3

So, I'm trying to set up forwarding with Kerberos and seem to have some problems.

On some of my servers I'm able to forward after receiving a ticket; however, some I'm not.

My system setup is a mixture of CentOS 5 and OpenSuSE 13.1. Some of these machines use sssd and some use /etc/krb5.conf. In all of the sshd_confs I've enabled the following options:

# Kerberos options
KerberosAuthentication yes
KerberosOrLocalPasswd yes
KerberosTicketCleanup yes
#KerberosGetAFSToken yes #Not always supported

# GSSAPI options
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes

I think this may be a pam\sssd problem, but let me put the following diagram to try and clear everything up

----------------   ssh -K  ------------------
| OpenSuSE 13.1 | -------> | CentOS 5       |
| sssd          |          | /etc/krb5.conf |
-----------------\         | kdc server     |
                  ssh -K   ------------------
                    \            ^  |
                     \           |  v
                       - > ------------------
                           | CentOS 5       |
                           | /etc/krb5.conf |
                           | kdc server     |
                           ------------------

To understand this, if there is an arrow, then that means I can log in without entering another password. So, between the two kdc servers I can log in without a password.

From the OpenSuSE box, I have to specify the -K option when performing ssh; however, I am not able to get back from CentOS to OpenSuSE, even when at the console.

What I want is to be able to go from any machine to any other, using my ticket, and without having to do the -K option for SSH.

Any ideas?

-1
Host some.host.net some-other-machine.net
    GSSAPIDelegateCredentials yes

should eliminate having to pass -K.

  • Maybe the OP will understand this immediately, but I don't. Please improve this answer by explaining it. Is this a shell command (or two commands)? Or is this something that should be added to a config file? Where? What do some.host.net and some-other-machine.net represent (I assume that they aren't literal)? What does this actually do/mean? Please do not respond in comments; edit your answer to make it clearer and more complete. – G-Man Aug 27 '16 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.