[22602] in Kerberos
Re: Kerberized authentication with SecureCRT 4.1.8
daemon@ATHENA.MIT.EDU (Sam Hartman)
Fri Oct 1 13:55:03 2004
To: "Douglas E. Engert" <deengert@anl.gov>
From: Sam Hartman <hartmans@mit.edu>
Date: Fri, 01 Oct 2004 13:46:06 -0400
In-Reply-To: <415C9A1F.1000207@anl.gov> (Douglas E. Engert's message of
"Thu, 30 Sep 2004 18:43:27 -0500")
Message-ID: <tsl3c0yjpr5.fsf@cz.mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
>>>>> "Douglas" == Douglas E Engert <deengert@anl.gov> writes:
Douglas> rachel elizabeth dillon wrote:
>> I have an existing MIT Kerberos realm with Kerberized SSH
>> logins over GSSAPI using method external-keyx. I want to be
>> able to connect to this realm from a Windows machine. The owner
>> of the realm has a SecureCRT license, so I started there. With
>> MIT KfW 2.6.5 installed on the machine (which is running
>> Windows 2003), I am able to make a connection which gets me a
>> host ticket and the pre-login banner but then fails with an
>> error of "GSSAPI authentication with the server could not be
>> completed." Running an sshd -d -d -d on the server machine, I
>> see that it tries to connect first with method "none," which
>> tries to use PAM and fails (PAM is not configured on this
>> server past the defaults), and then tries to use method
>> "gssapi," which fails as follows:
>>
Douglas> It should work, I have used SecureCRT-4.1.3 with KfW to
Douglas> OpenSSH sshd versions 3.1, through 3.9. Note that the
Douglas> gssapi code was changed to gssapi-with-mic as there was a
Douglas> security problem. SecureCRT should work with either.
I believe Rachel is running into a bug in my Debian packages. I think
I understand what's going on. I managed to misapply part of Simon's
3.6 patches such that the Debian server cannot deal with a
properly-encoded OID.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
