Hey all. I am working on getting solaris 10 and 9 clients authenticating to
active directory. We have a test setup with windows 2003 r2 and the unix
fields filled out. All was going well with a combination of pam_krb5 and
nss_ldap and ldap mappings, including working automouting of home directories.
This included orginally, set up instructions from microsoft where they said to
create a user account, assign a password, and generate a keytab to transfer to
the unix host to import. This process also went well.
This changed when we tried to use a newer samba and share = domain. Which
required samba to join active directory. This played with our keytab settings
as it tried to create another machine account. We decided it would be easier
to let samba handle the joining and managing of the krb5.keytab file as it did
it more "properly" anyway. Now we can't seem to get ssh
authentication working
again. kinit username works as does kpasswd. We can run net ads keytab
commands and net ads changetrustpw fine, but when we try to do what worked
before, ssh username@localhost we now get the error "Key table entry not
found". We have spent considerable time messing with the local hostname
changing it from FQDN to short and whatnot, but to no avail. They keytab also
appears to have entries for both, so I don't understand this error. DNS
works
in both directions for this host, and like I said when creating a keytab from
a user account on windows, manually, this process works.
If I run something like "kinit -k host/mundi@TESTAUTH.NETWORK" I get a
preauthentication failed message. If insted of the mundi I make that fully
quallified I get the client not found in kerberos database error.
I should also mention in order to get this far I had to add supported_enctypes
= des-cbc-md5 and various other lines to krb5.conf to only allow that encoding
as solaris does not allow many types. This successfuly limited my keytab down
to only those enc types. I also added to smb.conf use kerberos keytab = yes,
to have a unified system domain join, ie ssh and samba would both be
preauthenicated from the machine account samba created.
Attached are possibly helpful log and config files.
In short, how can I get ssh authentication working again?
Thanks,
Christian McHugh
Northern Arizona University
