[29769] in Kerberos
Re: Is a Kerberos principal always a DNS name?
daemon@ATHENA.MIT.EDU (Simon Wilkinson)
Sat Apr 26 05:30:52 2008
In-Reply-To: <24749.1209093794@malison.ait.iastate.edu>
Mime-Version: 1.0 (Apple Message framework v753)
Message-Id: <F04A4234-D717-4E9D-9C7B-31AAE15738F3@sxw.org.uk>
From: Simon Wilkinson <simon@sxw.org.uk>
Date: Sat, 26 Apr 2008 10:28:57 +0100
To: John Hascall <john@iastate.edu>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 25 Apr 2008, at 04:23, John Hascall wrote:
>
>
>> If we take for example an sshd server on a typical Unix host, how
>> does
>> it figure out its own principal name? Suppose it has keys for
>> multiple principals in the keytab, which one would it choose?
>
> I can't speak for how sshd does it,
I can - certainly for OpenSSH.
If you're using out of the box OpenSSH, then it ties the acceptor
principal to being host/fqdn, where the FQDN is the fully qualified
domain name version of the machine's hostname.
With my patches, turning off the GSSAPIStrictAcceptorCheck option
will let it use any principal in the default keytab. SSH is a GSSAPI
protocol, so this is implemented at the GSSAPI, rather than kerberos,
API level (by using GSS_C_NO_CREDENTIALS for the server principal
when calling accept_sec_context). It doesn't currently do the final
step, of making sure that the chosen acceptors service name is
'host' - because there's no method exposed in the current GSSAPI
which will let you do so in a mechanism independent manner.
Simon.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
