[22788] in Kerberos
Re: problem setting up ssh-krb5 from Debian Sarge
daemon@ATHENA.MIT.EDU (Christopher D. Clausen)
Fri Oct 29 20:48:28 2004
Message-ID: <036e01c4be19$eb601920$1909000a@ad.uiuc.edu>
From: "Christopher D. Clausen" <cclausen@acm.org>
To: <kerberos@mit.edu>
Date: Fri, 29 Oct 2004 19:46:37 -0500
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=original
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Wes Chow wrote:
> After all that, I now have an AFS question. I'm not sure whether I
> should ask the question here or on the OpenAFS list, as it seems at
> least to me that it's a Kerberos ticket forwarding problem.
>
> I have PAM and OpenAFS working (/etc/pam.d/common-auth excerpt):
>
> auth [success=ok default=1] pam_krb5.so forwardable
> auth [default=done] pam_openafs_session.so debug
>
> wchow@jack's password:
> Linux jack 2.4.27-acr-afs64 #1 SMP Wed Oct 27 14:40:19 EDT 2004 i686
> GNU/Linux
> wchow@jack:~$ klist
> Ticket cache: FILE:/tmp/krb5cc_iCScnU
> Default principal: wchow@D2702.ATHENACR.COM
>
> Valid starting Expires Service principal
> 10/29/04 18:33:39 10/30/04 04:33:39
> host/jack.dev.in.athenacr.com@D2702.ATHENACR.COM
> 10/29/04 18:33:39 10/30/04 04:33:39
> krbtgt/D2702.ATHENACR.COM@D2702.ATHENACR.COM
> 10/29/04 18:33:39 10/30/04 04:33:39
> afs/d2702.athenacr.com@D2702.ATHENACR.COM
>
> wchow@jack:~$ tokens
>
> Tokens held by the Cache Manager:
>
> User's (AFS ID 1000) tokens for afs@d2702.athenacr.com [Expires Oct 30
> 04:33]
> --End of list--
>
> Then, from jack (which has a kerberized ssh installation), I try to
> ssh into itself:
>
>
> wchow@jack:~$ ssh -K jack
> Linux jack 2.4.27-acr-afs64 #1 SMP Wed Oct 27 14:40:19 EDT 2004
> i686 GNU/Linux
Well, check your /etc/hosts file. I believe that Debian puts the
hostname on the 127.0.0.1 line. This is not good.
You want to do something like this:
[cclausen@clortho:/]% cat /etc/hosts
127.0.0.1 localhost
128.174.251.6 clortho.acm.uiuc.edu clortho
128.174.251.37 enzo.acm.uiuc.edu enzo
Or else you'll end up with Kerberos trying to get tickets for localhost
and the KDC as well as the client libraries will get confused as to
which machine is "localhost."
> The Kerberos tickets were forwarded correctly, but the AFS ticket was
> not. Is this a problem with my ssh-krb5 installation, or should I be
> asking the OpenAFS list about this?
You probably should be asking this question on the OpenAFS list, but
there are many who read both.
> Looking at my /var/log/auth.log output, it looks as if the "ssh -K
> jack" command skips pam completely:
PAM should not be skipped, even when using credential forwarding.
> Why is it that AFS tickets aren't being forwarded?
AFS tokens are NOT forwarded through SSH. Instead, you would use your
forwarded Kerberos tickets to obtain AFS tokens on the remote machine.
(Usually via PAM, although several sites have modified the OpenSSH
code.)
You have libpam-openafs-session installed. Are you using it as a
session module also?
session required pam_openafs_session.so
This could also be a problem with Kerberos tickets not being
"forwardable."
Please show output from klist -f:
[cclausen@clortho:/]% klist -f
Ticket cache: FILE:/tmp/krb5cc_3qzSel
Default principal: cclausen@ACM.UIUC.EDU
Valid starting Expires Service principal
10/29/04 13:35:04 10/29/04 23:35:02 krbtgt/ACM.UIUC.EDU@ACM.UIUC.EDU
Flags: FPI
10/29/04 13:35:08 10/29/04 23:35:02 afs/acm.uiuc.edu@ACM.UIUC.EDU
Flags: FPT
The 'F' means that the ticket is forwardable. If your tickets are not
forwardable they will only be used for authentication and not actually
be available in your ccache on the remote machine.
It looks like your tickets are being forwarded though, so its probably
just the session PAM config for pam_openafs_session.
<<CDC
Christopher D. Clausen
ACM@UIUC SysAdmin
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
