I'm using ksshaskpass
to add my password protected keys into ssh-agent
upon logging into KDE, is there something similar for kerberos?
2 Answers
I would look into using pam-krb5.
On Debian and Ubuntu, it should be apt-get install libpam-krb5
.
The PAM configuration would look something like:
auth required pam_unix.so
auth optional pam_krb5.so try_first_pass
or
auth required pam_unix.so
auth optional pam_krb5.so use_first_pass
in /etc/pam.d/common-auth
.
It takes the password you used to authenticate locally, e.g. the password in /etc/shadow
, and then tries to use the same one as your Kerberos password.
If your Kerberos password is the same as your system password, you don't need to type it again.
If your Kerberos password is different from your system password, what happens depends on whether you used try_first_pass
or use_first_pass
:
try_first_pass
will ask you for your Kerberos passworduse_first_pass
won't ask you, but you'll have to runkinit
yourself later
Note that this probably makes ksshaskpass redundant too, because you can also have:
auth required pam_unix.so
auth optional pam_ssh.so try_first_pass
auth optional pam_krb5.so try_first_pass
On Debian and Ubuntu, that requires installing libpam-ssh.
-
Yeah I know about this, but I would like some solution that works with different passwords. Apr 26, 2011 at 8:49
-
@Let_Me_Be: Can you elaborate?
try_first_pass
or no option should work in that case.– MikelApr 28, 2011 at 0:39 -
1How would this work if my kerberos username is different from the local username? E.g.
gert
versusgertvdijk
. Sep 2, 2013 at 11:16 -
It would be great to have kinit using a keyring, does someone know about something like that?– DaveSep 8, 2015 at 10:18
Normally, Kerberos would be integrated with PAM pam_krb5.so. It will attempt to acquire a Kerberos ticket based on your username and the password you supply. It can also use that to verify whether you are allowed to login, but that can be set to ignore if you just want the ticket. It needs to be added as both an auth and a session module, probably also password if you plan to keep your Kerberos password in sync with your desktop. If you plan to use Kerberos for verifying a user's login, you should also setup your keytab file at /etc/krb5.keytab with a key for host/[email protected] replace hostname and example.com as appropriate for your environment.