Hello again,
Following up on an early query about configuring IPA clients that are in
different DNS domains than the IPA server domain & realm
This is our setup:
AD Servers & IPA:
------------------------
AD Forest #1: company-test.org
AD Forest #2: company-aws.org
IPA Server : company-ipa.org
I don't really need Kerberos or Kerberized SSO -- I really just want to
get SSH logins via passwords working before moving on to SSH keys - my
understanding of the way I'm configuring things basically breaks
Kerberos but should allow other user and authentication services to work.
Client Machine:
------------------
Hostname: client.company-aws.org
I was able to configure a client in the domain 'company-aws.org' by
abusing the ipa-client-install command:
$ client.company-aws.org> # ipa-client-install --server
ipa.company-ipa.org --domain company-ipa.com
Barring the usual warnings about losing autodiscover based failover the
above command actually worked and took me pretty far. I can launch an
AWS host and give it the standard "company-aws.org" hostname but still
bind it explicitly to an IPA server running in a different DNS domain
and realm.
The nice thing is that it appears that everything but SSH w/ passwords
is working on the client machine with the different DNS domain name
# id u...@company-test.org works
# id u...@company-aws.org works
# id <local IPA user> works
# getent passwd u...@company-test.org works
# getent passwd u...@company-aws.org works
# getent passwd <local IPA user> works
# su - u...@company-test.org works
# su - u...@company-aws.org works
# su - <local IPA user> works
What fails are things like:
$ ssh localhost -l u...@company-aws.org
The client sees a standard "Permission Denied, please try again" error
On the client host I mainly see this in /var/log/messages:
client.company-aws.org: [sssd[krb5_child[2311]]]: Cannot find KDC for
realm "COMPANY-AWS.ORG"
I'm hesitant to make significant changes for fear of breaking the fact
that my client can actually resolve users and passwords! I'm incredibly
happy to even have the basic identities being recognized.
The problem with configuring SSH for password logins seems like it could
be somewhere in krb5.conf, ssh_config, sshd_config, sssd.conf or even
down in the PAM configuration and I'm not really where to start
troubleshooting "just SSH" when everything else seems to be working OK.
Any tips, tricks or URLs for configuring the local SSH client on IPA
clients would be appreciated. I suspect I'm a victim of either a dumb
mistake or something that needs a manual tweak after doing an IPA client
install where the client hostname is different from the IPA domain and
realm.
Can provide config files and logs but did not want to spam a huge
message in case there was a simple set of things I should be looking at
-Chris
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
