[28417] in Kerberos
Disable name canonicalization for OpenSSH GSSAPI
daemon@ATHENA.MIT.EDU (Joel Johnson)
Mon Sep 17 22:45:56 2007
Message-ID: <60470.70.56.213.36.1190082427.squirrel@webmail.lixil.net>
Date: Mon, 17 Sep 2007 20:27:07 -0600 (MDT)
From: "Joel Johnson" <mrjoel@lixil.net>
To: kerberos@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
I'm using OpenSSH (4.3p2) on a Linux client to authenticate via GSSAPI with
the gssapi-with-mic SSH mechanism to multiple hosts with an existing
Kerberos infrastructure. The issue I'm having is with a new server which for
various reasons is located on a DSL link with a dynamic IP address. In turn,
I don't have control over the DNS PTR records, so while I have forward
resolution setup properly, I'm unable to setup the correct reverse lookup.
When I attempt to connect to this host with SSH, a ticket request is made
against the KDC for a host ticket using the name obtained by a reverse DNS
lookup name canonicalization which is not defined.
I've found references to the "[libdefaults] rdns = no" entry in krb5.conf,
but I'd rather not set the global setting. Is there any way to disable
reverse DNS on a per host/IP/regex basis?
Thanks for any help,
Joel Johnson
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
