[Freeipa-users] Re: login to host issue

[Rob Crittenden]

Patterson, David via FreeIPA-users wrote:
>  Hello,
>  
>  Â 
>  
>  IPA version 4.6.8.
>  
>  Â 
>  
>  Got a host that doesn’t allow user logins, but was joined at some point
>  to the domain.
>  
>  Everything that I can think of to check appears to be working
>  
>  Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Log into client system with local credentials
>  
>  Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Logs show invalid user attempts
>  
>  Client Keytab looks valid…..do these ever expire?
>  
>  Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Ktutil
>  
>
> Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 
> read_kt /etc/krb5.keytab
>  
>
> Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 
> list
>  
>
> Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 
> Shows
>  the host/hostname.domain
>  
>
> Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 
> Quit
>  
>                  Cannot ‘id admin’ or ‘id’ any other user
>  
>  Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Can obtain Kerberos keys for admin
>  
>  Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Can run ipa user-show for any user
>  
>  Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  System appears valid in idmweb gui
>  
>  Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 
>  
>  What did I miss?
>  
>  Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Get a new keytab for the client with ipa-getkeytab?
Maybe...
>  
>  Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Is there some server/client certs I should be checking?
No.

I'd start with, as root, kinit -kt /etc/krb5.keytab

That will tell you if the keytab is ok. You can also run klist -kt
/etc/krb5.keytab and note the highest kvno. Then on a working system run
kvno host/<host of client> and see if they match.

If either fails use ipa-getkeytab to get a new one.

I assume sssd is running? You might try their troubleshooting guide as well.

rob