[22665] in Kerberos
Re: PAM and GSSAPI SSH authentication conflict
daemon@ATHENA.MIT.EDU (Rachel Elizabeth Dillon)
Fri Oct 8 15:18:37 2004
Date: Fri, 8 Oct 2004 15:16:36 -0400
From: Rachel Elizabeth Dillon <red@mit.edu>
To: "Kasundra, Digant" <digant@uta.edu>
Message-ID: <20041008191636.GP2188@yiff.mit.edu>
Mime-Version: 1.0
In-Reply-To: <2BF615FBFB12BB47B6501D04376E657A0B0A8C@MAILFS1.uta.edu>
cc: kerberos@mit.edu
Content-Type: multipart/mixed; boundary="===============83993675362433917=="
Errors-To: kerberos-bounces@mit.edu
--===============83993675362433917==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="djJN5oi3zFpblwUd"
Content-Disposition: inline
--djJN5oi3zFpblwUd
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Thank you! I had to tweak some things to the modules that I had, and take
out some modules I didn't have, but I was able to get the right behavior
with:
#ssh auth required pam_env.so
ssh auth sufficient pam_unix_auth.so.1=20
ssh auth sufficient pam_krb5.so.1 try_first_pass=20
#ssh auth required pam_deny.so
ssh account required pam_unix_account.so.1
ssh account sufficient pam_krb5.so.1=20
ssh password sufficient pam_krb5.so.1 try_first_pass=20
#ssh password required pam_deny.so
#ssh session required pam_limits.so
ssh session required pam_unix_session.so.1
ssh session optional pam_krb5.so.1
I don't _think_ there is any problem with having those other lines
commented out, but I am not a PAM wizard. Thank you again for the help!
-r.
On Fri, Oct 08, 2004 at 01:58:07PM -0500, Kasundra, Digant wrote:
> This is what our pam file looks like:
>=20
> auth required /lib/security/$ISA/pam_env.so
> auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok
> auth sufficient /lib/security/$ISA/pam_krb5.so use_first_pass
> auth required /lib/security/$ISA/pam_deny.so
> =
=20
> account required /lib/security/$ISA/pam_unix.so
> account [default=3Dbad success=3Dok user_unknown=3Dignore service_err=
=3Dignore system_err=3Dignore] /lib/security/$ISA/pam_krb5.so
> =
=20
> password required /lib/security/$ISA/pam_cracklib.so retry=3D3 ty=
pe=3D
> password sufficient /lib/security/$ISA/pam_unix.so nullok use_autht=
ok md5 shadow
> password sufficient /lib/security/$ISA/pam_krb5.so use_authtok
> password required /lib/security/$ISA/pam_deny.so
> =
=20
> session sufficient /lib/security/$ISA/pam_mkhomedir.so skel=3D/etc=
/skel/ umask=3D0077
> session required /lib/security/$ISA/pam_limits.so
> session required /lib/security/$ISA/pam_unix.so
> session optional /lib/security/$ISA/pam_krb5.so
>=20
> The biggest difference that I see is the account and session lines. We r=
equire pam_unix.so first. This is because the account information (ie who =
are you, what is your uidnumber, what is your home directory, etc) is not s=
tored in kerberos, but locally. (Actually, its stored in LDAP but the loca=
l nsswitch knows to look in there, pam doesn't know about all of that here).
>=20
>=20
>=20
> -----Original Message-----
> From: kerberos-bounces@mit.edu on behalf of Rachel Elizabeth Dillon
> Sent: Fri 10/8/2004 1:12 PM
> To: kerberos@mit.edu
> Subject: PAM and GSSAPI SSH authentication conflict
> =20
> I am building a network that uses Kerberos for authentication. The origin=
al
> plan was to have a single bastion host to which users sshed, and logged in
> using their Kerberos password. From that bastion host, users could then=
=20
> ssh to any other machine on the network, authenticatning via forwardable
> Kerberos tickets and GSSAPI. I had this working. But, as always happens
> with these things, requirements changed.
>=20
> I am currently evaluating the feasibility of having every machine on the
> network accept either Kerberos tickets or a Kerberos password as an
> authentication mechanism. I believe that this _should_ work, but I haven't
> been able to make it work. I have the following lines in /etc/pam.conf :
>=20
> ssh auth required pam_krb5.so.1 try_first_pass=20
> ssh account required pam_krb5.so.1=20
> ssh session required pam_krb5.so.1=20
> ssh password required pam_krb5.so.1 try_first_pass
>=20
> If I comment these lines out, I get authentication just fine without
> tickets but, unsurprisingly, no password-based authentication via PAM.
> With the lines in place, if I ssh in with appropriate Kerberos tickets,
> I get a host ticket but the following error in sshd -d -d -d :
>=20
> debug1: userauth-request for user ptadmin service ssh-connection method e=
xternal-keyx
> debug1: attempt 1 failures 1
> debug2: input_userauth_request: try method external-keyx
> Authorized to ptadmin, krb5 principal ptadmin@IC.COM (krb5_kuserok)
> debug2: pam_acct_mgmt() =3D 17
> PAM rejected by account configuration[17]: User account has expired
>=20
> To the best of my knowledge the account is not expired, since it can log=
=20
> in just fine either with its Kerberos password or with those lines commen=
ted
> out. I tried googling on this phrase and found a variety of errors related
> to password expiry (reasonable), but this user account does not even _hav=
e_=20
> a local password; no accounts do in our system. I would expect Solaris to
> do the right thing and not count them as expired passwords in this case, =
but
> maybe PAM gets tripped up? I'm not sure.
>=20
> Anyway, any help would be appreciated. I'm using stock Debian OpenSSH 3.6,
> except recompiled for Solaris.
>=20
> Thanks!
>=20
> -r.
>=20
--djJN5oi3zFpblwUd
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFBZueUrAG/UVUP/b0RAmQKAJ9UFb/429v00ALUU91gmDEYlLlG8QCdEoIf
NX/O4U+uYKQs3QiiTqxSvcI=
=hcGA
-----END PGP SIGNATURE-----
--djJN5oi3zFpblwUd--
--===============83993675362433917==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============83993675362433917==--
