[Bug 268186] Kerberos authentication fails with a Linux/FreeIPA KDC
- In reply to: bugzilla-noreply_a_freebsd.org: "[Bug 268186] Kerberos authentication fails with a Linux/FreeIPA KDC"
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sun, 11 Dec 2022 00:35:26 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=268186 --- Comment #16 from amendlik@gmail.com --- I'm trying to eliminate version mismatches by logging on to SSH from the same host, so the client and server are the same system. The only other server involved is the KDC, which is running Linux and FreeIPA. Here is the log from the SSH client: OpenSSH_8.8p1, OpenSSL 1.1.1o-freebsd 3 May 2022 debug1: Reading configuration data /etc/ssh/ssh_config debug3: kex names ok: [curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1] debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/********/.ssh/known_hosts' debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/********/.ssh/known_hosts2' debug1: Executing proxy command: exec /usr/local/bin/sss_ssh_knownhostsproxy -p 22 ************** debug1: identity file /home/********/.ssh/id_rsa type -1 debug1: identity file /home/********/.ssh/id_rsa-cert type -1 debug1: identity file /home/********/.ssh/id_dsa type -1 debug1: identity file /home/********/.ssh/id_dsa-cert type -1 debug1: identity file /home/********/.ssh/id_ecdsa type -1 debug1: identity file /home/********/.ssh/id_ecdsa-cert type -1 debug1: identity file /home/********/.ssh/id_ecdsa_sk type -1 debug1: identity file /home/********/.ssh/id_ecdsa_sk-cert type -1 debug1: identity file /home/********/.ssh/id_ed25519 type -1 debug1: identity file /home/********/.ssh/id_ed25519-cert type -1 debug1: identity file /home/********/.ssh/id_ed25519_sk type -1 debug1: identity file /home/********/.ssh/id_ed25519_sk-cert type -1 debug1: identity file /home/********/.ssh/id_xmss type -1 debug1: identity file /home/********/.ssh/id_xmss-cert type -1 debug1: Local version string SSH-2.0-OpenSSH_8.8 FreeBSD-20211221 debug1: Remote protocol version 2.0, remote software version OpenSSH_8.8 FreeBSD-20211221 debug1: Fssh_compat_banner: match: OpenSSH_8.8 FreeBSD-20211221 pat OpenSSH* compat 0x04000000 debug2: fd 7 setting O_NONBLOCK debug2: fd 6 setting O_NONBLOCK debug1: Authenticating to **************:22 as '********' debug3: Fssh_record_hostkey: found key type ED25519 in file /home/********/.ssh/known_hosts:3 debug3: Fssh_load_hostkeys_file: loaded 1 keys from ************** debug1: Fssh_load_hostkeys: fopen /home/********/.ssh/known_hosts2: No such file or directory debug3: order_hostkeyalgs: have matching best-preference key type ssh-ed25519-cert-v01@openssh.com, using HostkeyAlgorithms verbatim debug3: send packet: type 20 debug1: SSH2_MSG_KEXINIT sent debug3: receive packet: type 20 debug1: SSH2_MSG_KEXINIT received debug2: local client KEXINIT proposal debug2: KEX algorithms: curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,ext-info-c debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: compression ctos: none,zlib@openssh.com,zlib debug2: compression stoc: none,zlib@openssh.com,zlib debug2: languages ctos: debug2: languages stoc: debug2: first_kex_follows 0 debug2: reserved 0 debug2: peer server KEXINIT proposal debug2: KEX algorithms: curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256 debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 debug2: ciphers ctos: aes256-ctr,aes192-ctr,aes128-ctr debug2: ciphers stoc: aes256-ctr,aes192-ctr,aes128-ctr debug2: MACs ctos: hmac-sha1 debug2: MACs stoc: hmac-sha1 debug2: compression ctos: none,zlib@openssh.com debug2: compression stoc: none,zlib@openssh.com debug2: languages ctos: debug2: languages stoc: debug2: first_kex_follows 0 debug2: reserved 0 debug1: kex: algorithm: curve25519-sha256@libssh.org debug1: kex: host key algorithm: ssh-ed25519 debug1: kex: server->client cipher: aes128-ctr MAC: hmac-sha1 compression: none debug1: kex: client->server cipher: aes128-ctr MAC: hmac-sha1 compression: none debug3: send packet: type 30 debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug3: receive packet: type 31 debug1: SSH2_MSG_KEX_ECDH_REPLY received debug1: Server host key: ssh-ed25519 SHA256:qsH5DlfcvjRaiyO43GHO135fwfsyFTHDji2EIsTp9r4 debug3: verify_host_key_dns DNS lookup error: general failure debug3: Fssh_record_hostkey: found key type ED25519 in file /home/********/.ssh/known_hosts:3 debug3: Fssh_load_hostkeys_file: loaded 1 keys from ************** debug1: Fssh_load_hostkeys: fopen /home/********/.ssh/known_hosts2: No such file or directory debug1: Host '**************' is known and matches the ED25519 host key. debug1: Found key in /home/********/.ssh/known_hosts:3 debug3: send packet: type 21 debug2: set_newkeys: mode 1 debug1: rekey out after 4294967296 blocks debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug3: receive packet: type 21 debug1: SSH2_MSG_NEWKEYS received debug2: set_newkeys: mode 0 debug1: rekey in after 4294967296 blocks debug1: Will attempt key: /home/********/.ssh/id_rsa RSA SHA256:f62xqkxo+DJNCEgqxXTFp6JyduHfzliOxWdWMFwQsIw agent debug1: Will attempt key: /home/********/.ssh/id_rsa debug1: Will attempt key: /home/********/.ssh/id_dsa debug1: Will attempt key: /home/********/.ssh/id_ecdsa debug1: Will attempt key: /home/********/.ssh/id_ecdsa_sk debug1: Will attempt key: /home/********/.ssh/id_ed25519 debug1: Will attempt key: /home/********/.ssh/id_ed25519_sk debug1: Will attempt key: /home/********/.ssh/id_xmss debug2: pubkey_prepare: done debug3: send packet: type 5 debug3: receive packet: type 7 debug1: SSH2_MSG_EXT_INFO received debug1: Fssh_kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com> debug3: receive packet: type 6 debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug3: send packet: type 50 debug3: receive packet: type 51 debug1: Authentications that can continue: publickey,gssapi-with-mic debug3: start over, passed a different list publickey,gssapi-with-mic debug3: preferred gssapi-with-mic,keyboard-interactive debug3: authmethod_lookup gssapi-with-mic debug3: remaining preferred: keyboard-interactive debug3: authmethod_is_enabled gssapi-with-mic debug1: Next authentication method: gssapi-with-mic debug3: send packet: type 50 debug2: we sent a gssapi-with-mic packet, wait for reply debug3: receive packet: type 60 debug1: Delegating credentials debug3: send packet: type 61 debug3: receive packet: type 51 debug1: Authentications that can continue: publickey,gssapi-with-mic debug2: we did not send a packet, disable method debug1: No more authentication methods to try. -- You are receiving this mail because: You are the assignee for the bug.