Troubleshooting local GSSAPI connections is fairly straight-forward. This page will cover both major Linux distribution sets.
Installing the Kerberos GSSAPI client and server utility
RedHat, CentOS or Scientific Linux
On RedHat, CentOS or Scientific Linux, install the Kerberos GSSAPI utilities by running the following command (as root):
Debian or Ubuntu
On Debian or Ubuntu, install the Kerberos GSSAPI utilities by running the following command (as root):
To troubleshoot a GSSAPI connection, you require two separate terminal sessions and a RadSec connection to your local Moonshot RP Proxy.
On a Moonshot client
Moonshot clients do not need to define a RadSec connection (because the service you connect to defines this connection), if you however are trying to troubleshoot the local GSS system, you will need to define this connection to temporarily turn your Moonshot client into a server.
To do this, you need three files from your Moonshot RP Proxy's FreeRADIUS directory:
Store the files in a directory that an ordinary user can read, and check that the files are also readable by an ordinary user. You may wish to rename them to be clearly identifiable.
Also create a
Make sure that the file is also readable by an ordinary user.
On a Moonshot server
As part of configuring your server to connect to an RP Proxy, you will have defined the RadSec connection configuration.
Check the permissions of the four files needed for a RadSec connections:
Also check the validity of the certificates used for the connection:
Terminal 1 - As root
Terminal 2 - As your test user
In an X environment
When you launch a terminal from X, e.g. a Gnome or KDE desktop session, the behaviour is different to a pure text environment. This is also the case when you use SSH to connect to a remote server and use display forwarding.
In a non-X environment
In a pure command-line environment with no display forwarding available, the Moonshot Identity Selector is not available. Instead, you use the
After selecting your identity, you should now see output in both terminals.
If the GSSAPI connection failed, you may see one or more errors in either window.
If your GSS connection failed, you will need to diagnose why the error occurred.
$ ls -la ~/.gss_eap_id
If you get a
"No such file or directory" error message, double-check that the file exists in the home directory of the user you are running the
gss-client command as.
GSS directory permissions
Standard users need to have access to the
/etc/gss directory and its contents. Check that the permissions allow your test user to list and read the contents:
# ls -laR /etc/gss /etc/gss: total 20 drwxr-xr-x. 2 root root 4096 Jan 20 11:38 . drwxr-xr-x. 117 root root 12288 May 26 11:22 .. -rw-r--r--. 1 root root 90 Jan 20 11:38 mech
$ ls -laR /etc/gss /etc/gss: total 0 drwxr-xr-x 3 root root 29 Jan 20 11:38 . drwxr-sr-x 128 root root 580 May 26 11:22 .. -rw-r--r-- 2 root root 39 Jan 20 11:38 mech.d /etc/gss/mech.d: total 1 drwxr-xr-x 2 root root 39 Jan 20 11:38 . drwxr-sr-x 3 root root 29 May 26 11:22 .. -rw-r--r-- 1 root root 258 Jan 20 11:38 moonshot-gss-eap
GSS relies on hostnames being correct. Running the
hostname and then the
hostname -f commands should return the same result:
$ hostname debian.localdomain $ hostname -f debian.localdomain
If the results are different, you must configure your machine correctly to return the same result.
Either define the name correctly in DNS, or configure the
/etc/sysconfig/network files correctly, or install
dnsmasq or a similar utility that will use the
/etc/hosts file to correctly resolve your hostname.
Check that there is no firewall preventing the connection. Often a basic firewall like
iptables is installed on the local machine. Check whether you can connect to the Moonshot RP Proxy by trying to connect to port 2083 on the Moonshot RP Proxy over TCP. A
"Connection refused" message or a connection timeout is usually a tell-tale sign that something is preventing your connection between your local machine and your Moonshot RP Proxy.
Still under construction