I cant login to my root and any other account which im not owner with kerberos and ~/.k5login (ksu is working). Here is presentation of problem:
root@gwhost:~# ssh user@freeipa01
user@freeipa01's password:
Last login: Tue Sep 8 15:46:20 2015 from 172.16.0.31
-bash-4.2$ klist
Ticket cache: KEYRING:persistent:1570800003:krb_ccache_HGjE46r
Default principal: user@DOMAIN.LOCAL
Valid starting Expires Service principal
09/08/2015 17:12:09 09/09/2015 17:12:08 krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL
-bash-4.2$ ssh freeipa02
Last login: Tue Sep 8 09:34:04 2015 from freeipa02.domain.local
-bash-4.2$ ksu
Authenticated user@DOMAIN.LOCAL
Account root: authorization for user@DOMAIN.LOCAL successful
[Last failed login: Tue Sep 8 06:25:15 PDT 2015 from freeipa01.domain.local on ssh:notty]
[There was 1 failed login attempt since the last successful login.]
Changing uid to root (0)
[root@freeipa02 user]# cat /root/.k5login
user@DOMAIN.LOCAL
[root@freeipa02 user]# exit
-bash-4.2$ logout
Connection to freeipa02 closed.
-bash-4.2$ ssh root@freeipa02
root@freeipa02's password:
Permission denied, please try again.
root@freeipa02's password:
-bash-4.2$
- Login to first kerberized server and receive krb ticket.
- Login to second kerberized server with ticket (no password) and use ksu and .k5login file to login as root (no password required) - everything succeed.
- Get back to first server and trying to login directly as root (with krb ticket and root .k5login file) - fail (is asking for root password).
What could be reason of such behavior? What could i check/change to fix it?