-current ssh/Kerberos issues
Michael Reifenberger
mike at Reifenberger.com
Thu Mar 11 15:30:05 PST 2004
Hi,
after making a new -current world on my (client-)Notebook (including the new
openssh package), it seems that ssh/Heimdal/GSSAPI doestn't work any longer.
Symptom: I get asked for an password (but I have an valid forwardable ticket).
'fw' is KDC, 'nihil' is client.
############## Window 1 #####################
(nihil)(root) # ldd /usr/sbin/sshd
/usr/sbin/sshd:
libssh.so.2 => /usr/lib/libssh.so.2 (0x480a7000)
libutil.so.4 => /lib/libutil.so.4 (0x480d6000)
libz.so.2 => /lib/libz.so.2 (0x480e2000)
libwrap.so.3 => /usr/lib/libwrap.so.3 (0x480f0000)
libpam.so.2 => /usr/lib/libpam.so.2 (0x480f8000)
libgssapi.so.7 => /usr/lib/libgssapi.so.7 (0x480ff000)
libkrb5.so.7 => /usr/lib/libkrb5.so.7 (0x4810d000)
libasn1.so.7 => /usr/lib/libasn1.so.7 (0x48149000)
libcom_err.so.2 => /usr/lib/libcom_err.so.2 (0x4816f000)
libroken.so.7 => /usr/lib/libroken.so.7 (0x48171000)
libcrypto.so.3 => /lib/libcrypto.so.3 (0x4817f000)
libcrypt.so.2 => /lib/libcrypt.so.2 (0x4828e000)
libc.so.5 => /lib/libc.so.5 (0x482a7000)
libmd.so.2 => /lib/libmd.so.2 (0x48382000)
(nihil)(root) # sshd -Dde
debug1: sshd version OpenSSH_3.7.1p2 FreeBSD-20040106
debug1: read PEM private key done: type DSA
debug1: private host key: #0 type 2 DSA
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Server will not fork when running in debugging mode.
debug1: res_init()
Connection from 10.0.0.1 port 51895
debug1: Client protocol version 2.0; client software version OpenSSH_3.7.1p2
FreeBSD-20040106
debug1: match: OpenSSH_3.7.1p2 FreeBSD-20040106 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.7.1p2 FreeBSD-20040106
debug1: permanently_set_uid: 22/22
debug1: list_hostkey_types: ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
Address 10.0.0.1 maps to fw.reifenberger.com, but this does not map back to the
address - POSSIBLE BREAKIN ATTEMPT!
debug1: userauth-request for user root service ssh-connection method none
debug1: attempt 0 failures 0
Failed none for root from 10.0.0.1 port 51895 ssh2
debug1: PAM: initializing for "root"
debug1: PAM: setting PAM_RHOST to "fw.reifenberger.com"
debug1: userauth-request for user root service ssh-connection method
keyboard-interactive
debug1: attempt 1 failures 1
debug1: keyboard-interactive devs
debug1: auth2_challenge: user=root devs=
debug1: kbdint_alloc: devices 'pam'
debug1: auth2_challenge_start: trying authentication method 'pam'
Postponed keyboard-interactive for root from 10.0.0.1 port 51895 ssh2
################# Window 2 ###################################
(nihil)(root) # kinit
root at REIFENBERGER.COM's Password:
(nihil)(root) # klist -f
Credentials cache: FILE:/tmp/krb5cc_0
Principal: root at REIFENBERGER.COM
Issued Expires Flags Principal
Mar 12 00:02:19 Mar 19 00:02:19 FRIA
krbtgt/REIFENBERGER.COM at REIFENBERGER.COM
(nihil)(root) # ssh fw
(fw)(root) # klist -f
Credentials cache: FILE:/tmp/krb5cc_8Cmyjx
Principal: root at REIFENBERGER.COM
Issued Expires Flags Principal
Mar 12 00:02:57 Mar 19 00:02:19 FfA krbtgt/REIFENBERGER.COM at REIFENBERGER.COM
(fw)(root) # ssh nihil
Password:
...
##################
BTW: on nihil I reverted /usr/sbin/ssh and /usr/lib/libssh.so.2 back to the
previous versions to have outgoing SSO access to fw. Without that
'ssh fw' would have asked for an password too.
BTW2: pam_krb5 doesnt seem to respect the following settings in /etc/krb5.conf:
...
forwardable = true
ticket_lifetime = 1 week
renew_lifetime = 1 month
...
I have them in both '[appdefaults]' and '[libdefaults]' sections.
This can be seen when login via syscons which uses /etc/pam.d/login which
includes /etc/pam.d/system which contains:
...
auth sufficient pam_krb5.so rootok no_warn try_first_pass
...
which leads after login to:
(nihil)(root) # klist -f
Credentials cache: FILE:/tmp/krb5cc_0
Principal: root at REIFENBERGER.COM
Issued Expires Flags Principal
Mar 12 00:16:11 Mar 12 10:16:11 A host/nihil.reifenberger.com at REIFENBERGER.COM
Mar 12 00:16:11 Mar 12 10:16:11 IA krbtgt/REIFENBERGER.COM at REIFENBERGER.COM
Any clues?
Bye/2
---
Michael Reifenberger, Business Development Manager SAP-Basis, Plaut Consulting
Comp: Michael.Reifenberger at plaut.de | Priv: Michael at Reifenberger.com
http://www.plaut.de | http://www.Reifenberger.com
-------------- next part --------------
# $OpenBSD: sshd_config,v 1.59 2002/09/25 11:17:16 markus Exp $
# $FreeBSD: src/crypto/openssh/sshd_config,v 1.33 2003/09/24 19:20:23 des Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.
# Note that some of FreeBSD's defaults differ from OpenBSD's, and
# FreeBSD has a few additional options.
#VersionAddendum FreeBSD-20030924
#Port 22
#Protocol 2,1
#ListenAddress 0.0.0.0
#ListenAddress ::
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_dsa_key
# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 3600
#ServerKeyBits 768
# Logging
#obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO
# Authentication:
#LoginGraceTime 120
PermitRootLogin yes
#StrictModes yes
#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
# rhosts authentication should not be used
#RhostsAuthentication no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
# Change to no to disable PAM authentication
#ChallengeResponseAuthentication yes
# Kerberos options
KerberosAuthentication yes
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
# GSSAPI options
GSSAPIAuthentication yes
GSSAPICleanupCreds yes
#AFSTokenPassing no
# Kerberos TGT Passing only works with the AFS kaserver
#KerberosTgtPassing no
#X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#KeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression yes
#MaxStartups 10
# no default banner path
#Banner /some/path
#VerifyReverseMapping no
# override default of no subsystems
Subsystem sftp /usr/libexec/sftp-server
-------------- next part --------------
# $OpenBSD: ssh_config,v 1.16 2002/07/03 14:21:05 markus Exp $
# $FreeBSD: src/crypto/openssh/ssh_config,v 1.22 2003/09/24 19:20:23 des Exp $
# This is the ssh client system-wide configuration file. See
# ssh_config(5) for more information. This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.
# Configuration data is parsed as follows:
# 1. command line options
# 2. user-specific file
# 3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.
# Site-wide defaults for various options
# Host *
# ForwardAgent no
# ForwardX11 no
# RhostsAuthentication no
# RhostsRSAAuthentication no
# RSAAuthentication yes
# PasswordAuthentication yes
# HostbasedAuthentication no
# BatchMode no
# CheckHostIP no
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# Port 22
# Protocol 2,1
# Cipher 3des
# Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
# EscapeChar ~
# VersionAddendum FreeBSD-20030924
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
-------------- next part --------------
[appdefaults]
forwardable = true
ticket_lifetime = 1 week
renew_lifetime = 1 month
[libdefaults]
default_etypes = des-cbc-crc
default_etypes_des = des-cbc-crc
default_realm = REIFENBERGER.COM
forwardable = true
ticket_lifetime = 1 week
renew_lifetime = 1 month
clockskew = 300
[domain_realm]
.reifenberger.com = REIFENBERGER.COM
[realms]
REIFENBERGER.COM = {
kdc = fw.reifenberger.com
kpasswd_server = fw.reifenberger.com
admin_server = fw.reifenberger.com
}
[kdc]
database = {
acl_file = /var/heimdal/kadmind.acl
mkey_file = /var/heimdal/m-key
}
More information about the freebsd-current
mailing list