[Bug 268186] Kerberos authentication fails with a Linux/FreeIPA KDC

From: <bugzilla-noreply_at_freebsd.org>
Date: Fri, 16 Dec 2022 18:06:21 UTC 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=268186

--- Comment #24 from Cy Schubert <cy@FreeBSD.org> ---
(In reply to amendlik from comment #23)
Correct. You misunderstand.

FreeIPA has an MIT KRB5 KDC running on top of Linux O/S.

I an running and have tested on a MIT KRB5 KDC running on a FreeBSD O/S. There
is no FreeBSD native Heimdal KDC involved whatsoever. The MIT KRB5 KDC I am
running supports those ciphers. The FreeIPA KDC does not.

FreeBSD native Heimdal works with MIT KRB5 KDC. Using a Fedora 36 OpenSSH
client with a TGT from my MIT KRB5 KDC to connect to a FreeBSD OpenSSH server
linked against Heimdal also works. I use this to connect from $JOB and my
FreeBSD network.

Can you please try the OpenSSH patch I posted and rely entirely on PAM?
Otherwise I cannot tell if the calls to native Heimdal libraries by OpenSSH are
involved with this problem. Until such time this test is performed I must rely
entirely on my testing to conclude that FreeBSD Heimdal libraries work with an
MIT KRB5 KDC, which I have been using here for two and a half decades now.

-- 
You are receiving this mail because:
You are the assignee for the bug.