SSH as root with different principal

[Lukas Kubin]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 31 Jul 2003, Vladimir Terziev wrote:

>
>   Please supply the full debug output from `ssh -v' and I'll try to figure out the problem.
>
>
> 	Vlady

OK, thank you. The output follows:

OpenSSH_3.6.1p2 Debian_krb5 3.6.1p2-1 Debian_krb5 3.6.1p2-1 Debian_krb5
3.6.1p2-1, SSH protocols 1.5/2.0, OpenSSL 0x0090702f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Rhosts Authentication disabled, originating port will not be
trusted.
debug1: Connecting to <deleted> [<deleted>] port 22.
debug1: Connection established.
debug1: identity file /home/lukas/.ssh/identity type -1
debug1: identity file /home/lukas/.ssh/id_rsa type 1
debug1: identity file /home/lukas/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_3.4p1
Debian_krb5 3.4p1-0woody1
debug1: match: OpenSSH_3.4p1 Debian_krb5 3.4p1-0woody1 pat
OpenSSH_3.2*,OpenSSH_3.3*,OpenSSH_3.4*,OpenSSH_3.5*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.6.1p2 Debian_krb5 3.6.1p2-1
Debian_krb5 3.6.1p2-1 Debian_krb5 3.6.1p2-1
debug1: Mechanism encoded as toWM5Slw5Ew8Mqkay+al2g==
debug1: Mechanism encoded as A/vxljAEU54gt9a48EiANQ==
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '<deleted>' is known and matches the RSA host key.
debug1: Found key in /home/lukas/.ssh/known_hosts:19
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue:
external-keyx,gssapi,publickey,password,keyboard-interactive
debug1: Next authentication method: external-keyx
debug1: Authentications that can continue:
external-keyx,gssapi,publickey,password,keyboard-interactive
debug1: Next authentication method: gssapi
debug1: Authentications that can continue:
external-keyx,gssapi,publickey,password,keyboard-interactive
debug1: Authentications that can continue:
external-keyx,gssapi,publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /home/lukas/.ssh/identity
debug1: Offering public key: /home/lukas/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 149 lastkey 0x808bb28 hint
1
debug1: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>
Enter passphrase for key '/home/lukas/.ssh/id_rsa':
debug1: Trying private key: /home/lukas/.ssh/id_dsa
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue:
external-keyx,gssapi,publickey,password,keyboard-interactive
debug1: Next authentication method: password
root@<deleted>'s password:
debug1: Authentications that can continue:
external-keyx,gssapi,publickey,password,keyboard-interactive
Permission denied, please try again.
root@<deleted>'s password:
debug1: Authentications that can continue:
external-keyx,gssapi,publickey,password,keyboard-interactive
Permission denied, please try again.
root@<deleted>'s password:
Received disconnect from <deleted>: 2: Too many authentication failures
for root
debug1: Calling cleanup 0x8061400(0x0)


>
> On Thu, 31 Jul 2003 09:37:29 +0200 (CEST)
> Lukas Kubin <kubin at opf.slu.cz> wrote:
>
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > I tried it but it didn't work. I have
> >
> > 1. created .k5login file in the root's home at remote server and put
> > myrealusernam at MYREALM there
> > 2. used the command "ssh -v root at theremoteserver"
> >
> > But the server still wants me to authenticate using public key or password
> > only. This is part of what it returned with the "-v" option:
> >
> > ==========
> > debug1: Authentications that can continue:
> > external-keyx,gssapi,publickey,password,keyboard-interactive
> > debug1: Next authentication method: external-keyx
> > debug1: Authentications that can continue:
> > external-keyx,gssapi,publickey,password,keyboard-interactive
> > debug1: Next authentication method: gssapi
> > debug1: Authentications that can continue:
> > external-keyx,gssapi,publickey,password,keyboard-interactive
> > debug1: Authentications that can continue:
> > external-keyx,gssapi,publickey,password,keyboard-interactive
> > debug1: Next authentication method: publickey
> > ==========
> >
> > Both server and client are Debian Linux with kerberized OpenSSH (from the
> > supplied package).
> > What should I try next to make it work?
> > Thank you.
> >
> > lukas
> >
> > On Wed, 30 Jul 2003, Steve Langasek wrote:
> >
> > > On Wed, Jul 30, 2003 at 04:00:28PM +0200, Lukas Kubin wrote:
> > >
> > > > How can I login through SSH to administer a remote server? I mean, I have
> > > > a principal, say "user" and need to authenticate using kerberized SSH to
> > > > become root on the remote server.
> > > > Thank you.
> > >
> > > If using gssapi or krb5 authentication, you would add that principal to
> > > root's .k5login file; acquire a TGT for that user; and run
> > > 'ssh root at server' or 'ssh -l root server'.  This will grant you
> > > Kerberos-based access to the root account.
> > >
> > > --
> > > Steve Langasek
> > > postmodern programmer
> > >
> > >
> >
> > - --
> > Lukas Kubin
> >
> > phone: +420596398285
> > email: kubin at opf.slu.cz
> >
> > Information centre
> > The School of Business Administration in Karvina
> > Silesian University in Opava
> > Czech Republic
> > http://www.opf.slu.cz
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.2.1 (GNU/Linux)
> > Comment: Made with pgp4pine 1.75-6
> >
> > iD8DBQE/KMc/hukdIiZrwu4RAsoAAJ9c2ECgX0L+gobc+mfESo8Y1K6YjwCgigGu
> > 1zdOgKB73w3pXr5yeLvhkjc=
> > =uLna
> > -----END PGP SIGNATURE-----
> >
> >
> > ________________________________________________
> > Kerberos mailing list           Kerberos at mit.edu
> > https://mailman.mit.edu/mailman/listinfo/kerberos
> >
> >
>
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>

- -- 
Lukas Kubin

phone: +420596398285
email: kubin at opf.slu.cz

Information centre
The School of Business Administration in Karvina
Silesian University in Opava
Czech Republic
http://www.opf.slu.cz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Made with pgp4pine 1.75-6

iD8DBQE/KOJ7hukdIiZrwu4RAqRtAKCD/Y7mRUxRoA6umGKiA5vRTHEcggCeKYdh
15vZufrH48MITRw8CDIz8Js=
=AyBM
-----END PGP SIGNATURE-----