similar to: OpenSSH-snap-20040212 and the use of krb5-config

I am trying to transition several HP/UX 11i (PA/RISC) servers from ssh.com over to OpenSSH+GSSAPI (3.9p1) and it's complaining about the GSSAPI include files: -=- gcc -g -O2 -Wall -Wpointer-arith -Wno-uninitialized -I. -I. -I/usr/local/ssl/include -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1 -I/usr/local/krb5/include -DSSHDIR=\"/usr/local/etc\"

Darren, We have systems which are multihomed for virtualisation, but run only one sshd. You can connect to any IP-address and should be authenticated with gssapi/kerberos. So the client will ask for a principal host/virt-ip-X and the server has to have an entry for this in the keytab and has to select the right key by determining the hostname from the connection IP-address. There is no other way

Rather then implementing kafs in MIT Kerberos, I would like to suggest an alternative which has advantages to all parties. The OpenSSH sshd needs to do two things: (1) sets a PAG in the kernel, (2) obtains an AFS token storing it in the kernel. It can use the Kerberos credentials either obtained via GSSAPI delegation, PAM or other kerberos login code in the sshd. The above two

Does anyone see a need for a patch that allows Kerberos password authentication with the correct local options? I'm simply trying to get a feel for if it's worth my time to investigate it further. The issue is that we also use a patch that does Kerberos ticket passing and our ticket lifetime is slightly higher than the default 10 hours. Users experience different behavior when they

[[Sending again, as for some strange reason it is not accepted]] Hello OpenSSH developers, I maintain external patch for PKCS#11 smartcard support into OpenSSH[1] , many users already apply and use this patch. I wish to know if anyone is interesting in working toward merging this into mainline. I had some discussion with Damien Miller, but then he disappeared. Having standard smartcard

----- Forwarded message from Andrea Barisani <lcars at infis.univ.trieste.it> ----- Date: Fri, 2 May 2003 14:01:33 +0200 From: Andrea Barisani <lcars at infis.univ.trieste.it> To: openssh at openssh.com Subject: openssh 3.6.1_p2 problem with pam Hi, I've just updated to openssh 3.6.1_p2 and I notice this behaviour: # ssh -l lcars mybox [2 seconds delay] lcars at mybox's

Client: Windows XP pro, in an AD 2003 domain, running SecureCRT 4.1.11. I've also got MIT Kerberos for Windows installed on the client, and Leash shows that my tickets ARE forwardable. Server: Solaris 8 Sparc server, with MIT Kerberos (krb5-1.4.1), and OpenSSH 4.0p1. I've created two AD accounts, and extracted keys mapped to "host/hostname.domainname.com at REALM.COM" and

Hello, I have a question about SSH with Kerberos password authentication . Do I receive any host ticket to my client machine when I do ssh connection with Kerberos password authenticaiton? If dont, why? If I login to remote machine through telnet with Kerberos Password authentication [through PAM-kerberos], then I can see the tickets with klist. But with the same setup for sshd, I cannot see

I'm really scratching my head on this one. The server is running OpenSSH 5.1p1 on Solaris 9. The authentication is via PAM if that matters. # grep X11 sshd_config | sed '/^#/D' X11Forwarding yes X11DisplayOffset 10 X11UseLocalhost yes # Now I attach to my 'master' sshd and follow all children to look for any evidence of "DISPLAY": # truss -f -a -e -p 14923

Greetings, I'm working on the infrastructure of a medium size client/server environment using an Active Directory running on Windows Server 2003 for central authentication of users on linux clients. Additionally OpenAFS is running using Kerberos authentication through Active Directory as well. Now I want to grant users remote access to their AFS data by logging in into a central OpenSSH

I took Markus Friedl's advice and set up a KbdintDevice for Kerberos password authentication/expiry. It took me a bit to wrap my head around privsep, but I think it's working properly (code stolen shamelessly from FBSD's PAM implementation :->). The hardest part was working out how to get the interaction between krb5_get_init_creds_password() (along with the prompter) to work

Is there a way to run sshd on a windows 2000 server and have ssh clients authenticate to it using domain level authentication? Mike

I searched google and did not find any hits on this being solved. I want to get ssh so I can the dsa/rsa style password it in an environment that uses dfs/dce authentication if that is possible (and it has not already been solved). In other words, I want to be able to log into a host as a dfs/dce user without typing my password. Before I dig into the code and trying to do this, I wanted

Upgrading to the 3.8.x versions of OpenSSH appears to have broken support for Win2K KDC's. Win2K supports gssapi just fine, but the new gssapi-with-mic does not appear to work. I was able to use the old 3.6.x versions with Kerberos authentication, and the newer 3.7.x versions with gssapi authentication, but 3.8.x does not seem to work at all. The mitm patch provided for 3.8p1 does work, but

Now that RFC 4462 has been published, I was wondering if there would be any interest in looking again at integrating the key exchange portions of my GSSAPI patch into the OpenSSH tree? As I've mentioned before, key exchange has significant benefits for large sites as it allows them to use Kerberos to authenticate ssh hosts, and removes the need to maintain and distribute ssh known_hosts

I've spent the morning looking at making some RPMs for Fedora Core 1 and run into a problem with GSSAPI. Basically the default install of Fedora doesn't come with the necessary gssapi code to build the RPMs by default (i.e. you need to say %define kerberos5 0 in openssh.spec). Since Fedora is going to fork off from RedHat I was going to create a set of patches to make a

I login from system using Openssh 4.0p1 or 4.1p1 to systems running Openssh before 3.9p1 or 3.7p1. It appears the X11 stuff are either blocked or not recognised. I get errors like "xterm Xt error: Can't open display: <host>:10.0" or "X11 connection rejected because of wrong authentication. X connection to localhost:10.0 broken....." depending on whether I use

[Apologies if this is an off-topic question; please direct me to a more appropriate place if so.] Using Kerberos/GSSAPIAuthentication, is there a way to centrally control/manage (perhaps using LDAP?) which user principals can log into what hosts/accounts? -- Jos Backus jos at catnook.com

Hello, When I attempt to join the domain using YaST (openSUSE's system configuration tool) or 'net join DOMAIN,' it prompts me for a network admin's username/password. The IT network admin already manually joined the machine to the network's AD domain (server-side), but Samba still needs a username/password. The workstations are batch-installs and are unattended, so we need a

Remote users on external networks unable to connect to the host using F-Secure SSH from their workstations. The Host is installed with openssh-3.4p1 from IBM. Previously the host was installed with F-Secure 1.2.26 and there wasn't any problems. What can we do. I've checked in the sshd_config file and the AllowHosts and Allow Users tags are in there with the host ips and usernames that