Ubuntu SSH passwordless login using kerberos

Question

This is driving me batty. I'm trying to setup an AD integrated Ubuntu 16.04 server to accept Kerberos tickets when logging in via SSH. I have a CentOS 7 server that accepts tickets without a problem after being joined to the AD domain, but I haven't gotten the config quite right on the Ubuntu server.

Here's the setup:

• Windows 2012 AD Domain (realdomain.tld)
• Fedora 25 Workstation (wksf25.realdomain.tld)
• CentOS 7 Server (sc7.realdomain.tld)
• Ubuntu 16.04 Server (su16.realdomain.tld)

Everything was joined to AD via realm, and that works without problems. Everything also gets Kerberos tickets on login or via kinit just fine. SSHing from wksf25 to sc7 works just fine, and I'm able to login via SSH using the kerberos ticket I obtain on login to wkfs25.

Here is the setup steps for Ubuntu:

1. Install the packages:

   apt install realmd oddjob oddjob-mkhomedir sssd sssd-tools adcli samba-common krb5-user chrony packagekit libpam-krb5
   

2. Edit chrony.conf to use the AD DCs.

3. Setup realmd.conf: vim /etc/realmd.conf

   [users]
   default-home = /home/%D/%U
   
   [realdomain.tld]
   fully-qualified-names = no
   manage-system = no
   automatic-id-mapping = yes
   

4. Join the domain: realm join -vU domainuser realdomain.tld

5. Allow logins: realm permit -R realdomain.tld -g linuxadmins

6. Ubuntu specific - Setup pam to create homedir on login: `vim /etc/pam.d/common-session'

   session optional        pam_mkhomedir.so umask=0077
   

7. Ubuntu specific - Enable GSSAPI authentication in OpenSSH: vim /etc/ssh/sshd_config

   GSSAPIAuthentiction yes
   GSSAPICleanupCredentials no
   

8. Login with domain account and make sure everything is working. Everything works at this point minus passwordless SSH logins via Kerberos tickets on the Ubuntu server.

Here is what I get from realm list:

realdomain.tld
  type: kerberos
  realm-name: REALDOMAIN.TLD
  domain-name: realdomain.tld
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin
  login-formats: %U
  login-policy: allow-permitted-logins
  permitted-logins: 
  permitted-groups: linuxusers

sssd.conf:

[sssd]
domains = realdomain.tld
config_file_version = 2
services = nss, pam

[domain/realdomain.tld]
ad_domain = realdomain.tld
krb5_realm = REALDOAMIN.TLD
realmd_tags = joined-with-adcli 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%d/%u
access_provider = simple
simple_allow_groups = linuxusers

krb5.conf:

[libdefaults]
    dns_lookup_realm = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    rdns = false
    default_ccache_name = KEYRING:persistent:%{uid}

    default_realm = REALDOMAIN.TLD

[realms]
    REALDOMAIN.TLD = {
    }

[domain_realm]
    realdomain.org = REALDOMAIN.TLD
    .realdomain.org = REALDOMAIN.TLD

What am I missing?

Answer 1

Fixed. realm join -vU domainuser --membership-software=samba --client-software=sssd realdomain.tld to join the AD domain on Ubuntu rather then letting realm use the defaults.

There was one little difference in the SSSD configs that I didn't think was pertinent, but it turned out it was.

Ubuntu: realmd_tags = joined-with-adcli

CentOS: realmd_tags = joined-with-samba

To get a different perspective on the problem, I spun up an OpenSUSE VM and started researching how SUSE does their AD integration. While I was figuring out how SUSE does things, I ran across a post which suggests Samba should be used to join Windows Server 2012+ AD instead of adcli.1 Add that to the difference in the configs above, and that was a clue to what was going on.

Leaving the domain and rejoining with the updated realm command fixed the issue, and everything has been stable for the last day.

I don't have an exact root cause as to the differences between the two methods, but that's going to require more research and is a fight for another day.

Answer 2

We had a similar situation crop up coincident with adding an SSL certificate to support LDAPS (although I never reverted that change to determine if it was causal). I'm not sure if there's any reason to prefer adcli, but I found two options fixed realm join while still using adcli (on Ubuntu 14.04 and 16.04):

Solution 1 (Ubuntu 16.04 or 14.04)

Add two settings to our krb5.conf (neither alone helped):

[libdefaults]
    ...
    canonicalize = true
    rdns = false

Solution 2 (Ubuntu 14.04 only)

I subsequently stumbled upon this git issue that suggested another option that (alone) is also working for us on 14.04:

[libdefaults]
    ...
    dns_canonicalize_hostname = false

FWIW

We actually have full control over our DNS and were unable to find any issues in our existing records -- or any changes that eliminated the need for these.