6

I try to login onto a server which only supports login with kerberos authentication. Here's what I try:

kinit user@FOO.ORG
aklog -c foo.org
ssh server

But then I'm asked again for a password.

Here's what I have in my ~/.ssh/config for the entry server (my /etc/ssh/ssh_config is empty):

Host server
    HostName someserver.foo.org
    User user
    ForwardX11 yes
    ForwardX11Trusted yes
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials yes

According to colleagues, this (or something similar) is working for them. I can log onto other machines with kerberos tokens just fine. I assume it has something to do with my /etc/krb5.conf, but I do not know what to look for. I tried copying the /etc/krb5.conf from the server to my working station, but without success.

Here's part of the output if I run ssh -vvv server:

debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
Server not found in Kerberos database

debug1: Unspecified GSS failure.  Minor code may provide more information
Server not found in Kerberos database

debug1: Unspecified GSS failure.  Minor code may provide more information


debug2: we sent a gssapi-with-mic packet, wait for reply

How can I login with my local kerberos token? What am I doing wrong?

  • Can't you just create a key and put the public key in ~/.ssh/authorized_keys on the server? man ssh-keygen – MikeA Oct 19 '16 at 23:02
  • @MikeA The server accepts only connections with a valid kerberos token. – pfnuesel Oct 19 '16 at 23:05
  • 1
    Try setting GSSAPIAuthentication yes in your ~/.ssh/config file and retry. Also look at PreferredAuthentications setting and make sure you have gssapi-with-mic first – VenkatC Oct 20 '16 at 1:07
  • @VenkatC I tried both of these before, no success. – pfnuesel Oct 20 '16 at 9:24
  • 1
    Actually, I'm confused now. Are you saying that your colleagues can log into the same server successfully? And you are able to successfully log into other servers using your Kerberos ticket? If you could update your question to be explicit about which situations are working (or not), that might help. – larsks Oct 27 '16 at 15:39
2

You probably need to add the server to the kerberos data base aka KDC by creating a principal for the machine itself.

If you are running Windows Active Directory with a KDC you can use the ktpass.exe to add the host to the KDC.

if you are running Windows or Linux Kerberos KDC you can use the ktutil command in a linux shell to at the principal to the kerberos database.

1

It might be that NTPD service has gone down, Atleast in my case, when checked the status , service failed with logs having PANIC_STOP, try below steps-

  1. systemctl stop ntpd
  2. systemctl status ntpd
  3. Please take note of one of the servers in /etc/ntpd.conf
  4. ntpdate <ABOVE SERVER>
  5. systemctl start ntpd
  • Some of the steps are not necessary, and it would make sense to first verify whether the time is actually wrong. – RalfFriedl May 14 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.