search for: gssapirenewalforcesrekey

...t. This allows credentials provided via key exchange to be cascaded through a set of ssh connections, so that a once a user reauthenticates on their workstation, the new credentials are available on all machines to which they are currently connected. This is controlled via the new options GSSAPIRenewalForcesReKey and GSSAPIStoreCredentialsOnRekey. A pam stack, 'sshd-rekey' may be defined to trigger renewal of additional credentials, such as X509 certificates or AFS tokens, when credentials are renewed on a particular machine. Cascading credential support is implemented using the standard ssh...

In an environment where users use smart cards to authenticate on Windows and then use ssh to login to UNIX systems via GSSAPI, it is nigh impossible to renew/refresh the Kerberos credentials in the UNIX session. If the user fails to renew their credentials before they expire, the user is stuck and must log out and log back in to get valid tickets. Meanwhile it is entirely likely that on the

https://bugzilla.mindrot.org/show_bug.cgi?id=2310 Bug ID: 2310 Summary: functionality to start process before ssh and/or to "wrap" such command around ssh Product: Portable OpenSSH Version: 6.7p1 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5

I'm pretty sure this is a resolving problem. Can you verify this: https://wiki.samba.org/index.php/Verifying_and_Creating_a_DC_DNS_Record Especialy these : for both guids and cross check if from both servers. host -t CNAME 50507d18-c8ee-4ef4-bbda-4d0d9bc31caa._msdcs..... Can you post from both server. /etc/hosts /etc/resolv.conf host servername host fqdn host servername @dns othere

If I am trying to build OpenSSH 6.6 with Kerberos GSSAPI support, do I still need to get Simon Wilkinson's patches? --- Scott Neugroschl | XYPRO Technology Corporation 4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |