CentOS - Jan 2010 - Kerberos integration in directory server

Hi,

Got some issues regarding Kerberos and Directory Server and hope someone can
help me out.
Used these for the configiruation :
http://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-kerberos.html
http://www.redhat.com/docs/manuals/dir-server/8.1/install/index.html

Server : CentOS 5.4 with Kerberos and Directory Server installed
Client : CentOS 5.4

I use putty to connect to the client, which authenticates against the server.
Using Kerberos or LDAP worked perfectly (using system-config-authentication on
the client for configuration)

The only thing that doesn't seem to work is the kerberized version of the
login via LDAP on the directory Server. Shouldn't I get a Kerberos ticket
for that ? If I activate kerberos AND ldap in system-config-authentication it
fails :

Jan 25 13:24:59 monarch sshd[3947]: pam_unix(sshd:auth): check pass; user
unknown
Jan 25 13:24:59 monarch sshd[3947]: pam_unix(sshd:auth): authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.1
Jan 25 13:24:59 monarch sshd[3947]: pam_succeed_if(sshd:auth): error retrieving
information about user testuser
Jan 25 13:25:01 monarch sshd[3947]: Failed password for invalid user testuser
from 192.168.0.1 port 1142 ssh2

I followed the instructions here : 
http://directory.fedoraproject.org/wiki/Howto:Kerberos

Maybe I just didn't get it ;)

Thanks in advance,

Peter

?> -----Original Message-----
> From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On
> Behalf Of nimmermehr at chello.at
> Sent: Tuesday, January 26, 2010 6:23 AM
> To: centos at centos.org
> Subject: [CentOS] Kerberos integration in directory server
> 
> Hi,
> 
> Got some issues regarding Kerberos and Directory Server and hope someone
> can help me out.
> Used these for the configiruation :
> http://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-kerberos.html
> http://www.redhat.com/docs/manuals/dir-server/8.1/install/index.html
> 
> Server : CentOS 5.4 with Kerberos and Directory Server installed
> Client : CentOS 5.4
> 
> I use putty to connect to the client, which authenticates against the
> server.
> Using Kerberos or LDAP worked perfectly (using system-config-
> authentication on the client for configuration)
> 
> The only thing that doesn't seem to work is the kerberized version of
the
> login via LDAP on the directory Server. Shouldn't I get a Kerberos
ticket
> for that ? If I activate kerberos AND ldap in system-config-authentication
> it fails :
> 
> Jan 25 13:24:59 monarch sshd[3947]: pam_unix(sshd:auth): check pass; user
> unknown
> Jan 25 13:24:59 monarch sshd[3947]: pam_unix(sshd:auth): authentication
> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.1
> Jan 25 13:24:59 monarch sshd[3947]: pam_succeed_if(sshd:auth): error
> retrieving information about user testuser
> Jan 25 13:25:01 monarch sshd[3947]: Failed password for invalid user
> testuser from 192.168.0.1 port 1142 ssh2
> 
> I followed the instructions here :
> http://directory.fedoraproject.org/wiki/Howto:Kerberos
> 
> Maybe I just didn't get it ;)
> 
> Thanks in advance,
> 
> Peter
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
My setup is a tad different than yours in that I integrated MIT Kerberos with
OpenLDAP. While our configurations are different I'm sure you're trying
for kerberized logins (System authenticates against Kerberos and pulls account
information from LDAP). If so here are some items you may want to verify you
have included in your system-auth config file.

Auth	sufficient	pam_krb5.so use_first_pass
Auth	sufficient	pam_unix.so nullok try_first_pass

Account sufficient	pam_ldap.so
Account required		pam_unix.so

Password sufficient pam_krb5.so
Password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authok

Session	optional	pam_keyinit.so revoke
Session	optional	pam_krb5.so	

Dan

> > -----Original Message-----
>> From: centos-bounces at centos.org [mailto:centos-bounces at
centos.org] On
>> Behalf Of nimmermehr at chello.at
>> Sent: Tuesday, January 26, 2010 6:23 AM
>> To: centos at centos.org
>> Subject: [CentOS] Kerberos integration in directory server
>> 
>> Hi,
>> 
>> Got some issues regarding Kerberos and Directory Server and hope
someone
>> can help me out.
>> Used these for the configiruation :
>>
http://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-kerberos.html
>> http://www.redhat.com/docs/manuals/dir-server/8.1/install/index.html
>> 
>> Server : CentOS 5.4 with Kerberos and Directory Server installed
>> Client : CentOS 5.4
>> 
>> I use putty to connect to the client, which authenticates against the
>> server.
>> Using Kerberos or LDAP worked perfectly (using system-config-
>> authentication on the client for configuration)
>> 
>> The only thing that doesn't seem to work is the kerberized version
of the
>> login via LDAP on the directory Server. Shouldn't I get a Kerberos
ticket
>> for that ? If I activate kerberos AND ldap in
system-config-authentication
>> it fails :
>> 
>> Jan 25 13:24:59 monarch sshd[3947]: pam_unix(sshd:auth): check pass;
user
>> unknown
>> Jan 25 13:24:59 monarch sshd[3947]: pam_unix(sshd:auth): authentication
>> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.1
>> Jan 25 13:24:59 monarch sshd[3947]: pam_succeed_if(sshd:auth): error
>> retrieving information about user testuser
>> Jan 25 13:25:01 monarch sshd[3947]: Failed password for invalid user
>> testuser from 192.168.0.1 port 1142 ssh2
>> 
>> I followed the instructions here :
>> http://directory.fedoraproject.org/wiki/Howto:Kerberos
>> 
>> Maybe I just didn't get it ;)
>> 
>> Thanks in advance,
>> 
>> Peter
>> _______________________________________________
>> CentOS mailing list
>> CentOS at centos.org
>> http://lists.centos.org/mailman/listinfo/centos
>My setup is a tad different than yours in that I integrated MIT Kerberos
with OpenLDAP. While our configurations are different I'm sure
>you're trying for kerberized logins (System authenticates against
Kerberos and pulls account information from LDAP). If so here are >some items
you may want to verify you have included in your system-auth config file.
>Auth	sufficient	pam_krb5.so use_first_pass
>Auth	sufficient	pam_unix.so nullok try_first_pass
>Account sufficient	pam_ldap.so
>Account required		pam_unix.so
>Password sufficient pam_krb5.so
>Password sufficient pam_unix.so sha512 shadow nullok try_first_pass
use_authok
>Session	optional	pam_keyinit.so revoke
>Session	optional	pam_krb5.so	
>Dan
Just to see if I understood it correctly :
It is mandatory that every LDAP-User has a functional Kerberos-login (user and
PW). Is it possible for such a user to access a server that only has ldap for
authentication and checks against the LDAP-Server ?

About testing : How can I check if the information is pulled out of ldap ? 

Thanks in advance :)

Peter