Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Thanks to your help , I am getting closer. Now at this point, I am getting the following message with logging in via ssh:

debug1: Unspecified GSS failure.  Minor code may provide more information
Wrong principal in request

From the client side, after I request a ticket, I can confirm that it is being generated at the KDC log

Sep 27 00:37:11 kerberos.monzell.com krb5kdc[6060](info): TGS_REQ (1 etypes {18}) 192.168.15.37: ISSUE: authtime 1317097291, etypes {rep=18 tkt=18 ses=18}, foster@MONZELL.COM for krbtgt/MONZELL.COM@MONZELL.COM

and from the klist:

foster@kvm0007 ~]$ klist -f
Ticket cache: FILE:/tmp/krb5cc_502
Default principal: foster@MONZELL.COM

Valid starting     Expires            Service principal
09/27/11 00:21:31  09/28/11 00:21:31  krbtgt/MONZELL.COM@MONZELL.COM
    renew until 09/27/11 00:21:31, Flags: FRI
09/27/11 00:21:56  09/28/11 00:21:31  host/kerberos.monzell.com@MONZELL.COM
    renew until 09/27/11 00:21:31, Flags: FRT
[foster@kvm0007 ~]$ 

I initiate with the following:

ssh -p222 -K -lfoster  kerberos.monzell.com -vvv

From the server side, I setup a debug here:

/usr/sbin/sshd -d -D -f sshd_config

Here is the full debug from the client side:

[foster@kvm0007 ~]$ ssh -p222 -K -lfoster  kerberos.monzell.com -vvv
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010
debug1: Reading configuration data /home/users/foster/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to kerberos.monzell.com [192.168.15.100] port 222.
debug1: Connection established.
debug1: identity file /home/users/foster/.ssh/identity type -1
debug1: identity file /home/users/foster/.ssh/id_rsa type -1
debug3: Not a RSA1 key file /home/users/foster/.ssh/id_dsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /home/users/foster/.ssh/id_dsa type 2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug3: Wrote 792 bytes for a total of 813
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug3: Wrote 24 bytes for a total of 837
debug2: dh_gen_key: priv key bits set: 136/256
debug2: bits set: 536/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: Wrote 144 bytes for a total of 981
debug3: put_host_port: [192.168.15.100]:222
debug3: put_host_port: [kerberos.monzell.com]:222
debug3: check_host_in_hostfile: filename /home/users/foster/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /etc/ssh/ssh_known_hosts
debug3: check_host_in_hostfile: filename /home/users/foster/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /etc/ssh/ssh_known_hosts
debug1: checking without port identifier
debug3: check_host_in_hostfile: filename /home/users/foster/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 1
debug3: check_host_in_hostfile: filename /home/users/foster/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 1
debug1: Host 'kerberos.monzell.com' is known and matches the RSA host key.
debug1: Found key in /home/users/foster/.ssh/known_hosts:1
debug1: found matching key w/out port
debug2: bits set: 519/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: Wrote 16 bytes for a total of 997
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug3: Wrote 48 bytes for a total of 1045
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/users/foster/.ssh/identity ((nil))
debug2: key: /home/users/foster/.ssh/id_rsa ((nil))
debug2: key: /home/users/foster/.ssh/id_dsa (0x7f23d128dd10)
debug3: Wrote 64 bytes for a total of 1109
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: Trying to reverse map address 192.168.15.100.
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 96 bytes for a total of 1205
debug1: Delegating credentials
debug3: Wrote 1392 bytes for a total of 2597
debug1: Delegating credentials
debug1: Unspecified GSS failure.  Minor code may provide more information
Generic error (see e-text)

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 96 bytes for a total of 2693
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 96 bytes for a total of 2789
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 96 bytes for a total of 2885
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/users/foster/.ssh/identity
debug3: no such identity: /home/users/foster/.ssh/identity
debug1: Trying private key: /home/users/foster/.ssh/id_rsa
debug3: no such identity: /home/users/foster/.ssh/id_rsa
debug1: Offering public key: /home/users/foster/.ssh/id_dsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug3: Wrote 528 bytes for a total of 3413
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
foster@kerberos.monzell.com's password: 

And from the server side:

[root@kerberos ~]# /usr/sbin/sshd -d -D -f sshd_config
debug1: sshd version OpenSSH_5.3p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: rexec_argv[2]='-D'
debug1: rexec_argv[3]='-f'
debug1: rexec_argv[4]='sshd_config'
debug1: Bind to port 222 on 0.0.0.0.
Server listening on 0.0.0.0 port 222.
debug1: Bind to port 222 on ::.
Server listening on :: port 222.


debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 192.168.15.37 port 35193
debug1: Client protocol version 2.0; client software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: permanently_set_uid: 74/74
debug1: list_hostkey_types: ssh-rsa,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user foster service ssh-connection method none
debug1: attempt 0 failures 0
debug1: PAM: initializing for "foster"
debug1: PAM: setting PAM_RHOST to "kvm0007.monzell.com"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: userauth-request for user foster service ssh-connection method gssapi-with-mic
debug1: attempt 1 failures 0
Postponed gssapi-with-mic for foster from 192.168.15.37 port 35193 ssh2
debug1: Unspecified GSS failure.  Minor code may provide more information
Wrong principal in request

debug1: Got no client credentials
debug1: userauth-request for user foster service ssh-connection method gssapi-with-mic
debug1: attempt 2 failures 1
debug1: userauth-request for user foster service ssh-connection method gssapi-with-mic
debug1: attempt 3 failures 1
debug1: userauth-request for user foster service ssh-connection method gssapi-with-mic
debug1: attempt 4 failures 1
debug1: userauth-request for user foster service ssh-connection method publickey
debug1: attempt 5 failures 1
debug1: test whether pkalg/pkblob are acceptable
debug1: temporarily_use_uid: 502/502 (e=0/0)
debug1: trying public key file /home/users/foster/.ssh/authorized_keys
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 502/502 (e=0/0)
debug1: trying public key file /home/users/foster/.ssh/authorized_keys2
debug1: restore_uid: 0/0
Failed publickey for foster from 192.168.15.37 port 35193 ssh2

List of principals:

[root@kerberos ~]# kadmin.local
Authenticating as principal rilindo/admin@MONZELL.COM with password.
kadmin.local:  listprincs
K/M@MONZELL.COM
foster@MONZELL.COM
host/kerberos.monzell.com@MONZELL.COM
host/kvm0007.monzell.com@MONZELL.COM
joe@MONZELL.COM
kadmin/admin@MONZELL.COM
kadmin/changepw@MONZELL.COM
kadmin/sl6@MONZELL.COM
krbtgt/MONZELL.COM@MONZELL.COM
monzell@MONZELL.COM
rilindo/admin@MONZELL.COM
rilindo@MONZELL.COM

Here is the output from the key tab from the client:

[root@kvm0007 ~]# klist -k /etc/krb5.keytab
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   2 host/kvm0007.monzell.com@MONZELL.COM
   2 host/kvm0007.monzell.com@MONZELL.COM
   2 host/kvm0007.monzell.com@MONZELL.COM
   2 host/kvm0007.monzell.com@MONZELL.COM

And the server:

[root@kerberos ~]# klist -k  /etc/krb5.keytab 
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   2 host/kerberos.monzell.com@MONZELL.COM
   2 host/kerberos.monzell.com@MONZELL.COM
   2 host/kerberos.monzell.com@MONZELL.COM
   2 host/kerberos.monzell.com@MONZELL.COM
   2 host/kerberos.monzell.com@MONZELL.COM
   2 host/kerberos.monzell.com@MONZELL.COM
   2 host/kerberos.monzell.com@MONZELL.COM
   2 host/kerberos.monzell.com@MONZELL.COM
   2 host/kerberos.monzell.com@MONZELL.COM
   2 host/kerberos.monzell.com@MONZELL.COM

And the krb5kdc.conf (both the same on the client the server).

[root@kvm0007 ~]# cat /etc/krb5.conf
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = MONZELL.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]

 MONZELL.COM = {
  kdc = kerberos.monzell.com
  admin_server = kerberos.monzell.com
  default_domain = monzell.com
 }

[domain_realm]
 .monzell.com = MONZELL.COM
 monzell.com = MONZELL.COM

For some reason, I want to say it is still some sort of hostname issue, but I can't say for certainty at this point.

EDIT: Output of getprinc:

root@kerberos ~]# kadmin -q "getprinc host/kerberos.monzell.com"
Authenticating as principal rilindo/admin@MONZELL.COM with password.
Password for rilindo/admin@MONZELL.COM: 
Principal: host/kerberos.monzell.com@MONZELL.COM
Expiration date: [never]
Last password change: Sun Sep 25 16:34:01 EDT 2011
Password expiration date: [none]
Maximum ticket life: 1 day 00:00:00
Maximum renewable life: 0 days 00:00:00
Last modified: Sun Sep 25 16:34:01 EDT 2011 (root/admin@MONZELL.COM)
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 4
Key: vno 2, aes256-cts-hmac-sha1-96, no salt
Key: vno 2, aes128-cts-hmac-sha1-96, no salt
Key: vno 2, des3-cbc-sha1, no salt
Key: vno 2, arcfour-hmac, no salt
MKey: vno 1
Attributes:
Policy: hosts

Output from hostname command:

[root@kerberos ~]# hostname -f kerberos.monzell.com
kerberos.monzell.com
[root@kerberos ~]# 
share|improve this question
    
Output of kadmin -q "getprinc host/kerberos.monzell.com. Output of hostname -f on kerberos.monzell.com . –  84104 Sep 27 '11 at 6:28
    
Done. Post has been updated. –  Rilindo Sep 27 '11 at 14:08

1 Answer 1

up vote 0 down vote accepted

After taking a very careful comparison between this link (which I started with) and this link, it turns out the host principal policies was wrong.

I added the principal as follows:

addpol hosts
addprinc -randkey -policy hosts host/kvm0007.monzell.com

When it really should apparently be:

addpol host
addpinc -randkey -policy host host/kvm0007.monzell.com

I went and removed all the host principals and then policy, then redid the policy and re-added the principals (while redoing the key tabs). Now my SSO worked, at least from that kvm007 to kerberos. Now for the other clients. :P

share|improve this answer
    
And they worked! In retrospect, either convention would have worked. It just that mixing between is likely what caused my problem. –  Rilindo Sep 28 '11 at 3:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.