Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1757299 - 2.2.2 regression: SSH GSS authentication fails with "Ticket expired"
Summary: 2.2.2 regression: SSH GSS authentication fails with "Ticket expired"
Keywords:
Status: CLOSED DUPLICATE of bug 1757224
Alias: None
Product: Fedora
Classification: Fedora
Component: sssd
Version: 31
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Michal Zidek
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-10-01 06:50 UTC by Martin Pitt
Modified: 2019-10-01 16:51 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-10-01 13:38:00 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description Martin Pitt 2019-10-01 06:50:07 UTC 
Description of problem: A recent upgrade in Fedora 31 (noticed in [1]) broke IPA/kerberos authentication of ssh.

It complains about "Ticket expired" even though it's clearly not.

[1] https://github.com/cockpit-project/bots/pull/57


Version-Release number of selected component (if applicable):

sssd-krb5-2.2.2-1.fc31.x86_64
freeipa-client-4.8.1-1.fc31.x86_64
openssh-8.0p1-8.fc31.1.x86_64
krb5-libs-1.17-45.fc31.x86_64

How reproducible: Always


Steps to Reproduce:
1. Join machine to a FreeIPA server
2. Log in as FreeIPA user. This should get you a ticket:

$ klist
Ticket cache: KCM:420800000
Default principal: admin

Valid starting       Expires              Service principal
01.10.2019 02:38:20  02.10.2019 02:38:20  krbtgt/COCKPIT.LAN

3. Try to ssh into some machine of the domain. In my case, I'm just using the same machine with its public FreeIPA DNS name:

$ ssh -vv x0.cockpit.lan

Actual results:

ssh login through GSSAPI fails:

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
Ticket expired


debug1: Unspecified GSS failure.  Minor code may provide more information
Ticket expired


debug2: we did not send a packet, disable method
debug1: Next authentication method: publickey

Note that the ticket is not expired, see klist output (it's valid until tomorrow).



Expected results: ssh login succeeds through kerberos:

debug1: Next authentication method: gssapi-with-mic
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentication succeeded (gssapi-with-mic).
Authenticated to x0.cockpit.lan (via proxy).
debug1: channel 0: new [client-session]


Additional info:
Comment 1 Simo Sorce 2019-10-01 13:36:58 UTC 
Why did you file this against sssd?
Sounds like krb5 or ssh related.
Comment 2 Simo Sorce 2019-10-01 13:38:00 UTC 
Sounds like a duplicate of a ticket filed earlier, dupclosing

*** This bug has been marked as a duplicate of bug 1757224 ***
Comment 3 Sumit Bose 2019-10-01 16:51:38 UTC 
(In reply to Simo Sorce from comment #1)
> Why did you file this against sssd?
> Sounds like krb5 or ssh related.

Or maybe KCM? It might be good to check if there is the same issue with KEYRING.

bye,
Sumit
Note You need to log in before you can comment on or make changes to this bug.