[23363] in Kerberos
Problem with MIT Kerberos v1.4, OpenSSH 3.9p1 and Active Directory
daemon@ATHENA.MIT.EDU (Sam Evans)
Thu Feb 10 13:12:48 2005
Date: Thu, 10 Feb 2005 10:53:26 -0700
From: Sam Evans <wintrmte@gmail.com>
Message-ID: <O7ydnbDoZtM7ApbfRVn-ug@giganews.com>
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
All:
I seem to have run into a road block getting my Linux machines to
authenticate against AD when coming in through OpenSSH.
First, let me start off my listing what my environmnet is:
Test Client:
* RHEL Linux
* MIT Kerboros v1.4
* OpenSSH v3.9p1 - Compiled using the following line:
./configure --with-tcp-wrappers --with-pam
--with-kerberos5=/usr/kerberos --with-md5-passwords --prefix=/usr
--sysconfdir=/etc/ssh
Active Directory:
* Windows 2003
Scenario 1:
If I use my local account and password, I can get into the machine OK. I
know that OpenSSH is functioning properly. At this point, if I do a
'kinit' I can successfully authenticate myself against AD and obtain my
Keberos5 ticket.
Scenario 2:
If I change my account information to require that authentication take
place using Kerberos, then I get the following error from the ssh daemon:
debug1: Kerberos password authentication failed: ASN.1 encoding ended
unexpectedly
-- What I have been able to determine at this point is that if I remove
my userid from the multitude of groups that it belongs to in AD, then I
*can* successfully authenticate myself when I come in through OpenSSH,
using Kerberos.
-- If I place myself back into the same groups, I cannot authenticate
myself and get the above error.
In doing some reading, it appears as if I need to force TCP usage in the
MIT Kerberos, which I have done. Everything still works when I do
'kinit' but nothing has changed in regards to OpenSSH authentication
ability.
Anyone have any thoughts or suggestions?
Thanks,
Sam
P
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
