[32925] in Kerberos
Re: GSSAPI Issue
daemon@ATHENA.MIT.EDU (Russ Allbery)
Wed Nov 24 13:55:38 2010
From: Russ Allbery <rra@stanford.edu>
To: "kerberos\@mit.edu" <kerberos@mit.edu>
In-Reply-To: <1290620365.20307.5.camel@ray> (Greg Hudson's message of "Wed, 24
Nov 2010 12:39:25 -0500")
Date: Wed, 24 Nov 2010 10:55:33 -0800
Message-ID: <87sjyqy2je.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Greg Hudson <ghudson@MIT.EDU> writes:
> It is possible to forward credentials from the client to the server.
> For this to work, the following must be true:
> * You must have obtained forwardable tickets on the client. You can do
> this with kinit -f, or by setting "forwardable = true" in the
> [libdefaults] section of krb5.conf.
> * "GSSAPIDelegateCredentials yes" must be set in ssh_config, or
> specified on the command line with ssh -o GSSAPIDelegateCredentials=yes.
ssh -K is a shortcut for the latter and lets you choose for each ssh
command whether you want to forward tickets. I usually only use the ssh
setting for specific hosts I use a lot and explicitly add the -K when I
want to forward tickets to other hosts.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
