Kerberos

Tillman Hodgson tillman at seekingfire.com
Tue May 10 13:37:56 PDT 2005


On Mon, May 09, 2005 at 05:44:23PM -0700, Damian Sobieralski wrote:
> > Look into the GSSAPI options for /etc/ssh/ssh_config instead. 
> > Newer OpenSSH versions support Kerberos natively and 
> > don't need PAM hacks.
> 
>  Thanks Tillman! I was using PAM only based on someone's
> recommendation. As I've already admitted limited kerberos knowledge, I
> didn't know enough to question this approach. Based on your advice,
> I'll look into GSSAPI and I'll post my results to the group.  :-)

As a "get you started" hint, set these in your ssh_config on the client
hosts:

 GSSAPIAuthentication yes
 GSSAPIDelegateCredentials yes

And these in the sshd_config in the destination hosts:

 GSSAPICleanupCredentials yes
 GSSAPIAuthentication yes

Then obtain a valid ticket with kinit and test OpenSSH with:

ssh -vvv -o PreferredAuthentications=gssapi-with-mic hostname.domain.tld

(We're specificying the auth option explicitly to avoid things like
 pubkey, etc. You won't need to do this in the Real World once it's
 been confirmed to be working.)

A successful login displays this in the output:

debug1: Authentications that can continue: publickey,gssapi-with-mic,keyboard-interactive
debug1: Next authentication method: gssapi-with-mic
debug1: Delegating credentials
debug1: Delegating credentials
debug1: Authentication succeeded (gssapi-with-mic).

Note that OpenSSH doesn't appear to be very smart about handling
multi-homed hosts, so expect to run into difficulties in that situation
(one of the reasons that I just use `telnet -x` instead).

-T


-- 
"Waking a person unnecessarily should not be considered a capital crime.
 For a first offense, that is."
    -- Robert Heinlein


More information about the freebsd-questions mailing list