Kees Bakker via FreeIPA-users wrote: > Hey, > > After installing a PC with Ubuntu 18.04 I'm seeing this problem with > SSH logins. The gssapi-with-mic authentication method does not > work anymore. Strangely enough a system that I upgraded (16.04->18.04) > was working fine. > > The debug of sshd shows (fivel being the unqualified hostname): > > debug1: Unspecified GSS failure.  Minor code may provide more information > No key table entry found matching host/fivel@ > > After debugging and looking at differences between the installed and upgraded system > I found that the new Ubuntu 18.04 installation has a slightly different krb5 configuration. > These are: > > ---------8X---------8X---------8X---------8X--------- > [libdefaults] > ... >    dns_canonicalize_hostname = false > ... > [domain_realm] > ... >   fqdn = <kerberos realm> > ---------8X---------8X---------8X---------8X--------- > > > Now the workaround for the login problem is to comment out dns_canonicalize_hostname. > > Can anyone comment on this? Why was this changed? Why doesn't it work out of the box? > This has been the setting since IPA v4.5.

IPA generally requires that the hostname of the system be fully-qualified. Is that the case on the working and non-working systems?