pam_krb5 does not get credentials when using ssh

[Douglas E. Engert]

Andrew Bovill wrote:
> On Wed, 08 Nov 2006 06:06:34 +0000, Andrew Bovill wrote:
> 
> 
>>pam_krb5 gives credentials (using a 'random' cache) just fine when loging
>>in on the local machine. However, if I log in over ssh, it does not get
>>the krb5 tickets, though it authenticates off kerberos just fine. I am
>>appending my pam config for system authentication:
> 
> 
> I forgot to mention, the sshd server I'm using is kerberized:
> OpenSSH_4.4p1, OpenSSL 0.9.8d 28 Sep 2006 with kerberos support.
> 

On what OS?

Which pam_krb5? There are a few different versions with different options.

Something to keep in mind:

  *  KerberosAuthentication yes, KerberosOrLocalPasswd yes and
     KerberosTicketCleanup yes all apply to password authentication,
     where sshd calls kerberos directly. (You may not want this.)

  *  Keyboard interactive is handled by PAM, that can use Kerberos
     if pam_krb5 is successful. (Preffered method.)

  *  GSSAPI authentication is using kerberos tickets, and sshd
     will call the pam session routines so as to handle delegated
     credentials, i.e. forwarded tickets.

  * Some sshd implementaitons will uss a different pam service name
    depending on the method used. I don't think OpenSSH-4.x does.

So there are two seperate paths to consider, keyboard-interactive
for passwords, and gssapi-with-mic for Kerberos ticket authenticaiton.

With keyboard-interactive, privsep may get in the way. If your pam_krb5
has a force type option, to store the tickets during pam_sm_authenticate,
rather the pam_sm_setcreds. give that a try.

With gssapi-with-mic, sshd store any delegated credentials (i.e. ssh_config
or user had set GSSAPIDelegateCredentials yes) and set KRB5CCNAME
in the pam_env, and call the pam_open_session. (This is where AFS could
use these, but you are not using AFS.) In you case there is nothing
to do.

> --Andrew
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
> 
> 

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444