openssh unix dev - Oct 2003 - kerberos + gssapi password change

Hello 

I am not a developer, but since this is a more advanced issue I rather 
post to this list than to the users list, I hope this is OK.

We are currently running openssh with simon's gssapi patch and want to 
move towards the new integrated solution with openssh-3.7.1p2. A problem 
we experienced in both versions of openssh is that we are not able to 
change the kerberos password, when it expires. I used James'  patch but it 
seemed to not work well with simon's gssapi patch and as such we decided 
not to integrate it. James told me that he believes password change is now 
working with the changes, but I am unable to get it working and am 
wondering if this is a known limitation still and if you are planning to 
work on this issue in the future if it is still an issue.

Another oddness I experience 


Cheers

IBM Global Services - New Zealand Linux Team
Linux Infrastructure project
Office: +64-9-359-8761
email: girardet at nz1.ibm.com
13-17 Dundonald Street, Newton, Auckland, New Zealand





###########################################
from sshd -ddd

ebug3: ssh_msg_recv entering
debug3: ssh_msg_send: type 7
PAM: Authentication token is no longer valid; new one required.
debug3: mm_request_send entering: type 49
debug3: mm_request_receive entering
debug3: mm_sshpam_query: pam_query returned -1
debug2: auth2_challenge_start: devices <empty>
debug3: mm_sshpam_free_ctx
debug3: mm_request_send entering: type 52
debug3: mm_sshpam_free_ctx: waiting for MONITOR_ANS_PAM_FREE_CTX
debug3: mm_request_receive_expect entering: type 53
debug3: mm_request_receive entering
debug3: monitor_read: checking request 52
debug3: mm_answer_pam_free_ctx
debug3: mm_request_send entering: type 53
debug2: monitor_read: 52 used once, disabling now
Failed keyboard-interactive/pam for agirardet from 10.65.59.54 port 43168 
ssh2
debug3: mm_request_receive entering
Failed keyboard-interactive/pam for agirardet from 10.65.59.54 port 43168 
ssh2
debug1: userauth-request for user agirardet service ssh-connection method 
keyboard-interactive
debug1: attempt 5 failures 4
debug2: input_userauth_request: try method keyboard-interactive
debug1: keyboard-interactive devs
debug1: auth2_challenge: user=agirardet devsdebug1: kbdint_alloc: devices
'pam'
debug2: auth2_challenge_start: devices pam
debug2: kbdint_next_device: devices <empty>
debug1: auth2_challenge_start: trying authentication method 'pam'
debug3: mm_sshpam_init_ctx
debug3: mm_request_send entering: type 46
debug3: mm_sshpam_init_ctx: waiting for MONITOR_ANS_PAM_INIT_CTX
debug3: mm_request_receive_expect entering: type 47
debug3: mm_request_receive entering
debug3: monitor_read: checking request 46
debug3: mm_answer_pam_init_ctx
debug3: mm_request_send entering: type 47
debug3: mm_request_receive entering
debug3: mm_sshpam_query
debug3: mm_request_send entering: type 48
debug3: mm_sshpam_query: waiting for MONITOR_ANS_PAM_QUERY
debug3: mm_request_receive_expect entering: type 49
debug3: mm_request_receive entering
debug3: monitor_read: checking request 48
debug3: mm_answer_pam_query
debug3: ssh_msg_recv entering
debug3: ssh_msg_send: type 1
debug3: mm_request_send entering: type 49
debug3: mm_request_receive entering
debug3: mm_sshpam_query: pam_query returned 0
Postponed keyboard-interactive for agirardet from 10.65.59.54 port 43168 
ssh2
debug3: ssh_msg_recv entering
debug3: mm_sshpam_respond
debug3: mm_request_send entering: type 50
debug3: mm_sshpam_respond: waiting for MONITOR_ANS_PAM_RESPOND
debug3: mm_request_receive_expect entering: type 51
debug3: mm_request_receive entering
debug3: monitor_read: checking request 50
debug3: mm_answer_pam_respond
debug2: PAM: sshpam_respond
debug3: ssh_msg_send: type 6
debug3: mm_request_send entering: type 51
debug3: mm_request_receive entering
debug3: mm_sshpam_respond: pam_respond returned 1
debug3: mm_sshpam_query
debug3: mm_request_send entering: type 48
debug3: mm_sshpam_query: waiting for MONITOR_ANS_PAM_QUERY
debug3: mm_request_receive_expect entering: type 49
debug3: mm_request_receive entering
debug3: monitor_read: checking request 48
debug3: mm_answer_pam_query
debug3: ssh_msg_recv entering
debug3: ssh_msg_send: type 7
PAM: Authentication token is no longer valid; new one required.
debug3: mm_request_send entering: type 49
debug3: mm_request_receive entering
debug3: mm_sshpam_query: pam_query returned -1
debug2: auth2_challenge_start: devices <empty>
debug3: mm_sshpam_free_ctx
debug3: mm_request_send entering: type 52
debug3: mm_sshpam_free_ctx: waiting for MONITOR_ANS_PAM_FREE_CTX
debug3: mm_request_receive_expect entering: type 53
debug3: mm_request_receive entering
debug3: monitor_read: checking request 52
debug3: mm_answer_pam_free_ctx
debug3: mm_request_send entering: type 53
##############################################

Andreas Girardet wrote:
> I am not a developer, but since this is a more advanced issue I rather
> post to this list than to the users list, I hope this is OK.
That's OK.
> We are currently running openssh with simon's gssapi patch and want to
> move towards the new integrated solution with openssh-3.7.1p2. A problem
> we experienced in both versions of openssh is that we are not able to
> change the kerberos password, when it expires. I used James'  patch but
it
> seemed to not work well with simon's gssapi patch and as such we
decided
> not to integrate it. James told me that he believes password change is now
> working with the changes, but I am unable to get it working and am
> wondering if this is a known limitation still and if you are planning to
> work on this issue in the future if it is still an issue.
I don't speak Kerberos myself but someone once reported [0] that an
earlier version of my password expiry patch [1] worked with Kerberos on an
earlier version of OpenSSH when PATH_PASSWD_PROGRAM was set to
"kinit".
> Another oddness I experience
... is truncated email messages? :-)

[0] http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=10485986783267

[1] http://www.zip.com.au/~dtucker/openssh/

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

>I don't speak Kerberos myself but someone once reported [0] that an
>earlier version of my password expiry patch [1] worked with Kerberos on 
an
>earlier version of OpenSSH when PATH_PASSWD_PROGRAM was set to
"kinit".
I have tried this and I am still get the same behaviour. keyboard 
interactive fails and I wonder if ssh actually understands at all what PAM 
is getting back from kerberos.

>> Another oddness I experience
>... is truncated email messages? :-)
Sure .. press escape in Lotus puts your message into the outbox and sends 
message (!!)


Andreas

Darren

Thanks so much for looking into this. Unfortunately your patch did not 
work. I had to actually apply it manually. In meantime I also tried to 
swith privsep off, but this did not help either. Any special debugging I 
can send you?

Andreas

PAM config looks like this for sshd
#################################################

auth       required     /lib/security/pam_stack.so service=system-auth
auth       required     /lib/security/pam_nologin.so
account    required     /lib/security/pam_stack.so service=system-auth
password   required     /lib/security/pam_stack.so service=system-auth
session    required     /lib/security/pam_stack.so service=system-auth
session    required     /lib/security/pam_limits.so
session    optional     /lib/security/pam_console.so
password        required        /lib/security/pam_cracklib.so retry=3 
type

system auth:
######################################################

auth        required      /lib/security/pam_env.so
auth        sufficient    /lib/security/pam_unix.so likeauth
auth        sufficient      /lib/security/pam_krb5.so use_first_pass
auth        required      /lib/security/pam_deny.so

account     [default=bad success=ok user_unknown=ignore service_err=ignore 
system_err=ignore authinfo_unavail=ignore] /lib/security/pam_ldap.so
account      [default=bad success=done user_unknown=ignore 
service_err=ignore system_err=ignore] /lib/security/pam_unix.so
account     [default=bad success=ok user_unknown=ignore service_err=ignore 
system_err=ignore] /lib/security/pam_krb5.so

password    required      /lib/security/pam_cracklib.so retry=3 typepassword   
sufficient    /lib/security/pam_unix.so use_authtok md5 shadow
remember=5
password    sufficient      /lib/security/pam_krb5.so use_authtok
password    required      /lib/security/pam_deny.so

session     required      /lib/security/pam_limits.so
session     required      /lib/security/pam_unix.so
session     optional      /lib/security/pam_krb5.so



########################################


Andreas

Darren

I have narrowed the issue down to be very likley a pam_krb5 issue with the 
version running on RH  ES2.1 and will do some more work on that side. I 
think I am getting closer .......



Thanks for the help

Andreas


IBM Global Services - New Zealand Linux Team
Linux Infrastructure project
Office: +64-9-359-8761
email: girardet at nz1.ibm.com
13-17 Dundonald Street, Newton, Auckland, New Zealand