System Preparation

Installing the Kerberos GSSAPI client and server utility

RedHat, CentOS or Scientific Linux

On RedHat, CentOS or Scientific Linux, install the Kerberos GSSAPI utilities by running the following command (as root):

Debian or Ubuntu

On Debian or Ubuntu, install the Kerberos GSSAPI utilities by running the following command (as root):

Troubleshooting

To troubleshoot a GSSAPI connection, you require two separate terminals.

Terminal 1 - As root

1. In the first terminal, as root, run the following command:

2. You should now have the following output with no prompt:

Terminal 2 - As your test user

In an X environment

When you launch a terminal from X, e.g. a Gnome or KDE desktop session, the behaviour is different to a pure text environment. This is also the case when you use SSH to connect to a remote server and use display forwarding.

1. In a second terminal, as your test user, run the following command:

   powershell

2. You should now be prompted to select an identity in the . Choose one that will authenticate locally.

In a non-X environment

In a pure command-line environment with no display forwarding available, the Moonshot Identity Selector is not available. Instead, you use the .gss_eap_id file to test your environment.

1. In the second terminal, as your test user, create the .gss_eap_id file in your home directory with the following content:

   File naming

   Double-check the file name you use. Incorrect naming of the file is a common mistake. The file name is .gss_eap_id

2. Then run the following command:

   powershell

GSS Output

After selecting your identity, you should now see output in both terminals.

Successful output

1. In Terminal 1 (as root), the output should scroll rapidly with a lot of hex text before ending with something similar to the following:

2. In Terminal 2 (as your test user), the output looks similar to the below (in this example, the hostname is debian7x64.localdomain):

Failed output

If the GSSAPI connection failed, you may see one or more errors in either window.

1. In Terminal 1, you should see one or more messages similar to the below:

2. In Terminal 2, you should see one or more error messages similar to the below:

Possible solutions

If your GSS connection failed, you will need to diagnose why the error occurred.

The .gss_eap_id file

A common mistake involves the naming of the .gss_eap_id file.

A simple list command as your test user will allow you to check for it:

If you get a "No such file or directory" error message, double-check that the file exists in the home directory of the user you are running the gss-client command as.

Directory permissions

Your users need to have access to the /etc/gss directory and its contents. Check that the permissions allow your test user to list and read the contents: