openssh unix dev - Mar 2019 - Building OpenSSH with Heimdal/Kerberos on OpenBSD

I'm new to openbsd to please excuse if some of the following questions 
are stupid (I did google).

Am I supposed to build OpenSSH from the non-portable version with 
Kerberos on a rather fresh install of OpenBSD 6.4?

I did download OpenSSH-7.9, followed instructions in README and it 
builds ok.

I have installed heimdal via pkg_ad and have the commands and the libs 
are in /usr/local/heimdal/libs. kinit works.


SSH: -------

When I go to the ssh folder and edit the makefile to set kerberos=yes I 
get errors.  I had to change the kerberos include path add an LDFLAG to 
point it to the heimdal lib folder.

Then it was missing choking on -lcom_err and I had to point it to 
/usr/local/lib as well.  (Meanwhile I had compiled heimdal from the 
ports package, so I don't know if libcom_err.so was there in the first 
place or came with the heimdal compile).

Then it turned out that gss-genr.c needed to be added to SRCS in the 
Makefile.

I guess the lib paths may be my lack of understanding OpenBSD, but teh 
missing source looks like a bug in the Makefile to me.



SSHD: -------

Similar things happened with sshd.  Once I added the lib-paths and 
include-paths, I got error messages. Essentially some include files were 
missing in various files to make them compile, e.g. in gss-serv.c




QUESTIONS: -------

I guess the missing paths are my fault one way or another, but I wonder 
if I should compile it based on heimdal or (seening the different 
include path originally pointing to "/usr/include/KerberosV") if I 
should use a different kerberos package (self compiled MIT or something).

Also, judging from the compile errors in sshd, once -DGSSAPI is enabled, 
I guess these are real errors.

So another question is, if it is so unusual to use OpenBSD with ssh and 
Kerberos, that nobody tried it in a long time.  Should I build the 
portable version instead or what else should I do (make a patch, if so, 
including the new lib paths?)


Thanks


Markus Schmidt

On 03.15.19 16:58 , Markus Schmidt wrote:
> Also, judging from the compile errors in sshd, once -DGSSAPI is enabled, 
> I guess these are real errors.
Attached is a diff of the changes I had to make to get ssh and sshd 
compile with -DGSSAPI (and gssapi.h from heimdal), regardless of the 
other problems (like missing lib folders, etc.).

This is for the BSD version of OpenSSH.



Markus
-------------- next part --------------
diff -u ssh/auth-krb5.c ssh2/auth-krb5.c
--- ssh/auth-krb5.c	Mon Jul  9 23:35:50 2018
+++ ssh2/auth-krb5.c	Fri Mar 15 16:30:57 2019
@@ -36,6 +36,7 @@
 #include "ssh.h"
 #include "packet.h"
 #include "log.h"
+#include "misc.h"
 #include "sshbuf.h"
 #include "sshkey.h"
 #include "servconf.h"
diff -u ssh/auth2-gss.c ssh2/auth2-gss.c
--- ssh/auth2-gss.c	Tue Jul 31 05:10:27 2018
+++ ssh2/auth2-gss.c	Fri Mar 15 16:31:31 2019
@@ -34,6 +34,7 @@
 #include "auth.h"
 #include "ssh2.h"
 #include "log.h"
+#include "misc.h"
 #include "dispatch.h"
 #include "sshbuf.h"
 #include "ssherr.h"
diff -u ssh/gss-serv.c ssh2/gss-serv.c
--- ssh/gss-serv.c	Mon Jul  9 23:37:55 2018
+++ ssh2/gss-serv.c	Fri Mar 15 18:35:12 2019
@@ -26,6 +26,8 @@
 
 #include <sys/types.h>
 #include <sys/queue.h>
+#include <sys/param.h>
+#include <netdb.h>
 
 #ifdef GSSAPI