Bug 801719

Upstream ticket:
https://fedorahosted.org/sssd/ticket/1245

Just a small clarification, this is a full output of ssh connection with hostname and host ip:


# ssh fbar.lab.bos.redhat.com
fbar.lab.bos.redhat.com's password: 
Last login: Fri Mar  9 09:19:11 2012 from vm-068.idm.lab.bos.redhat.com

# ssh fbar.78.138
Error looking up public keys
The authenticity of host '10.16.78.138 (<no hostip for proxy command>)' can't be established.
RSA key fingerprint is f4:f6:c8:45:23:7a:44:65:20:01:51:79:27:34:ad:33.
No matching host key fingerprint found in DNS.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.16.78.138' (RSA) to the list of known hosts.
fbar.78.138's password: 
Last login: Fri Mar  9 09:20:13 2012 from vm-068.idm.lab.bos.redhat.com

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause:
Reverse DNS lookup was not done to get the FQDN of a host specified by IP address.

Consequence:
SSH host public key lookup was incorrectly attempted with the textual IP address as FQDN.

Fix:
Do reverse DNS lookup to get the FQDN of the host before the SSH host public key lookup.

Result:
SSH host public key lookup is done correctly with FQDN of the host.

Deleted Technical Notes Contents.

Old Contents:
Cause:
Reverse DNS lookup was not done to get the FQDN of a host specified by IP address.

Consequence:
SSH host public key lookup was incorrectly attempted with the textual IP address as FQDN.

Fix:
Do reverse DNS lookup to get the FQDN of the host before the SSH host public key lookup.

Result:
SSH host public key lookup is done correctly with FQDN of the host.

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause:
Reverse DNS lookup was not done to get the FQDN of a host specified by IP
address.

Consequence:
SSH host public key lookup was incorrectly attempted with the textual IP
address as FQDN.

Fix:
Do reverse DNS lookup to get the FQDN of the host before the SSH host public
key lookup.

Result:
SSH host public key lookup is done correctly with FQDN of the host.

sssd-version:
============
[root@ipareplica ~]# rpm -q sssd
sssd-1.8.0-25.el6.x86_64
[root@ipareplica ~]#

Now i see error message "Error looking up public keys" when i do ssh to replica even with hostnames

[root@ipa63server ~]# ipa dnsrecord-show testrelm.com ipa63server
  Record name: ipa63server
  A record: 10.65.201.141
  SSHFP record: 2 1 56589F9B48400243165B37E43634E0F2DA4F4A8F, 1 1 798DCDB5A89F18007EF0ECEDF21FBD32F907178A
[root@ipa63server ~]# 

[root@ipa63server ~]# ipa dnsrecord-show testrelm.com ipareplica
  Record name: ipareplica
  A record: 10.65.201.159
  SSHFP record: 2 1 B1678B617E211E15F4D5473649BE8E796223E7F8, 1 1 87B8DDAD108C76E60553E6E8148F26F1423FE37B
[root@ipa63server ~]# 

[root@ipa63server ~]# ssh tuser1.com
Error looking up public keys
tuser1.com's password:

*** Bug 817406 has been marked as a duplicate of this bug. ***

*** Bug 813884 has been marked as a duplicate of this bug. ***

xdong verifying

ipa version:

ipa-server-3.0.0-8.el6.x86_64

how to verify:
1. Install ipa-server with dns
2. Install ipa-server replica
3. [root@qe-blade-06 ~]# ipa dnsrecord-find testrelm.com cloud-qe-15
  Record name: @
  NS record: qe-blade-06.testrelm.com., cloud-qe-15.testrelm.com.

...

  Record name: cloud-qe-15
  A record: 10.16.96.100
  SSHFP record: 1 1 CE10E5106B57DE6BB932A9ADA87506BF802D39C4, 2 1
                327D54350858DA03F927009E97A394B81022EA49
-----------------------------
Number of entries returned 10


4. [root@qe-blade-06 ~]# ssh cloud-qe-15.testrelm.com

[root@cloud-qe-15 ~]# 

5. [root@qe-blade-06 ~]# ssh 10.16.96.100

[root@cloud-qe-15 ~]# 
  
no error "looking up public keys " showed up while ssh to replica using IP address

verified

I'm seeing the same "Error looking up public keys" issues when sshing from a rhel 6.3 host which has been configured with "ipa-client-install --mkhomedir --configure-ssh --configure-sshd" to a rhel 5 host which doesn't support the ssh configuration and hence when configuring a RHEL-5 ipa client it doesn't register the ssh keys in DNS as part of the ipa client configuration process.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0508.html