Solaris 10 sshd + GSSAPI = where's my cred cache?

Jeff Blaine jblaine at kickflop.net
Mon Nov 5 11:31:57 EST 2007


Nicolas et al,

==== SSHD server ====================================================

~:alberta> uname -a
SunOS alberta.foo.com 5.10 Generic_127111-01 sun4u sparc SUNW,Ultra-5_10
~:alberta>

~:alberta> sudo /usr/lib/ssh/sshd -p 3333 -o
"GSSAPIStoreDelegatedCredentials yes" -o "GSSAPIKeyExchange yes" -o
"GSSAPIAuthentication yes" -ddd

==== SSH client =====================================================

~:rcf-kerbtest-linux> grep GSSAPI /etc/ssh/ssh_config
         GSSAPIAuthentication yes
~:rcf-kerbtest-linux> ls .ssh/config
ls: .ssh/config: No such file or directory
~:rcf-kerbtest-linux> /usr/kerberos/bin/klist -f
Ticket cache: FILE:/tmp/krb5cc_26560_XM0qlu
Default principal: jblaine at RCF.FOO.COM

Valid starting     Expires            Service principal
11/01/07 14:30:02  11/08/07 13:30:02  krbtgt/RCF.FOO.COM at RCF.FOO.COM
         Flags: FI
11/01/07 14:30:02  11/08/07 13:30:02  afs at RCF.FOO.COM
         Flags: FT
11/01/07 14:30:27  11/08/07 13:30:02  host/alberta.foo.com at RCF.FOO.COM
         Flags: FT


Kerberos 4 ticket cache: /tmp/tkt26560
klist: You have no tickets cached
~:rcf-kerbtest-linux> /usr/bin/ssh -p 3333 alberta
Last login: Mon Nov  5 11:15:47 2007 from rcf-kerbtest-li
...
~:alberta> /usr/bin/klist
klist: No credentials cache file found (ticket cache FILE:/tmp/krb5cc_26560)
~:alberta>

==== SSHD server reports =======================================
...
debug1: userauth-request for user jblaine service ssh-connection method 
gssapi-with-mic
debug1: attempt 1 initial attempt 0 failures 1 initial failures 0
debug2: input_userauth_request: try method gssapi-with-mic
debug1: Client offered gssapi userauth with { 1 2 840 113554 1 2 2 } 
(supported)
debug2: Mapping initiator GSS-API principal to local username
debug2: Mapped the initiator to: jblaine
debug2: Starting PAM service sshd-gssapi for method gssapi-with-mic
debug3: Trying to reverse map address xxx.xx.11.213.
debug3: Not storing delegated GSS credentials (none delegated)
Accepted gssapi-with-mic for jblaine from xxx.xx.11.213 port 41605 ssh2
...




More information about the Kerberos mailing list