[22662] in Kerberos
PAM and GSSAPI SSH authentication conflict
daemon@ATHENA.MIT.EDU (Rachel Elizabeth Dillon)
Fri Oct 8 14:15:42 2004
Date: Fri, 8 Oct 2004 14:12:43 -0400
From: Rachel Elizabeth Dillon <red@mit.edu>
To: kerberos@mit.edu
Message-ID: <20041008181243.GN2188@yiff.mit.edu>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="===============99861535628201603=="
Errors-To: kerberos-bounces@mit.edu
--===============99861535628201603==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="9ToWwKEyhugL+MAz"
Content-Disposition: inline
--9ToWwKEyhugL+MAz
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
I am building a network that uses Kerberos for authentication. The original
plan was to have a single bastion host to which users sshed, and logged in
using their Kerberos password. From that bastion host, users could then=20
ssh to any other machine on the network, authenticatning via forwardable
Kerberos tickets and GSSAPI. I had this working. But, as always happens
with these things, requirements changed.
I am currently evaluating the feasibility of having every machine on the
network accept either Kerberos tickets or a Kerberos password as an
authentication mechanism. I believe that this _should_ work, but I haven't
been able to make it work. I have the following lines in /etc/pam.conf :
ssh auth required pam_krb5.so.1 try_first_pass=20
ssh account required pam_krb5.so.1=20
ssh session required pam_krb5.so.1=20
ssh password required pam_krb5.so.1 try_first_pass
If I comment these lines out, I get authentication just fine without
tickets but, unsurprisingly, no password-based authentication via PAM.
With the lines in place, if I ssh in with appropriate Kerberos tickets,
I get a host ticket but the following error in sshd -d -d -d :
debug1: userauth-request for user ptadmin service ssh-connection method ext=
ernal-keyx
debug1: attempt 1 failures 1
debug2: input_userauth_request: try method external-keyx
Authorized to ptadmin, krb5 principal ptadmin@IC.COM (krb5_kuserok)
debug2: pam_acct_mgmt() =3D 17
PAM rejected by account configuration[17]: User account has expired
To the best of my knowledge the account is not expired, since it can log=20
in just fine either with its Kerberos password or with those lines commented
out. I tried googling on this phrase and found a variety of errors related
to password expiry (reasonable), but this user account does not even _have_=
=20
a local password; no accounts do in our system. I would expect Solaris to
do the right thing and not count them as expired passwords in this case, but
maybe PAM gets tripped up? I'm not sure.
Anyway, any help would be appreciated. I'm using stock Debian OpenSSH 3.6,
except recompiled for Solaris.
Thanks!
-r.
--9ToWwKEyhugL+MAz
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFBZtibrAG/UVUP/b0RAtWKAJ4rT7yXY8t/9H/g0cWPkxrA8sddsgCgu1R/
z8rlmhegr8kQHE6+BLv8la0=
=05wQ
-----END PGP SIGNATURE-----
--9ToWwKEyhugL+MAz--
--===============99861535628201603==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============99861535628201603==--
