Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: When trying to ssh from client to server "The authenticity of host 'f19.skynet.com (<no hostip for proxy command>)' can't be established." message appears. According test case: https://fedoraproject.org/wiki/QA:Testcase_FreeIPA_realmd_ssh this message shouldn't appear. Version-Release number of selected component (if applicable): realmd-0.13.3-2.fc19.x86_64 Steps to Reproduce: Follow TC mentined above. Additional info: When I'm trying to login from server to client no such message appear. I *think* this is caused by fact that dns entry for client contains it's fingerprint and there no such entries for server (f19.skynet.com is server, client.skynet.com is client: # dig +short f19.skynet.com SSHFP # dig +short client.skynet.com SSHFP 1 2 2CBA4EC2AE01ABF71EBB25B0EE47A3B2E0F117779C4C905DDCD4D7A1 FD56111F 1 1 D0B62584C00E6196F0ABD49B8E4C064A8E3748A7 2 2 023CD7E56786856567CC627F91F7C8E3A12A85B948161B9BA7F934AD C568EE65 2 1 BFF6CD508443FA7581745C77CE13AD5958E106EA
This looks like a duplicate to Bug 953617 (upstream ticket https://fedorahosted.org/freeipa/ticket/3571). Jan, can you confirm that?
This is not a duplicate of 953617. Branislav, could you please post the output of command "ipa host-show f19.skynet.com" on the server and /var/log/ipaclient-install.log from the server? (FYI this is not related to DNS, the host keys are fetched from IPA LDAP server by SSSD.)
Created attachment 738999 [details] ipaclient install log
Output from host-show command: # ipa host-show f19.skynet.com Host name: f19.skynet.com Principal name: host/f19.skynet.com Password: False Keytab: True Managed by: f19.skynet.com SSH public key fingerprint: F6:DE:68:B4:CB:1E:D8:C0:47:77:B7:6E:7B:3B:A3:F3 (ssh-rsa), 50:1B:4A:AB:25:0B:8E:FF:92:56:CA:FF:B9:E1:1D:DF (ssh-dss) #
Thanks. Could you please also add output of command "sss_ssh_knownhostsproxy --debug 10 f19.skynet.com" on the client (exit with Ctrl+C once you get "SSH-2.0-..." line in the output) and /etc/ssh/ssh_config from the client?
Here you are: [test@client ~]$ sss_ssh_knownhostsproxy --debug 10 f19.skynet.com (Tue Apr 23 16:31:55:345832 2013) [sss_ssh_knownhostsproxy] [main] (0x0040): sss_ssh_get_ent() failed (2): No such file or directory SSH-2.0-OpenSSH_6.1 [root@client /]# grep -v ^# /etc/ssh/ssh_config GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts PubkeyAuthentication yes ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h Host * GSSAPIAuthentication yes ForwardX11Trusted yes SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE SendEnv XMODIFIERS [root@client /]#
OK. Now can you please try restarting sssd and running sss_ssh_knownhostsproxy again?
[root@client /]# systemctl restart sssd.service [root@client /]# [root@client /]# sss_ssh_knownhostsproxy --debug 10 f19.skynet.com (Tue Apr 23 16:38:57:907672 2013) [sss_ssh_knownhostsproxy] [main] (0x0040): sss_ssh_get_ent() failed (2): No such file or directory SSH-2.0-OpenSSH_6.1
Can you please post /etc/sssd/sssd.conf and /var/log/ipaclient-install.log from the client? That will be all I hope.
Yep, no problem: # cat /etc/sssd/sssd.conf [domain/skynet.com] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = skynet.com id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = client.skynet.com chpass_provider = ipa ipa_dyndns_update = True ipa_server = _srv_, f19.skynet.com ldap_tls_cacert = /etc/ipa/ca.crt full_name_format = %1$s@%2$s re_expression = (?P<name>[^@]+)@(?P<domain>.+$) use_fully_qualified_names = True fallback_homedir = /home/%d/%u simple_allow_users = peter3, radek [sssd] services = nss, pam, ssh config_file_version = 2 domains = skynet.com [nss] default_shell = /bin/bash [pam] [sudo] [autofs] [ssh] [pac] [root@client /]#
Created attachment 739047 [details] ipaclient install log from client machine
We had an offline discussion with Branislav and it turns out this is actually a SSSD bug. Changing the component to sssd.
Upstream ticket: https://fedorahosted.org/sssd/ticket/1897
sssd-1.10.0-4.fc19.beta1 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/sssd-1.10.0-4.fc19.beta1
Package sssd-1.10.0-4.fc19.beta1: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing sssd-1.10.0-4.fc19.beta1' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-7584/sssd-1.10.0-4.fc19.beta1 then log in and leave karma (feedback).
sssd-1.10.0-4.fc19.beta1 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.