0

I currently try so setup the kerberos auth on a server living in a sub domain "sub.example.com". The KDC manages EXAMPLE.COM together with a dns server which manages 'example.com'. Due to organizational reasons we have a subdomain 'sub.example.com' for some servers (server1.sub.example.com). This subdomain is managed by a separate DNS server. There, the Kerberos login via pam works fine on this server using the following /etc/krb5.conf file:

includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
[libdefaults]
        default_realm = EXAMPLE.COM
        clockskew = 300
        ticket_lifetime = 2days
        renew_lifetime = 365days
        renewable = true
        forwardable = true

[realms]
        EXAMPLE.COM = {
                kdc = kerberos.example.com
        }

If I now connect with enabled Kerberos using kerberized ssh, I get

$ssh -vvv server1.sub.example.com
...
debug1: Unspecified GSS failure.  Minor code may provide more information
Server krbtgt/SUB.EXAMPLE.COM@EXAMPLE.COM not found in Kerberos database

debug1: Unspecified GSS failure.  Minor code may provide more information
Server krbtgt/SUB.EXAMPLE.COM@EXAMPLE.COM not found in Kerberos database

debug1: Unspecified GSS failure.  Minor code may provide more information


debug3: send packet: type 50
...

and return to password login. How can I convince kerberos/ssh to use krbtgt/EXAMPLE.COM@EXAMPLE.COM instead of krbtgt/SUB.EXAMPLE.COM@EXAMPLE.COM for the servers inside the subdomain.

0

Possibly try adding in /etc/krb5.conf:

[domain_realm]
 example.com  = EXAMPLE.COM
 .example.com = EXAMPLE.COM

Hmmm. I thought sure that would work. Maybe try:

[domain_realm]
  example.com  = EXAMPLE.COM
 .example.com  = EXAMPLE.COM
 sub.example.com = EXAMPLE.COM
.sub.example.com = EXAMPLE.COM

Well, that's all I can think of to try. Hopefully someone who knows more will come along.

New contributor
scarville is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • I tried but this does not work. I already found this but it did not change the situation. – M.K. aka Grisu Sep 12 at 6:55
  • Your edit does not help at all an the problem stays the same. – M.K. aka Grisu 2 days ago
  • You need to add these lines to krb5.conf on the ssh client system, not on the server1.sub.example.com. – Tomek 5 hours ago

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.