behaves a bit strange.
>
> I can always ssh to the same machine again.
> Like
> #foo: ssh foo
>
> but I can't ssh to any other computers. I always get a Permission denied.
> I've only enabled gssapi authentication, all others are disabled.
> Debug output of ssh didn't get me any further.
Hi Roman,
Did you create the host principal and keytab for the target server?
Also, you'll need a .k5login file in the home directory of the target:
$ cat ~/.k5login
alice@EXAMPLE.COM
Google for info about the above and you should find a tutorial I would think.
Mike
> At the moment users are basicly managed over NIS, only a few test users are in LDAP, so they don't have home directories. I don't know if this could cause the trouble.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
