Fedora 27 ssh and default kerberos config
On my new Fedora 27 system which I joined to my FreeIPA domain, I encountered an error I hadn't seen before. In the past I could just say "ssh remotehost" and it would connect me with GSSAPI auth using my kerberos key-- no password or ssh key needed! It was wonderful. However, I ran into this issue, as seen with ssh -v remotehost
debug1: Unspecified GSS failure. Minor code may provide more information
Server host/remotehost@IPA.EXAMPLE.COM not found in Kerberos database
But I know for a fact it's in the kerberos database! I duckducked (new verb) the error message and found the culprit. In file /etc/krb5.conf, this variable should be set to this value:
[libdefaults]
dns_canonicalize_hostname = true
The default is true according to man krb5.conf. but for whatever reason, whether by joining the domain, or some default of some package in Fedora 27, it was set to false. For the followers of my bgscripts package, just use this command:
sudo [updateval](https://gitlab.com/bgstack15/bgscripts/blob/master/src/usr/bin/updateval) -a /etc/krb5.conf -s '[libdefaults]' '^(\s*dns_canonicalize_hostname\s*=\s*).*' ' dns_canonicalize_hostname = true'
Comments