# service slapd start failed the first time with the error error: grep: /usr/local/etc/openldap/slapd.d/cn=config/olcDatabase=*: No such file or directory. Another stupid compound typo… when I created the folder /usr/local/etc/openldap/slapd.d/, I mis-named it slap.d/. Not only that, but my slapadd command to parse the ldif file into the database folder had the same typo, so it worked (the folder existed). Of course, rc went looking for the correct folder name and couldn’t find it… c_rehash . has been depricated and removed from the openssl package. The correct command to use is openssl rehash .olcTLSCACertificateFile: attibute in slapd.ldif. Seems to work fine… both CAs have their certs in /usr/share/certs/trusted/, and I made sure those were recognized by the system using certctl rehash.slapd_flags needs to also have an entry ldaps://0.0.0.0/. If that’s not there, rc won’t launch the service with TLS enabled and there’s no possiblity of getting it to work. This was the last piece I needed to get secure TLS communication working. ldapadd -Y EXTERNAL -H ldapi:/// -f 01.config.InstallMemberOf.ldif it failed with an insufficient access error. This one took me a bit to figure out, and I learned something along the way (bonus!). My first slapd.ldif was based on the example provided with the FreeBSD openldap26-server pkg install. That example does not allow this command to run out of the box.olcAccess: to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break. Applying this to both the frontend and config database sections solved the issue. Given that the Ubuntu template seems a little more modern and full-featured than the one that FreeBSD ships, I switched my entire template over to the Ubuntu version and customized from there. kadmind: LDAP bind dn value missing while initializing, aborting.
# pkg install openldap26-client cyrus-sasl-gssapi krb5 pam_ldap sssd2 sudo-sssd# certctl rehashsssd_enable="YES" to /etc/rc.confcreate_homedir=False in /usr/local/etc/sssd/sssd.conf. I did this because I didn't have time to play around with the pam_zfs_key.so module that supports creation of encrypted /home/$user datasets on first login. Given the extremely low number of people using my systems (4 total, and 2 of those almost never), I'm fine with manually setting up home datasets for family before they can log on to a host. There really won't be that many hosts that allow local logon... if the situation ever changes I'll dig in and look at enabling automatic home folder / dataset creation, but for now I'll skip that potential headache.
create_homedir = True in sssd.conf for this client.sudoers: files sss
# ls with flags that show ownership, I never looked hard enough to notice that the results were returning without any GID to name translation, e.g. -rw-r--r-- 1 firstuser 10002 208 Mar 16 20:10 somefile. -rw-r--r-- 1 firstuser firstuser 208 Mar 16 20:10 somefile.mech_list: GSSAPI PLAINas the first line of /usr/local/lib/sasl2/slapd.conf. This was too restrictive, in that it disallows the system root user to LDAP admin translation we took advantage of during setup.# ldapadd -y EXTERNAL -H ldapi:/// -f domainHost.ldif# kadmin.local > addprinc -x dn=cn=laptop1,ou=hosts,dc=mydomain,dc=com -randkey host/laptop1.mydomain.com (the -x flag tells kadmin to attach the new principal to the specified LDAP entry, instead of just placing it in the default kerberos subtree of dc=mydomain,dc=com) > ktadd -k /root/laptop1.keytab host/laptop1.mydomain.com > exit# kinit -k -t /etc/krb5.keytab host/laptop1.mydomain.com.
mech_list: GSSAPI PLAIN EXTERNAL. # slappasswd -o module-load=pw-sha2 -h '{SSHA512}' -s 'your-password-here'# ldapadd -x -D 'cn=admin,dc=mydomain,dc=com' -W -H ldapi:/// -f replicator.ldifdn: uid=replicator,ou=accounts,dc=mydomain,dc=com
objectClass: domainAccount
objectClass: simpleSecurityObject
cn: replicator
name: replicator
sn: replicator
uid: replicator
userPassword: {SSHA512}++Redacted==
description: Replication user# ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f acl_update.ldifdn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by dn="cn=admin,dc=mydomain,dc=com" manage by dn="uid=firstuser,ou=accounts,dc=mydomain,dc=com" manage by dn="uid=replicator,ou=accounts,dc=mydomain,dc=com" read by dn="uid=ldapbinduser,ou=accounts,dc=mydomain,dc=com" read by dn="uid=kdc-service,ou=accounts,dc=mydomain,dc=com" read by dn="uid=kadmin-service,ou=accounts,dc=mydomain,dc=com" write by * break
olcAccess: {1}to dn.children="ou=accounts,dc=mydomain,dc=com" attrs=userPassword,shadowExpire,shadowInactive,shadowLastChange,shadowMax,shadowMin,shadowWarning by self write by anonymous auth
olcAccess: {2}to dn.subtree="dc=mydomain,dc=com" by self read
olcAccess: {3}to attrs=krbPrincipalKey by anonymous auth by dn.exact="cn=kdc-service,ou=accounts,dc=mydomain,dc=com" read by dn.exact="cn=kadmin-service,ou=accounts,dc=mydomain,dc=com" write by self write by * none
olcAccess: {4}to dn.subtree="cn=krbContainer,dc=mydomain,dc=com" by dn.exact="cn=kdc-service,ou=accounts,dc=mydomain,dc=com" read by dn.exact="cn=kadmin-service,ou=accounts,dc=mydomain,dc=com" write by * none# ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f provider_simple_sync.ldif# Add indexes to the frontend db
dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: entryCSN eq
-
add: olcDbIndex
olcDbIndex: entryUUID eq
# Load the syncprov module
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: syncprov
# syncrepl Provider for primary db
dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
olcSpCheckpoint: 100 10
olcSpSessionLog: 100olcMemberOfDangling: ignore on the master LDAP instance. Create fix_memberOf.ldif and apply with# ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f fix_memberOf.ldifdn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcMemberOfDangling
olcMemberOfDangling: ignoreolcSaslHost in step 17 to use the FQDN of the backup LDAP jail.# ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f consumer_simple_repl.ldifdn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: syncprov
dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: entryUUID eq
-
add: olcSyncrepl
olcSyncrepl: rid=0
provider=ldap://ldapjail.mydomain.com
bindmethod=simple
binddn=uid=replicator,ou=accounts,dc=mydomain,dc=com credentials=<actual password here (not the hash)>
searchbase=dc=mydomain,dc=com
schemachecking=on
type=refreshAndPersist retry=”60 10 300 +”
starttls=critical tls_reqcert=demand
-
add: olcUpdateRef
olcUpdateRef: ldap://ldapjail.mydomain.comcontextCSN on both the primary and secondary LDAP jails: # ldapsearch -Y EXTERNAL -H ldapi:/// -b "dc=mydomain,dc=com" -s base contextCSN. Once both numbers are the same you know that replication has completed and you have a full copy on your secondary LDAP jail. Try querying the secondary from a client machine - it should give you good results, now.kdc = ldapjail.mydomain.com and kdc = ldapjail2.mydomain.com in the MYDOMAIN.COM section of the [realms] heading. ldapjail2 should be first so that the local Kerberos queries the local LDAP.mech_list: GSSAPI PLAIN EXTERNAL as the first line of /usr/local/lib/sasl2/slapd.confkadmind_enable="NO"# kadmin.local > addprinc -randkey host/ldapjail2.mydomain.com > addprinc -randkey ldap/ldapjail2.mydomain.com > ktadd -k /root/ldapjail2.keytab host/ldapjail2.mydomain.com ldap/ldapjail2.mydomain.com > exitroot:ldap.# service slapd restart# service kdc start# service saslauthd start# kinit -k -t /etc/krb5.keytab host/ldapjail2.mydomain.comkdc = in the [realms] MYDOMAIN = { section... one for ldapjail.mydomain.com and one for ldapjail2.mydomain.com.ldap_uri and krb5_server lines to include the secondary. These are comma separated entries, so just append ,ldapjail2.mydomain.com.
-o special_small_blocks=XXXX flag. The docs say this should set special_small_blocks to 0, which means these datasets will only store metadata on the special vdev. Perfect. When I copied over the files from my backup media to these new datasets, I monitored the progress using # zpool iostat -v tank 5, which let me watch as the data was written to the raidz3 at approximately the read speed I'd expect from the external USB HDD that was temporarily holding it. 250MB/s, or thereabouts.-o special_small_blocks=131072 when setting up these datasets. 128kB seemed like a reasonable break point, given the size distribution of my files. When I copied the files over from deep storage to the new datasets, however, I didn't see what I expected. # zpool iostat -v tank 5 showed that nearly all of my files were going to the special vdev. Once or twice I'd see a single write IOP on the raidz3 vdev, but not nearly the number I'd expect. I also expected to see the counter showing allocated storage on both vdevs tick up, but it only ticked up on the special vdev.
mountd[26963]: Warning: exporting /Videos exports entire [restricted] file systemjailed=on for each dataset that belonged to the NFS jail, and then updated /etc/jail.conf to execute the zfs jail ... and zfs unjail ... commands when the jail starts and stops.zfs_enable="YES" to make sure that it'll re-mount the datasets the next time it starts. jexec and don't even bother having SSH enabled on any of them. id firstuser and have it spit back results pulled from the directory, I established my NFS shares. V4 only, and sec=krb5is the only allowed security method.nfs/ principals in their keychains. I'm a little vague about why, but it's something to do with getting shares mounted without a local user logging in - both ends of the connection want to verify the other end against the ticketing service, so both need nfs/ principals to decrypt the tickets that get issued. Or maybe I'm hallucinating and that's all a load of h*&#e^!it... what's true is that creating an nfs/ principal for the client and adding it to the client keychain allowed me to get shares mounted (the NFS jail already had host/ and nfs/ principals in its keychain).
I've gotten a lot of life out of my Supermicro boards - I do like the ones I've owned. If I fall backwards into a pile of cash I'll upgrade my secondary server box with a Supermicro board that supports SR-IOV, just so I can standardize on the networking config for jails across my two boxes.
The TurboTax bulls*** this year caught me by surprise - luckily my employer found a way to get all of us access to the web version of TurboTax Deluxe for free as part of the legal plan they subscribe to. It was my first try with the web version - I've always bought the software from Costco in the past - and I have to say the web version seemed to be just fine. No need to run M$ software at all - I did my taxes with TurboTax using Firerfox on my Linux laptop.
How do you produce that graph?
May 2 15:18:01 machinename kernel: ixl1: Malicious Driver Detection event 1 on RX queue 38, pf number 1 (PF-0), (VF-1)
vm switch create public and vm switch add public ixl1 instead, and configured the vm-bhyve configuration for the guest to use virtio-net networking, and all is good! Now if I ever need to boot Windows (super rare instances like updating the Arc GPU firmware) I can do it without having to jump through hoops trying to get new files onto the VM. Updating GPU firmware now, then I'll shut down this Win10 VM and move on with jellyfin setup
--- b/sys/amd64/vmm/io/iommu.c
+++ b/sys/amd64/vmm/io/iommu.c
@@ -175,7 +175,7 @@
static void
iommu_init(void)
{
- int error, bus, slot, func;
+ int error, bus, slot, func, funcmax;
vm_paddr_t maxaddr;
devclass_t dc;
device_t dev;
@@ -221,7 +221,8 @@
dc = devclass_find("ppt");
for (bus = 0; bus <= PCI_BUSMAX; bus++) {
for (slot = 0; slot <= PCI_SLOTMAX; slot++) {
- for (func = 0; func <= PCI_FUNCMAX; func++) {
+ funcmax = (slot == 0) ? PCIE_ARI_FUNCMAX : PCI_FUNCMAX;
+ for (func = 0; func <= funcmax; func++) {
dev = pci_find_dbsf(0, bus, slot, func);
if (dev == NULL)
continue; make and make install ran cleanly. bhyve: gvt_d_setup_gsm: Unable to add Graphics Stolen Memory to E820 table (hpa 0x0 len 0x0).--- b/usr.sbin/bhyve/amd64/pci_gvt-d.c
+++ b/usr.sbin/bhyve/amd64/pci_gvt-d.c
@@ -224,6 +224,9 @@
if (class != PCIC_DISPLAY)
return (ENXIO);
+ if (get_igd_ops(pi) == NULL)
+ return (ENXIO);
+
return (0);
} sec:krb5. Service account "jellyfin-svc" created in the directory so the VM can access the shares it needs. passthrough : true; for one of the VFs in my iovctl.conf file and handed the ppt device that results directly to the VM. That works like a charm, and Debian thinks it has an Intel NIC all to itself. I also created a bridge interface on the host and gave epairs to both my NFS jail and the Debian VM. This also works, and since nothing actually touches physical network hardware it's as fast as the CPU on the host can run the virtual network stack. Access to jellyfin for admin and clients goes through the physical interface, and jellyfin gets its content via NFS over the private bridge (read only mount). -sec=krb5. Totally overkill, since the private bridge never sees an outside network, but I wanted to stay consistent with how shares are exposed via NFS.
vnet.interface+="epair5b"; below the existing vnet.interface=... line. set skip=epair5b in a jail's pf.conf to leave the private interface wide open while I brought things up and verified it was working. I'll get this buttoned down... soon...host/ or nfs/ principals to go with separately-named internal IP addresses, nor do I have to issue new certificates for differently-named interface-specific hostnames. One single hostname per jail, VM, or host, one certificate, one set of NFS principals. Now I have an internal and external view for my domain - queries for e.g. ns1.mydomain.com originating from an IP address covered by the internal view give the private IP address for the host, while queries coming from IP addresses NOT in the internal view default to using the external view and my name servers dish out the already-established IP address I've been using all along. All my clients, guest devices, etc on various previously-established subnets are served by the external view, while the jails and VMs use the internal view and therefore send their inter-jail communication over the private VLAN. [myuser@myclient ~]$ ssh jail1 klist -f showed I had a valid ticket and that it had the F flag to make it forwardable, so the problem wasn't on the client side. To test whether the jail was receiving the ticket, I logged into the jail using my LDAP user account with password authentication and ran the following:$ echo "cachename=$KRB5CCNAME"
cachename=$ ls -l /tmp/krb5cc*
ls: /tmp/krb5cc*: No such file or directory# ls -ld /tmp
drwxr-xr-t 6 root wheel 6 Oct 10 21:02 /tmp That's mode 1755. drwxrwxrwt 6 root wheel 6 Oct 10 21:02 /tmp Apparently /tmp should be mode 1777. /var/tmp/, which based on my host machine should also be mode 1777. I went ahead and changed the permissions on both folders to 1777 and tried SSO login again. It worked! [myuser@myclient ~] $ ssh jail1
[myuser@jail1 ~] $ exit
[myuser@myclient ~] $ su - after logging into the jail via SSO, and I saw this: [myuser@jail1 ~] $ su -
su: not running setuid freebsd-update IDS looks like the perfect tool. Here's what I ran, as root on the jailhost:# freebsd-update -j jail1 -d "/path/to/jail/var/db/freebsd-update" IDS > /tmp/jail1-ids.txt /etc/ since those are probably mine (and therefore intentional):# grep -v '/etc/' /tmp/jail1-ids.txt | less <-- gave me a detailed listing of all the differences# grep -v '/etc/' /tmp/jail1-ids.txt | wc -l <-- total count zfs send | zfs receive to copy the snapshot over to an entirely new and independent dataset. The 5 bad jails were created by cloning the template and then trying to promote each clone. I do recall a fight trying to get the promoted clones disentangled from the template, and that's where I'd point the finger. Whatever I did during the fight (I honestly don't recall) to get the jails to lose their inheritance relationship with the template, I'd bet it was wrong and led to this. J=<jail>; G=$(jls -j $J path)
service jail stop $J
zfs snapshot <jail dataset>@pre-rebase
cd /path/to/15.1-RELEASE/media/
tar -xpf base.txz -C "$G" --exclude ./etc --exclude ./var --exclude ./root
tar -xpf lib32.txz -C "$G"
mtree -deU -f /etc/mtree/BSD.var.dist -p "$G/var"
chmod 1777 "$G/tmp" "$G/var/tmp"
chflags schg "$G/var/empty"
freebsd-update -f /etc/freebsd-update-jails.conf -b "$G" -d "$G/var/db/freebsd-update" \
--currently-running 15.1-RELEASE fetch install
service jail start $J
pkg -j $J upgrade -fkernel to (maybe) make it run faster... seemed like a good idea at the time, but for sure not necessary. freebsd-update needs to be run with the --currently-running and -b options instead of the single -j option because the jail is stopped when doing this update, and -j requires the jail to be running so it can figure out the version to update. freebsd-update IDS shows they're all back in sync with a stock 15.1-RELEASE base. SSO is working in all jails (and in my jellyfin VM), so I'm happy with that... way too much work for minimal gain. I tried showing my wife and got a big eye roll. My networking config now passes all traffic between service jails / VMs on a separate VLAN, keeping my primary VLAN free for servicing clients.
[root@intermediatecajail ~] # cd /root/ca/intermediate/certs && \
cat intermediate.cert.pem ca.cert.pem > ca-chain.cert.pem && chmod 444 \
intermediate.cert.pem ca.cert.pem ca-chain.cert.pem [root@jailhost ~] # install -m 0644 -o root -g wheel \
"/path/to/intermediateCA/root/ca/intermediate/certs/ca-chain.cert.pem" \
"/path/to/newjail/usr/local/share/certs/mydomain.ca-chain.cert.pem" [root@jailhost ~] # jexec newjail certctl rehash [root@jailhost ~] # pkg -j newjail install sssd2 sudo-sssd pam_mkhomedir bash [root@jailhost ~] # jexec -l newjail login -f root[logging]
default = FILE:/var/log/krb5.log
[libdefaults]
default_realm = MYDOMAIN.COM
dns_lookup_realm = true
dns_lookup_kdc = true
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
fcc-mit-ticketflags = true
rdns = false
dns_canonicalize_hostname = false
[realms]
MYDOMAIN.COM = {
kdc = ldapjail.mydomain.com
kdc = ldapjail2.mydomain.com
admin_server = ldapjail.mydomain.com
default_domain = mydomain.com
}
[domain_realm]
.mydomain.com = MYDOMAIN.COM
mydomain.com = MYDOMAIN.COM [root@newjail ~] # chmod 644 /etc/krb5.conf && chown root:wheel /etc/krb5.confgroup: files sss
hosts: files dns
networks: files
passwd: files sss
shells: files
services: nis
protocols: files
rpc: files
sudoers: files sss [root@newjail ~] # chmod 644 /etc/nsswitch.conf && chown root:wheel /etc/nsswitch.confauth sufficient pam_sss.so forward_pass
auth required pam_unix.so no_warn try_first_pass
account required pam_nologin.so
account required pam_login_access.so
account required pam_unix.so
account required pam_sss.so ignore_unknown_user ignore_authinfo_unavail
session required pam_mkhomedir.so mode=0700 skel=/usr/local/etc/skel-ldap
session optional pam_sss.so
session required pam_permit.so
password required pam_unix.so no_warn try_first_pass [root@newjail ~] # chmod 644 /etc/pam.d/sshd && chown root:wheel /etc/pam.d/sshdauth sufficient pam_sss.so forward_pass
auth required pam_unix.so no_warn try_first_pass nullok
account required pam_login_access.so
account required pam_unix.so
account required pam_sss.so ignore_unknown_user ignore_authinfo_unavail
session required pam_mkhomedir.so mode=0700 skel=/usr/local/etc/skel-ldap
session optional pam_sss.so
session required pam_lastlog.so no_fail
password required pam_unix.so no_warn try_first_pass [root@newjail ~] # chmod 644 /etc/pam.d/system && chown root:wheel /etc/pam.d/systemauth sufficient pam_rootok.so no_warn
auth sufficient pam_self.so no_warn
auth requisite pam_group.so no_warn group=wheel root_only fail_safe ruser
auth include system
account include system
session required pam_mkhomedir.so mode=0700 skel=/usr/local/etc/skel-ldap
session required pam_permit.so [root@newjail ~] # chmod 644 /etc/pam.d/su && chown root:wheel /etc/pam.d/su[sssd]
services = nss, pam, sudo
config_file_version = 2
domains = MYDOMAIN.COM
debug_level = 4
[nss]
shell_fallback = /bin/sh
[sudo]
debug_level = 4
[domain/MYDOMAIN.COM]
debug_level = 4
cache_credentials = False
enumerate = True
id_provider = ldap
sudo_provider = ldap
ldap_uri = ldap://ldapjail.mydomain.com
ldap_backup_uri = ldap://ldapjail2.mydomain.com
ldap_search_base = dc=mydomain,dc=com
ldap_group_search_base = ou=groups,dc=mydomain,dc=com
ldap_sudo_search_base = ou=SUDOers,dc=mydomain,dc=com
ldap_sudo_full_refresh_interval = 86400
ldap_sudo_smart_refresh_interval = 3600
ldap_schema = rfc2307bis
ldap_user_object_class = domainAccount
ldap_group_object_class = domainGroup
ldap_group_member = member
ldap_default_bind_dn = uid=ldapbinduser,ou=accounts,dc=mydomain,dc=com
ldap_default_authtok = <bind password, whatever you picked earlier>
ldap_id_use_start_tls = True
ldap_tls_reqcert = demand
ldap_tls_cacert = /usr/local/share/certs/mydomain.ca-chain.cert.pem
ldap_tls_cacertdir = /etc/ssl/certs/
auth_provider = krb5
chpass_provider = krb5
krb5_server = ldapjail.mydomain.com
krb5_backup_server = ldapjail2.mydomain.com
krb5_kpasswd = ldapjail.mydomain.com
krb5_realm = MYDOMAIN.COM
[pam]
pam_passkey_auth = False [root@newjail ~] # chmod 600 /usr/local/etc/sssd/sssd.conf && chown root:wheel /usr/local/etc/sssd/sssd.conf [root@newjail ~] # mkdir -p /usr/local/etc/skel-ldap/ [root@newjail ~] # cp /usr/share/skel/dot.profile /usr/local/etc/skel-ldap/.profile[ -f ~/.profile ] && . ~/.profile
[ -f ~/.bashrc ] && . ~/.bashrcPS1="\u@\h:\w \$ "GSSAPIAuthentication yes
GSSAPICleanupCredentials yes [root@newjail ~] # ln -s /usr/local/bin/bash /bin/bash [root@newjail ~] # grep -qx /bin/bash /etc/shells || echo /bin/bash >> /etc/shells# mkdir -p /home [root@ldapjail ~] # /usr/local/sbin/kadmin.local -q "addprinc -randkey host/newjail.mydomain.com" [root@ldapjail ~] # /usr/local/sbin/kadmin.local -q "ktadd -k /tmp/newjail.keytab host/newjail.mydomain.com" [root@jailhost ~] # install -m 0600 -o root -g wheel "/path/to/ldapjail/tmp/newjail.keytab" "/path/to/newjail/etc/krb5.keytab" && rm "/path/to/ldapjail/tmp/newjail.keytab" [root@jailhost ~] # jexec -l newjail login -f root, and proceed to enable and start sssd: [root@newjail ~] # sysrc sssd_enable=YES [root@newjail ~] # service sssd start [root@newjail ~] # pw groupmod wheel -m directoryuser su and immediately gain elevated privileges without being asked for the password. [root@newjail ~] # sshd -t && service sshd reload [myuser@myclient ~] $ klist -f [myuser@myclient ~] $ ssh newjail.mydomain.com [myuser@newjail ~] $ klist
me@testjail:~ $ pwd
/home/me
me@testjail:~ $ ls -lh
total 0 B
me@testjail:~ $ exit
logout
Connection to testjail.mydomain.com closed.
[me@myclient SSOtest]$ ls -lh
total 0
[me@myclient SSOtest]$ touch 1.txt && touch 2.txt && touch 3.txt
[me@myclient SSOtest]$ ls -lh
total 1.5K
-rw-r--r-- 1 me me 0 Oct 19 21:07 1.txt
-rw-r--r-- 1 me me 0 Oct 19 21:07 2.txt
-rw-r--r-- 1 me me 0 Oct 19 21:07 3.txt
[me@myclient SSOtest]$ klist
Ticket cache: FILE:/tmp/krb5cc_10002_g150ke
Default principal: me@MYDOMAIN.COM
Valid starting Expires Service principal
10/19/2026 21:01:25 10/20/2026 09:01:25 krbtgt/MYDOMAIN.COM@MYDOMAIN.COM
renew until 10/20/2026 21:01:25
10/19/2026 21:02:54 10/20/2026 09:01:25 host/testjail.mydomain.com@MYDOMAIN.COM
renew until 10/20/2026 21:01:25
[me@myclient SSOtest]$ scp *.txt testjail:
1.txt 100% 0 0.0KB/s 00:00
2.txt 100% 0 0.0KB/s 00:00
3.txt 100% 0 0.0KB/s 00:00
[me@myclient SSOtest]$ ssh testjail
Last login: Mon Oct 19 21:07:03 2026 from 10.20.30.52
FreeBSD 15.1-RELEASE-p5 (GENERIC) releng/15.1-n283639-893c7c99b60d
Welcome to FreeBSD!
<< clip - we've all seen the welcome message before >>
-- Benedict Reuschling <bcr@FreeBSD.org>
me@testjail:~ $ pwd
/home/me
me@testjail:~ $ ls -lh
total 1.5 KB
-rw-r--r-- 1 me me 0B Oct 19 21:07 1.txt
-rw-r--r-- 1 me me 0B Oct 19 21:07 2.txt
-rw-r--r-- 1 me me 0B Oct 19 21:07 3.txt
me@testjail:~ $ klist
Ticket cache: FILE:/tmp/krb5cc_10002_3pnGUjsLV3
Default principal: me@MYDOMAIN.COM
Valid starting Expires Service principal
10/19/26 21:07:58 10/20/26 09:01:25 krbtgt/MYDOMAIN.COM@MYDOMAIN.COM
renew until 10/20/26 21:01:25
me@testjail:~ $ exit
logout
Connection to testjail.mydomain.com closed.
[me@myclient SSOtest]$