I am getting this error which leads to logins being denied:
in krb5_child.log:
(2026-06-04 22:53:26): [krb5_child[836]] [validate_tgt] (0x0020): [RID#33] error reading keytab [/etc/krb5.keytab], not verifying TGT.
(2026-06-04 22:53:26): [krb5_child[836]] [debug_and_log] (0x0020): [RID#33] 2587: [13][Permission denied]
(2026-06-04 22:53:26): [krb5_child[836]] [debug_and_log] (0x0040): [RID#33] 2677: [13][Permission denied]
In systemd logs:
krb5_child[836]: Permission denied
getcap /usr/lib/sssd/sssd/krb5_child shows cap_dac_read_search,cap_setgid,cap_setuid=p.
ls -lha /usr/lib/sssd/sssd/krb5_child is -rwxr-x--- 1 root sssd 192K Apr 27 22:21 /usr/lib/sssd/sssd/krb5_child.
ls -lha /etc/krb5.keytab is -rw------- 1 root root 196 Jun 20 2024 /etc/krb5.keytab.
What is going on? I thought krb5_child had setuid to be able to read the keytab.
This is on Arch Linux, sssd version 2.13.0.
I am getting this error which leads to logins being denied:
in krb5_child.log:
In systemd logs:
getcap /usr/lib/sssd/sssd/krb5_childshowscap_dac_read_search,cap_setgid,cap_setuid=p.ls -lha /usr/lib/sssd/sssd/krb5_childis-rwxr-x--- 1 root sssd 192K Apr 27 22:21 /usr/lib/sssd/sssd/krb5_child.ls -lha /etc/krb5.keytabis-rw------- 1 root root 196 Jun 20 2024 /etc/krb5.keytab.What is going on? I thought krb5_child had setuid to be able to read the keytab.
This is on Arch Linux, sssd version 2.13.0.