Kerberos SSH Login

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP








up vote
0
down vote

favorite












I'm trying to setup a



  • ssh server

  • ssh client

  • kerberos server

Now, on both the SSH server and client I can poll a ticket by calling, kinit -p root/admin.



In SSH/SSHD config I set



  • GSSAPIAuthentication yes

  • GSSAPICleanupCredentials yes

  • GSSAPIDelegateCredentials yes

Now when I try from client to ssh to the ssh-server I'm still prompted about password, why is that?



$ ssh -vv sshserver
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: 
<implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: 
<implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 
SHA256:71jU1n0c5M2uGF1RA37xc5ktz7CVmq2lqztrM+0ApX8
debug1: Host 'sshserver.kea.dk' is known and matches the ECDSA host key.
debug1: Found key in /home/ghost/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug2: key: /home/ghost/.ssh/id_rsa (0x564e5774b270)
debug2: key: /home/ghost/.ssh/id_dsa ((nil))
debug2: key: /home/ghost/.ssh/id_ecdsa ((nil))
debug2: key: /home/ghost/.ssh/id_ed25519 ((nil))
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug1: Next authentication method: gssapi-with-mic
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/ghost/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg rsa-sha2-512 blen 535
debug2: input_userauth_pk_ok: fp 
SHA256:V731Bh8CcX3x80tGJcwqsSBOo0wZbq2iIFc+ZHnyadg
debug1: Trying private key: /home/ghost/.ssh/id_dsa
debug1: Trying private key: /home/ghost/.ssh/id_ecdsa
debug1: Trying private key: /home/ghost/.ssh/id_ed25519
 debug2: we did not send a packet, disable method
debug1: Next authentication method: password



networking server ssh kerberos




share|improve this question






















  • Did you add a service principal for sshd to your kerberos database?
    – Sebastian Stark
    May 22 at 7:29











  • I think I did when I made the key for the ssh server? When doing listprincs it shows ssh/mykerberos.kea.dk@MYKERBEROS.KEA.DK
    – MrSykkox
    May 22 at 9:01











  • Are you using the exact same hostname for the ssh command line like shown in listprincs? That would have to be "ssh mykerberos.kea.dk"
    – Sebastian Stark
    May 27 at 12:35














up vote
0
down vote

favorite












I'm trying to setup a



  • ssh server

  • ssh client

  • kerberos server

Now, on both the SSH server and client I can poll a ticket by calling, kinit -p root/admin.



In SSH/SSHD config I set



  • GSSAPIAuthentication yes

  • GSSAPICleanupCredentials yes

  • GSSAPIDelegateCredentials yes

Now when I try from client to ssh to the ssh-server I'm still prompted about password, why is that?



$ ssh -vv sshserver
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: 
<implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: 
<implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 
SHA256:71jU1n0c5M2uGF1RA37xc5ktz7CVmq2lqztrM+0ApX8
debug1: Host 'sshserver.kea.dk' is known and matches the ECDSA host key.
debug1: Found key in /home/ghost/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug2: key: /home/ghost/.ssh/id_rsa (0x564e5774b270)
debug2: key: /home/ghost/.ssh/id_dsa ((nil))
debug2: key: /home/ghost/.ssh/id_ecdsa ((nil))
debug2: key: /home/ghost/.ssh/id_ed25519 ((nil))
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug1: Next authentication method: gssapi-with-mic
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/ghost/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg rsa-sha2-512 blen 535
debug2: input_userauth_pk_ok: fp 
SHA256:V731Bh8CcX3x80tGJcwqsSBOo0wZbq2iIFc+ZHnyadg
debug1: Trying private key: /home/ghost/.ssh/id_dsa
debug1: Trying private key: /home/ghost/.ssh/id_ecdsa
debug1: Trying private key: /home/ghost/.ssh/id_ed25519
 debug2: we did not send a packet, disable method
debug1: Next authentication method: password



networking server ssh kerberos




share|improve this question






















  • Did you add a service principal for sshd to your kerberos database?
    – Sebastian Stark
    May 22 at 7:29











  • I think I did when I made the key for the ssh server? When doing listprincs it shows ssh/mykerberos.kea.dk@MYKERBEROS.KEA.DK
    – MrSykkox
    May 22 at 9:01











  • Are you using the exact same hostname for the ssh command line like shown in listprincs? That would have to be "ssh mykerberos.kea.dk"
    – Sebastian Stark
    May 27 at 12:35












up vote
0
down vote

favorite









up vote
0
down vote

favorite











I'm trying to setup a



  • ssh server

  • ssh client

  • kerberos server

Now, on both the SSH server and client I can poll a ticket by calling, kinit -p root/admin.



In SSH/SSHD config I set



  • GSSAPIAuthentication yes

  • GSSAPICleanupCredentials yes

  • GSSAPIDelegateCredentials yes

Now when I try from client to ssh to the ssh-server I'm still prompted about password, why is that?



$ ssh -vv sshserver
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: 
<implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: 
<implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 
SHA256:71jU1n0c5M2uGF1RA37xc5ktz7CVmq2lqztrM+0ApX8
debug1: Host 'sshserver.kea.dk' is known and matches the ECDSA host key.
debug1: Found key in /home/ghost/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug2: key: /home/ghost/.ssh/id_rsa (0x564e5774b270)
debug2: key: /home/ghost/.ssh/id_dsa ((nil))
debug2: key: /home/ghost/.ssh/id_ecdsa ((nil))
debug2: key: /home/ghost/.ssh/id_ed25519 ((nil))
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug1: Next authentication method: gssapi-with-mic
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/ghost/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg rsa-sha2-512 blen 535
debug2: input_userauth_pk_ok: fp 
SHA256:V731Bh8CcX3x80tGJcwqsSBOo0wZbq2iIFc+ZHnyadg
debug1: Trying private key: /home/ghost/.ssh/id_dsa
debug1: Trying private key: /home/ghost/.ssh/id_ecdsa
debug1: Trying private key: /home/ghost/.ssh/id_ed25519
 debug2: we did not send a packet, disable method
debug1: Next authentication method: password



networking server ssh kerberos




share|improve this question














I'm trying to setup a



  • ssh server

  • ssh client

  • kerberos server

Now, on both the SSH server and client I can poll a ticket by calling, kinit -p root/admin.



In SSH/SSHD config I set



  • GSSAPIAuthentication yes

  • GSSAPICleanupCredentials yes

  • GSSAPIDelegateCredentials yes

Now when I try from client to ssh to the ssh-server I'm still prompted about password, why is that?



$ ssh -vv sshserver
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: 
<implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: 
<implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 
SHA256:71jU1n0c5M2uGF1RA37xc5ktz7CVmq2lqztrM+0ApX8
debug1: Host 'sshserver.kea.dk' is known and matches the ECDSA host key.
debug1: Found key in /home/ghost/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug2: key: /home/ghost/.ssh/id_rsa (0x564e5774b270)
debug2: key: /home/ghost/.ssh/id_dsa ((nil))
debug2: key: /home/ghost/.ssh/id_ecdsa ((nil))
debug2: key: /home/ghost/.ssh/id_ed25519 ((nil))
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug1: Next authentication method: gssapi-with-mic
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/ghost/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg rsa-sha2-512 blen 535
debug2: input_userauth_pk_ok: fp 
SHA256:V731Bh8CcX3x80tGJcwqsSBOo0wZbq2iIFc+ZHnyadg
debug1: Trying private key: /home/ghost/.ssh/id_dsa
debug1: Trying private key: /home/ghost/.ssh/id_ecdsa
debug1: Trying private key: /home/ghost/.ssh/id_ed25519
 debug2: we did not send a packet, disable method
debug1: Next authentication method: password




networking server ssh kerberos





share|improve this question













share|improve this question




share|improve this question








edited May 21 at 0:53









ubashu

2,23221736




2,23221736










asked May 20 at 20:56









MrSykkox

1012




1012











  • Did you add a service principal for sshd to your kerberos database?
    – Sebastian Stark
    May 22 at 7:29











  • I think I did when I made the key for the ssh server? When doing listprincs it shows ssh/mykerberos.kea.dk@MYKERBEROS.KEA.DK
    – MrSykkox
    May 22 at 9:01











  • Are you using the exact same hostname for the ssh command line like shown in listprincs? That would have to be "ssh mykerberos.kea.dk"
    – Sebastian Stark
    May 27 at 12:35
















  • Did you add a service principal for sshd to your kerberos database?
    – Sebastian Stark
    May 22 at 7:29











  • I think I did when I made the key for the ssh server? When doing listprincs it shows ssh/mykerberos.kea.dk@MYKERBEROS.KEA.DK
    – MrSykkox
    May 22 at 9:01











  • Are you using the exact same hostname for the ssh command line like shown in listprincs? That would have to be "ssh mykerberos.kea.dk"
    – Sebastian Stark
    May 27 at 12:35















Did you add a service principal for sshd to your kerberos database?
– Sebastian Stark
May 22 at 7:29





Did you add a service principal for sshd to your kerberos database?
– Sebastian Stark
May 22 at 7:29













I think I did when I made the key for the ssh server? When doing listprincs it shows ssh/mykerberos.kea.dk@MYKERBEROS.KEA.DK
– MrSykkox
May 22 at 9:01





I think I did when I made the key for the ssh server? When doing listprincs it shows ssh/mykerberos.kea.dk@MYKERBEROS.KEA.DK
– MrSykkox
May 22 at 9:01













Are you using the exact same hostname for the ssh command line like shown in listprincs? That would have to be "ssh mykerberos.kea.dk"
– Sebastian Stark
May 27 at 12:35




Are you using the exact same hostname for the ssh command line like shown in listprincs? That would have to be "ssh mykerberos.kea.dk"
– Sebastian Stark
May 27 at 12:35















active

oldest

votes











Your Answer







StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "89"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);








 

draft saved


draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1038484%2fkerberos-ssh-login%23new-answer', 'question_page');

);

Post as a guest






















active

oldest

votes













active

oldest

votes









active

oldest

votes






active

oldest

votes










 

draft saved


draft discarded


























 


draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1038484%2fkerberos-ssh-login%23new-answer', 'question_page');

);

Post as a guest
































































-

Popular posts from this blog

Which professions warranted travel in Medieval times?

Image
Clash Royale CLAN TAG #URR8PPP up vote 54 down vote favorite 15 I'm trying to come up with characters whose backgrounds allow them to have homes, histories, and skills, but will still enable or encourage them to travel in a typical medieval setting. I've never really liked "Adventurer" as a job, and would like my story to have a kind of unlikely-hero vibe. besides the common "Traveling merchant", what kinds of artisans or professionals in fantasy would have a reason to move around the world (or at least visit other settlements)? First time posting, so let me know what to improve. Thanks! EDIT: When I say traveling, I was thinking someone who spends multiple days/weeks/months away from their place of origin as they go elsewhere for their business, or to gather materials for it. medieval travel share | improve this question edited Aug 1 at 15:16 asked Aug 1 at 15:07 Julia Witham 279 2 7 11 Please ...
Read more

How do so many people here on Academia.SE, and in general, afford lavish higher education programs?

Image
Clash Royale CLAN TAG #URR8PPP up vote 45 down vote favorite 7 I graduated last year with a BS in Computer Science. I do not come from a particularly wealthy family, (very low middle class), and was only able to afford my education via school loans/scholarships and working low-wage jobs, with no support from my family or anyone else. I realize some scholarship/loan programs extend into grad school. But I don't think those cover all costs. Now I'm lucky enough to have a decent-paying salary in industry, along with benefits and living on my own, and I'm thinking one day (sooner rather than later) I'd like to try my hand at research or continue my degree, but these things cost money, in addition to my regular living expenses. I read posts here often about academic people being in positions of choosing between these crazy research grad programs, some in Japan, or Ireland (while they currently live in the U.S./U.K.) then moving around between countries/universit...
Read more

Trouble downloading packages list due to a “Hash sum mismatch” error

Image
Clash Royale CLAN TAG #URR8PPP .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0; up vote 331 down vote favorite 117 When I check for updates, I get a "Failed To Download Repository Information" error. This is what comes up under details: W: Failed to fetch gzip:/var/lib/apt/lists/partial/us.archive.ubuntu.com_ubuntu_dists_natty_main_source_Sources Hash Sum mismatch, E: Some index files failed to download. They have been ignored, or old ones used instead. apt share | improve this question edited Nov 12 '14 at 23:37 Braiam 49.5k 19 130 210 asked May 9 '11 at 20:55 Rob 5,300 10 26 40 add a comment  |  up vote 331 down vote favorite 117 When I check for updates, I get a "Failed To Download Repository Information" error. This is what comes up under details: W: Failed to fetch gzip:/var/lib/apt/lists/partial/us.archive.ubuntu.com_ubuntu_dists_nat...
Read more