[22378] in Kerberos
Re: OpenSSH with Kerberos, without PAM
daemon@ATHENA.MIT.EDU (Christian Pfaffel)
Mon Sep 6 02:27:34 2004
To: "Ryan B. Lynch" <rlynch@bway.net>
From: Christian Pfaffel <flash@itp.tu-graz.ac.at>
In-Reply-To: <200409041958.36360.rlynch@bway.net>
Date: 06 Sep 2004 08:23:22 +0200
Message-ID: <7g1xhfkjad.fsf@faeppc20.tu-graz.ac.at>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-15
Content-Transfer-Encoding: 8bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
"Ryan B. Lynch" <rlynch@bway.net> writes:
> Hi,
>
> I'm wondering if it's possible to get OpenSSH authenticating via Kerberos
> WITHOUT using PAM.
>
> I was looking through the archives of the last couple months, specifically the
> discussions on OpenSSH and krb5, but I couldn't find any references to
> working setups that didn't use PAM. Google has a lot of information, but I
> haven't found anything dealing with the PAM question specifically. The docs
> are treating me similarly.
>
This applies to OpenSSH 3.8.1p1:
# cat /etc/ssh/sshd_config
...
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
...
# cat /etc/ssh/ssh_config
Protocol 2
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
See sshd_config(5) and ssh_config(5). Additionaly You need a
krb5.keytab entry for host/fqdn@domain at the host running sshd.
Regards,
Christian
--
Christian Pfaffel <flash@itp.tu-graz.ac.at>
Technische Universität Graz Telefon: +43 / 316 / 873 - 81 90
Institut für Theoretische Physik Telefax: +43 / 316 / 873 - 86 78
Petersgasse 16, A-8010 Graz http://fubphpc.tu-graz.ac.at/~flash/pubkey.gpg
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
