[28340] in Kerberos
Re: Active Directory LDAP SSH
daemon@ATHENA.MIT.EDU (Christopher D. Clausen)
Tue Sep 4 14:27:03 2007
Message-ID: <0E0E4BF88B0648139383AB8ED90AE777@CDCHOME>
From: "Christopher D. Clausen" <cclausen@acm.org>
To: "Roman S" <kleinerroemer@hotmail.com>
Date: Tue, 4 Sep 2007 13:26:25 -0500
Cc: kerberos@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Michael B Allen <ioplex@gmail.com> wrote:
> On 9/4/07, Roman S <kleinerroemer@hotmail.com> wrote:
>> I've configured a Microsoft Active Directory with LDAP and Kerberos,
>> and some Linux (Redhat) clients who authenticate to it.
>> I'm able to get some tickets for the users who are in the Active
>> Directory, but SSH behaves a bit strange.
>>
>> I can always ssh to the same machine again.
>> Like
>> #foo: ssh foo
>>
>> but I can't ssh to any other computers. I always get a Permission
>> denied.
>> I've only enabled gssapi authentication, all others are disabled.
>> Debug output of ssh didn't get me any further.
>
> Hi Roman,
>
> Did you create the host principal and keytab for the target server?
I suspect yes or the inital credential forwarding would not work either.
> Also, you'll need a .k5login file in the home directory of the target:
>
> $ cat ~/.k5login
> alice@EXAMPLE.COM
You do not NEED a .k5login file. It may be useful in certain
environments, but it is not required.
> Google for info about the above and you should find a tutorial I
> would think.
You probably need to:
1) ensure that forwardable tickets are being obtained (I suspect this is
already the case)
2) set GSSAPIDelegateCredentials yes for ssh and/or sshd
<<CDC
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
