Hi, after making a new -current world on my (client-)Notebook (including the new openssh package), it seems that ssh/Heimdal/GSSAPI doestn't work any longer. Symptom: I get asked for an password (but I have an valid forwardable ticket). 'fw' is KDC, 'nihil' is client. ############## Window 1 ##################### (nihil)(root) # ldd /usr/sbin/sshd /usr/sbin/sshd: libssh.so.2 => /usr/lib/libssh.so.2 (0x480a7000) libutil.so.4 => /lib/libutil.so.4 (0x480d6000) libz.so.2 => /lib/libz.so.2 (0x480e2000) libwrap.so.3 => /usr/lib/libwrap.so.3 (0x480f0000) libpam.so.2 => /usr/lib/libpam.so.2 (0x480f8000) libgssapi.so.7 => /usr/lib/libgssapi.so.7 (0x480ff000) libkrb5.so.7 => /usr/lib/libkrb5.so.7 (0x4810d000) libasn1.so.7 => /usr/lib/libasn1.so.7 (0x48149000) libcom_err.so.2 => /usr/lib/libcom_err.so.2 (0x4816f000) libroken.so.7 => /usr/lib/libroken.so.7 (0x48171000) libcrypto.so.3 => /lib/libcrypto.so.3 (0x4817f000) libcrypt.so.2 => /lib/libcrypt.so.2 (0x4828e000) libc.so.5 => /lib/libc.so.5 (0x482a7000) libmd.so.2 => /lib/libmd.so.2 (0x48382000) (nihil)(root) # sshd -Dde debug1: sshd version OpenSSH_3.7.1p2 FreeBSD-20040106 debug1: read PEM private key done: type DSA debug1: private host key: #0 type 2 DSA debug1: Bind to port 22 on 0.0.0.0. Server listening on 0.0.0.0 port 22. debug1: Server will not fork when running in debugging mode. debug1: res_init() Connection from 10.0.0.1 port 51895 debug1: Client protocol version 2.0; client software version OpenSSH_3.7.1p2 FreeBSD-20040106 debug1: match: OpenSSH_3.7.1p2 FreeBSD-20040106 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_3.7.1p2 FreeBSD-20040106 debug1: permanently_set_uid: 22/22 debug1: list_hostkey_types: ssh-dss debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: client->server aes128-cbc hmac-md5 none debug1: kex: server->client aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: KEX done Address 10.0.0.1 maps to fw.reifenberger.com, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT! debug1: userauth-request for user root service ssh-connection method none debug1: attempt 0 failures 0 Failed none for root from 10.0.0.1 port 51895 ssh2 debug1: PAM: initializing for "root" debug1: PAM: setting PAM_RHOST to "fw.reifenberger.com" debug1: userauth-request for user root service ssh-connection method keyboard-interactive debug1: attempt 1 failures 1 debug1: keyboard-interactive devs debug1: auth2_challenge: user=root devs= debug1: kbdint_alloc: devices 'pam' debug1: auth2_challenge_start: trying authentication method 'pam' Postponed keyboard-interactive for root from 10.0.0.1 port 51895 ssh2 ################# Window 2 ################################### (nihil)(root) # kinit root_at_REIFENBERGER.COM's Password: (nihil)(root) # klist -f Credentials cache: FILE:/tmp/krb5cc_0 Principal: root_at_REIFENBERGER.COM Issued Expires Flags Principal Mar 12 00:02:19 Mar 19 00:02:19 FRIA krbtgt/REIFENBERGER.COM_at_REIFENBERGER.COM (nihil)(root) # ssh fw (fw)(root) # klist -f Credentials cache: FILE:/tmp/krb5cc_8Cmyjx Principal: root_at_REIFENBERGER.COM Issued Expires Flags Principal Mar 12 00:02:57 Mar 19 00:02:19 FfA krbtgt/REIFENBERGER.COM_at_REIFENBERGER.COM (fw)(root) # ssh nihil Password: ... ################## BTW: on nihil I reverted /usr/sbin/ssh and /usr/lib/libssh.so.2 back to the previous versions to have outgoing SSO access to fw. Without that 'ssh fw' would have asked for an password too. BTW2: pam_krb5 doesnt seem to respect the following settings in /etc/krb5.conf: ... forwardable = true ticket_lifetime = 1 week renew_lifetime = 1 month ... I have them in both '[appdefaults]' and '[libdefaults]' sections. This can be seen when login via syscons which uses /etc/pam.d/login which includes /etc/pam.d/system which contains: ... auth sufficient pam_krb5.so rootok no_warn try_first_pass ... which leads after login to: (nihil)(root) # klist -f Credentials cache: FILE:/tmp/krb5cc_0 Principal: root_at_REIFENBERGER.COM Issued Expires Flags Principal Mar 12 00:16:11 Mar 12 10:16:11 A host/nihil.reifenberger.com_at_REIFENBERGER.COM Mar 12 00:16:11 Mar 12 10:16:11 IA krbtgt/REIFENBERGER.COM_at_REIFENBERGER.COM Any clues? Bye/2 --- Michael Reifenberger, Business Development Manager SAP-Basis, Plaut Consulting Comp: Michael.Reifenberger_at_plaut.de | Priv: Michael_at_Reifenberger.com http://www.plaut.de | http://www.Reifenberger.com
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:47 UTC