Bug 955499

This looks like a duplicate to Bug 953617 (upstream ticket https://fedorahosted.org/freeipa/ticket/3571). Jan, can you confirm that?

This is not a duplicate of 953617.

Branislav, could you please post the output of command "ipa host-show f19.skynet.com" on the server and /var/log/ipaclient-install.log from the server? (FYI this is not related to DNS, the host keys are fetched from IPA LDAP server by SSSD.)

Created attachment 738999 [details]
ipaclient install log

Output from host-show command:

# ipa host-show f19.skynet.com
  Host name: f19.skynet.com
  Principal name: host/f19.skynet.com
  Password: False
  Keytab: True
  Managed by: f19.skynet.com
  SSH public key fingerprint: F6:DE:68:B4:CB:1E:D8:C0:47:77:B7:6E:7B:3B:A3:F3 (ssh-rsa),
                              50:1B:4A:AB:25:0B:8E:FF:92:56:CA:FF:B9:E1:1D:DF (ssh-dss)
#

Thanks. Could you please also add output of command "sss_ssh_knownhostsproxy --debug 10 f19.skynet.com" on the client (exit with Ctrl+C once you get "SSH-2.0-..." line in the output) and /etc/ssh/ssh_config from the client?

Here you are:

[test@client ~]$ sss_ssh_knownhostsproxy --debug 10 f19.skynet.com
(Tue Apr 23 16:31:55:345832 2013) [sss_ssh_knownhostsproxy] [main] (0x0040): sss_ssh_get_ent() failed (2): No such file or directory
SSH-2.0-OpenSSH_6.1

[root@client /]# grep -v ^# /etc/ssh/ssh_config 
GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
PubkeyAuthentication yes
ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h

Host *
	GSSAPIAuthentication yes
	ForwardX11Trusted yes
	SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES 
	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT 
	SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
	SendEnv XMODIFIERS
[root@client /]#

OK. Now can you please try restarting sssd and running sss_ssh_knownhostsproxy again?

[root@client /]# systemctl restart sssd.service
[root@client /]# 
[root@client /]# sss_ssh_knownhostsproxy --debug 10 f19.skynet.com
(Tue Apr 23 16:38:57:907672 2013) [sss_ssh_knownhostsproxy] [main] (0x0040): sss_ssh_get_ent() failed (2): No such file or directory
SSH-2.0-OpenSSH_6.1

Can you please post /etc/sssd/sssd.conf and /var/log/ipaclient-install.log from the client? That will be all I hope.

Yep, no problem:

# cat /etc/sssd/sssd.conf
[domain/skynet.com]

cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = skynet.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = client.skynet.com
chpass_provider = ipa
ipa_dyndns_update = True
ipa_server = _srv_, f19.skynet.com
ldap_tls_cacert = /etc/ipa/ca.crt
full_name_format = %1$s@%2$s
re_expression = (?P<name>[^@]+)@(?P<domain>.+$)
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
simple_allow_users = peter3, radek
[sssd]
services = nss, pam, ssh
config_file_version = 2

domains = skynet.com
[nss]
default_shell = /bin/bash

[pam]

[sudo]

[autofs]

[ssh]

[pac]

[root@client /]#

Created attachment 739047 [details]
ipaclient install log from client machine

We had an offline discussion with Branislav and it turns out this is actually a SSSD bug.

Changing the component to sssd.

Upstream ticket:
https://fedorahosted.org/sssd/ticket/1897

sssd-1.10.0-4.fc19.beta1 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/sssd-1.10.0-4.fc19.beta1

Package sssd-1.10.0-4.fc19.beta1:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing sssd-1.10.0-4.fc19.beta1'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-7584/sssd-1.10.0-4.fc19.beta1
then log in and leave karma (feedback).

sssd-1.10.0-4.fc19.beta1 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.