Cfxtrjtrk

Env:- 16.04.4 LTS (Xenial Xerus)
4.13.0-36-generic

I'm following this article (https://wiki.ubuntu.com/Enterprise/Authentication/KerberosServices ) for setting up kerberised ssh. Tried with domain instead of IP, still no luck..

Also I want to enable these kerberised users needs have sudo access on the machine, so that every kerberised users will get admin prvileges. This can be achieved by adding entry in sudoers file.

For enabling kerberized ssh its not working.

Below is the client configuration.

    $grep -i  ad.ny /etc/krb5.conf 

    kdc = ad.test.edu

    admin_server = ad.test.edu

I'm able to get the kerberos ticket without any issues

$kinit test@AD.TEST.EDU

 Password for test@AD.TEST.EDU: 

Below is the ticket details

 $klist 

 Ticket cache: FILE:/tmp/krb5cc_1000

 Default principal: test@AD.TEST.EDU



   Valid starting       Expires              Service principal

   03/19/2019 16:36:05  03/20/2019 02:36:05  

 krbtgt/AD.TEST.EDU@AD.TEST.EDU

Below is the ssh configuration

 $ grep -v ^# /etc/ssh/sshd_config  | grep -v -e '^$'

  Port 22

  Protocol 2

  HostKey /etc/ssh/ssh_host_rsa_key

  HostKey /etc/ssh/ssh_host_dsa_key

  HostKey /etc/ssh/ssh_host_ecdsa_key

  HostKey /etc/ssh/ssh_host_ed25519_key

  UsePrivilegeSeparation yes

  KeyRegenerationInterval 3600

  ServerKeyBits 1024

  SyslogFacility AUTH

  LogLevel INFO

  LoginGraceTime 120

  PermitRootLogin prohibit-password

  StrictModes yes

  RSAAuthentication yes

  PubkeyAuthentication yes

  IgnoreRhosts yes

  RhostsRSAAuthentication no

  HostbasedAuthentication no

  PermitEmptyPasswords no

  ChallengeResponseAuthentication no

  X11Forwarding yes

  X11DisplayOffset 10

  PrintMotd no

  PrintLastLog yes

  TCPKeepAlive yes

  AcceptEnv LANG LC_*

  Subsystem sftp /usr/lib/openssh/sftp-server

  UsePAM yes

  KerberosAuthentication yes

  KerberosTicketCleanup yes

  GSSAPIAuthentication yes

  GSSAPICleanupCredentials yes

Below is the ssh verbose output

  $ssh -K -v test/AD.TEST.EDU@192.168.115.23

  << .snip>

    ..

   <snip>

  debug1: Authentications that can continue: publickey,gssapi- 

  keyex,gssapi-with-mic,password

  debug1: Trying private key: /Users/test/.ssh/id_dsa

  debug1: Trying private key: /Users/test/.ssh/id_ecdsa

  debug1: Trying private key: /Users/test/.ssh/id_ed25519

  debug1: Trying private key: /Users/test/.ssh/id_xmss

  debug1: Next authentication method: password

  test/AD.TEST.EDU@192.168.115.23's password: