Hallo:

I use CentOS 5.5 joined to Active Directory Win2003 (ADS).

I use ADS to authenticate users.

Works fine:
- Share folders.
- ssh with user/pass from ADS.

But have a problem with SSO.

When a user of ADS starts a session, a kerberos ticket is created. So he can use that ticket to start sessions on another computer with that username.

As I've added system to ADS, only direct name/IP has been added.

If I've started a session with a user of ADS called userda1 then I can start a new session with:

ssh server.domain

The problem is that this works if I do a new connection with current host, but not to another computer.

What I've checked is that it's due to a problem of DNS.

If I add the IP of target host to /etc/hosts, then it works fine. else, it doesn't work.

Another option is to register reverse IP in DNS, but that can give me problems with another services (due to I use the IP with different names).

Can any tell me how can I say to ssh client not to check reverse IP.

Tried modifying /etc/ssh_config with:
CheckHostIP no

But still I receive a message with:

Next authentication method: gssapi-with-mic
debug3: Trying to reverse map address 10.18.127.134.
debug1: Unspecified GSS failure. Minor code may provide more information
Server not found in Kerberos database

and I'm asked for user/pass.


Thanks

Hi Felipe,

What are the DNS settings on your CentOS 5.5 server?
My suggestion would be to have it points to the same DNS server as the one used by the Windows machines in the Windows 2000 AD.
Post back the content of

/etc/resolv.conf:
search your_windows_2000_domain
nameserver the_ip_address_of_your_windows_2000_domain_first_dns_server
nameserver the_ip_address_of_your_windows_2000_domain_second_dns_server

Regards,

Tshimanga.

As I've told you, mi resolv.conf has as dns servers the domain controllers of Active Directory (ADS).
It works fine and it solves direct and reverse ip/name of computers.
But for Kerberos purposes, I have to add the reverse IP of my computer to DNS of ADS. Windows computers are added to ADS only with name/IP, not reverse, and kerberos works fine.
In Linux servers I've to add direct/reverse IP to DNS to work kerberos. So I suppose I'm doing something wrong and I suppose that will be a way to do kerberos work without adding reverse IP to DNS.
As my servers have more names (depending of the services it serves), some of them can give me problems if I add reverse IP, as some of them check direct and reverse and will see they are not the same. So won't work.
Not sure if I've explained it well, but the only I look for is to "do kerberos work without adding reverse IP to DNS".

Any suggestion?

Thanks