3

As far as I understand, issuing ssh -K somehost will use a kerberos token to authenticate with somehost. Is it possible to specify which file to use as the token?

Note that Kerberos is not properly set up on my machine, but I only copied the TGT from a machine on which Kerberos is set up properly.

More specifically, I copied the token to /tmp/krb5cc_1000 (where 1000 is my uid), so that klist recognizes the token as follows:

➜  ~ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: XXX@XXX.COM

Valid starting       Expires              Service principal  
XXXX  
XXXX

I would like to do this as I currently need to ssh from my Laptop (L) to a gateway server (G) on which I may issue the token and then ssh to the final server (S). Given that the token may be valid for an extended timeframe and that transparent ssh forwarding would simplify my development setup I aim to set up ssh ProxyCommand. However, ssh ProxyCommand requires all keys / tokens to be present on the local machine (L).

Currently I am using a ProxyCommand as follows:

ProxyCommand ssh gateway nc %h %p

This enables me to establish a connection to (S), however authentication does not finish:

OpenSSH_7.3p1-hpn14v11, OpenSSL 1.0.2k  26 Jan 2017
debug1: Reading configuration data /home/user/.ssh/config
debug1: /home/user/.ssh/config line 1: Applying options for *
debug1: /home/user/.ssh/config line 10: Applying options for S
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Executing proxy command: exec ssh GW nc S -p 22
debug1: permanently_drop_suid: 1000
debug1: identity file /home/user/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.3p1-hpn14v11
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
debug1: Remote is NON-HPN aware
debug1: Authenticating to S:22 as 'user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: AUTH STATE IS 0
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: REQUESTED ENC.NAME is 'chacha20-poly1305@openssh.com'
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: REQUESTED ENC.NAME is 'chacha20-poly1305@openssh.com'
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY

I have tried setting GSSAPIAuthentication yes which should force authentication via kerberos as far as I understand.

2

Is it possible to specify which file to use as the token?

No. SSH is using the ticket the same ticket as is visible for klist and accessible using GSSAPI.

copied the TGT from a machine on which Kerberos is set up properly.

I don't think this is how it works. Start from the start and set up the kerberos properly.

This enables me to establish a connection to (S), however authentication does not finish:

The authentication did not even start according to this log. It hangs on the key exchange, which is completely another issue (unless you would do gssapi key exchange which you don't do).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.