[33464] in Kerberos
Re: Help: OpenSSH cannot login by Kerberos
daemon@ATHENA.MIT.EDU (Brian Candler)
Sat Jun 11 13:09:34 2011
Date: Sat, 11 Jun 2011 18:09:23 +0100
From: Brian Candler <B.Candler@pobox.com>
To: Lee Eric <openlinuxsource@gmail.com>
Message-ID: <20110611170923.GB2656@talktalkplc.com>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <BANLkTinbqPeA4e1tBFMKu9_zBrxeHGY=Zw@mail.gmail.com>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Sat, Jun 11, 2011 at 02:18:57PM +0800, Lee Eric wrote:
> # Kerberos options
> KerberosAuthentication yes
Aside: note that you almost certainly don't want this.
"KerberosAuthentication" means "cleartext password authentication, checking
the password against the KDC"
To authenticate people using their Kerberos ticket you need:
> GSSAPIAuthentication yes
(which you already have), and preferably also:
GSSAPIKeyExchange yes
(this is a second form of ssh Kerberos authentication which takes advantage
of Kerberos mutual authentication, to authenticate the server to the client
as well as the client to the server. It means you don't need the known_hosts
file, and the user is never prompted whether or not to accept the host key
fingerprint when first connecting)
> UsePAM yes
You probably don't want that, unless you're also authenticating against PAM
in the event that Kerberos fails.
> And on client side, I'm getting the principle of the user huli then
> try to login.
> debug3: Not a RSA1 key file /root/.ssh/id_rsa.
> debug2: key_type_from_name: unknown key type '-----BEGIN'
That's broken; you should rm that file (or mv it out of the way). You can't
use a PGP key or an X509-style private key as an SSH key.
Regards,
Brian.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
