[SOLVED] Freeipa + Kerberos + auks

rufa · 01-14-2019, 01:42 PM

Hello,

We are using freeipa and i'm trying to configure auks using kerberos but i'm getting an error when trying to start the service:

Code:

# systemctl restart aukspriv
# tail -f /var/log/messages
slurm aukspriv[18008]: unable to get ccache for username using ktfile /etc/auks/auks.keytab : kinit: Preauthentication failed while getting initial credentials

So i added this principal to the keytab:

Code:

#ktutil
ktutil:  add_entry -password -p username.domain_name@DOMAIN_NAME -k 1 -e aes256-cts
read_kt /etc/krb5.kseytab
list
ktutil: 
13    1            username.domain_name@DOMAIN_NAME

I don't understand why still having the error, can some help please ?

Thanks,

rufa · 01-16-2019, 11:40 AM

Problem solved by creating again the krb5.keytab:

- krb5.keytab contains:

Code:

host/hostname.realm.com@REALM.COM

- aukspriv should contain exactly the same principal as in the keytab:
host/hostname.realm.com@REALM.COM

- auks.conf should contain exactly the same principal as in the keytab:

Code:

host/hostname.realm.com@REALM.COM

- auksd.acl should contain exactly the same principal as in the keytab:

Code:

host/hostname.realm.com@REALM.COM

Note: The principal should have @ between the realm.com and REALM.COM and not /