1

We are running OpenSSH server under Debian jessie. We use Kerberos as one of our authentication methods. The standard place to put the Kerberos keytab file on the OpenSSH server is in /etc/krb5.keytab. Is there any OpenSSH configuration option that would allow us to put the keytab file somewhere else, or is that location hard-coded in the OpenSSH server executable?

1

The (portable) OpenSSH code base lacks reference to "keytab", so scooting over to the kerberos configuration in krb5.conf we find:

LIBDEFAULTS SECTION
       The following relations are defined in the [libdefaults] section:

       default_keytab_name
              This  relation  specifies  the default keytab name to be used by
              application severs such as telnetd and rlogind.  The default  is
              "/etc/krb5.keytab".  This formerly defaulted to "/etc/v5srvtab",
              but was changed to the current value.

Which may or may not be too global a value for your need, depending.

1

I know this is an old question, but wanted to post my answer as I looked for this for a while:

There is a kerberos environment variable that points to the location of the kerberos keytab file, KRB5_KTNAME. And you can certainly set that globally, but then all applications will look at that one keytab file.

But I finally found a great way to set it on an application specific basis when the application configuration doesn't explicitly allow for it. I added the kerberos keytab environment variable KRB5_KTNAME to /etc/default/ssh (the rest of the file below was already there by default):

/etc/default/ssh
# Default settings for openssh-server. This file is sourced by /bin/sh from
# /etc/init.d/ssh.

# Options to pass to sshd
SSHD_OPTS=

KRB5_KTNAME=/etc/krb/host.keytab

The file above specifies init.d, but many of systemd service files also reference the same file. On my Ubuntu 16.04 install, here's the relevant section of the default sshd.service file:

/lib/systemd/system/sshd.service
[...]
[Service]
EnvironmentFile=-/etc/default/ssh
ExecStart=/usr/sbin/sshd -D $SSHD_OPTS
[...]

Of course, if your service file does not contain the "EnvironmentFile" line, you can add it as above, or you can edit the service file to point to any file with the KRB5_KTNAME env variable defined.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.