[23272] in Kerberos
Re: cross-realm logins with ssh & pam_krb5
daemon@ATHENA.MIT.EDU (Troy Benjegerdes)
Fri Jan 28 12:59:34 2005
Date: Fri, 28 Jan 2005 11:58:50 -0600
From: Troy Benjegerdes <hozer@hozed.org>
To: "Douglas E. Engert" <deengert@anl.gov>
Message-ID: <20050128175850.GE9768@kalmia.hozed.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
In-Reply-To: <41FA7114.1000503@anl.gov>
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Fri, Jan 28, 2005 at 11:06:28AM -0600, Douglas E. Engert wrote:
>
>
> Troy Benjegerdes wrote:
>
> >I want to allow users from two different realms to be able to log into a
> >machine via ssh using the pam_krb5 kerboard-interactive authentication
> >method.
> >
> >Is there a pam_krb5 module that supports this? Ideally, I'd like to
> >default to REALM1, and users from realm1 would do
> >"ssh -l user@REALM2 login-machine", and if they had a valid account,
> >they could get logged in. For the moment, let's just deal with the case
> >where
> >the principal name is the same as the login name.
> >
> >How can I get this to work... I don't think pam/linux is quite happy
> >with usernames of the form "user@REALM", which would be nice, but maybe
> >messy.
>
> Its really an SSH deficiency. They check the username for validity
> before calling PAM, and will not allow PAM to change the username.
>
> In auth2.c in input_userauth_request()
>
> They get the user and strip off anything after a :
> then call getpwnamallow(user)
>
> So they don't give PAM a chance to parse the username, and
> to change it something else.
> They also make sure later the user name has not changed
> and print out
> "Change of username or service not allowed:"
So, does the current openssh-3.8 work right with pam and/or afs with
privledge separation turned on? My other wishlist item for ssh is
support for changing expired kerberos passwords.. has anyone gotten this
working?
Are there any other SSH implementations that have GSSAPI support?
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
