-current ssh/Kerberos issues

From: Michael Reifenberger <mike_at_Reifenberger.com>
Date: Fri, 12 Mar 2004 00:23:44 +0100 (CET)
Hi,
after making a new -current world on my (client-)Notebook (including the new
openssh package), it seems that ssh/Heimdal/GSSAPI doestn't work any longer.

Symptom: I get asked for an password (but I have an valid forwardable ticket).

'fw' is KDC, 'nihil' is client.

############## Window 1 #####################

(nihil)(root) # ldd /usr/sbin/sshd
/usr/sbin/sshd:
        libssh.so.2 => /usr/lib/libssh.so.2 (0x480a7000)
        libutil.so.4 => /lib/libutil.so.4 (0x480d6000)
        libz.so.2 => /lib/libz.so.2 (0x480e2000)
        libwrap.so.3 => /usr/lib/libwrap.so.3 (0x480f0000)
        libpam.so.2 => /usr/lib/libpam.so.2 (0x480f8000)
        libgssapi.so.7 => /usr/lib/libgssapi.so.7 (0x480ff000)
        libkrb5.so.7 => /usr/lib/libkrb5.so.7 (0x4810d000)
        libasn1.so.7 => /usr/lib/libasn1.so.7 (0x48149000)
        libcom_err.so.2 => /usr/lib/libcom_err.so.2 (0x4816f000)
        libroken.so.7 => /usr/lib/libroken.so.7 (0x48171000)
        libcrypto.so.3 => /lib/libcrypto.so.3 (0x4817f000)
        libcrypt.so.2 => /lib/libcrypt.so.2 (0x4828e000)
        libc.so.5 => /lib/libc.so.5 (0x482a7000)
        libmd.so.2 => /lib/libmd.so.2 (0x48382000)

(nihil)(root) # sshd -Dde
debug1: sshd version OpenSSH_3.7.1p2 FreeBSD-20040106
debug1: read PEM private key done: type DSA
debug1: private host key: #0 type 2 DSA
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Server will not fork when running in debugging mode.
debug1: res_init()
Connection from 10.0.0.1 port 51895
debug1: Client protocol version 2.0; client software version OpenSSH_3.7.1p2
FreeBSD-20040106
debug1: match: OpenSSH_3.7.1p2 FreeBSD-20040106 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.7.1p2 FreeBSD-20040106
debug1: permanently_set_uid: 22/22
debug1: list_hostkey_types: ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
Address 10.0.0.1 maps to fw.reifenberger.com, but this does not map back to the
address - POSSIBLE BREAKIN ATTEMPT!
debug1: userauth-request for user root service ssh-connection method none
debug1: attempt 0 failures 0
Failed none for root from 10.0.0.1 port 51895 ssh2
debug1: PAM: initializing for "root"
debug1: PAM: setting PAM_RHOST to "fw.reifenberger.com"
debug1: userauth-request for user root service ssh-connection method
keyboard-interactive
debug1: attempt 1 failures 1
debug1: keyboard-interactive devs
debug1: auth2_challenge: user=root devs=
debug1: kbdint_alloc: devices 'pam'
debug1: auth2_challenge_start: trying authentication method 'pam'
Postponed keyboard-interactive for root from 10.0.0.1 port 51895 ssh2

################# Window 2 ###################################

(nihil)(root) # kinit
root_at_REIFENBERGER.COM's Password:
(nihil)(root) # klist -f
Credentials cache: FILE:/tmp/krb5cc_0
        Principal: root_at_REIFENBERGER.COM

  Issued           Expires        Flags    Principal
Mar 12 00:02:19  Mar 19 00:02:19  FRIA
krbtgt/REIFENBERGER.COM_at_REIFENBERGER.COM

(nihil)(root) # ssh fw
(fw)(root) # klist -f
Credentials cache: FILE:/tmp/krb5cc_8Cmyjx
        Principal: root_at_REIFENBERGER.COM

  Issued           Expires        Flags    Principal
Mar 12 00:02:57  Mar 19 00:02:19  FfA    krbtgt/REIFENBERGER.COM_at_REIFENBERGER.COM

(fw)(root) # ssh nihil
Password:
...

##################

BTW: on nihil I reverted /usr/sbin/ssh and /usr/lib/libssh.so.2 back to the
previous versions to have outgoing SSO access to fw. Without that
'ssh fw' would have asked for an password too.

BTW2: pam_krb5 doesnt seem to respect the following settings in /etc/krb5.conf:
...
        forwardable = true
        ticket_lifetime = 1 week
        renew_lifetime = 1 month
...
I have them in both '[appdefaults]' and '[libdefaults]' sections.

This can be seen when login via syscons which uses /etc/pam.d/login which
includes /etc/pam.d/system which contains:
...
auth            sufficient      pam_krb5.so             rootok no_warn try_first_pass
...

which leads after login to:
(nihil)(root) # klist -f
Credentials cache: FILE:/tmp/krb5cc_0
        Principal: root_at_REIFENBERGER.COM

  Issued           Expires        Flags    Principal
Mar 12 00:16:11  Mar 12 10:16:11  A      host/nihil.reifenberger.com_at_REIFENBERGER.COM
Mar 12 00:16:11  Mar 12 10:16:11  IA     krbtgt/REIFENBERGER.COM_at_REIFENBERGER.COM


Any clues?

Bye/2
---
Michael Reifenberger, Business Development Manager SAP-Basis, Plaut Consulting
Comp: Michael.Reifenberger_at_plaut.de | Priv: Michael_at_Reifenberger.com
      http://www.plaut.de           |       http://www.Reifenberger.com

Received on Thu Mar 11 2004 - 14:30:05 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:47 UTC