>> libraries in... Not even sure they have GSSAPI at all, maybe just GSS?
>> Does anyone have any hints on this, or has anyone ever done it? Or
>> maybe a better place to post?
>
> The Kerberos API was private in Solaris for a long time because there
> were concerns about stability of the in
On Wed, Aug 09, 2006 at 11:08:11AM -0500, Douglas E. Engert wrote:
> Another comment, if the problem is the Solaris 10 sshd is not saving
> the forwarded credentials, it could be the pam.conf is not configured
> correctly. sshd calls pam with a number of different services names,
> including sshd-
On Wednesday, August 09, 2006 02:55:05 PM -0500 "Douglas E. Engert"
<[EMAIL PROTECTED]> wrote:
>> __gss_userok() is not; should it be?
>
> I would say yes. Every service needs to do this, and use the GSS creds
> to test if it can use the local resource. So it in that regards it is
> generic.
A
On Wed, Aug 09, 2006 at 02:55:05PM -0500, Douglas E. Engert wrote:
> Nicolas Williams wrote:
> >gss_store_cred() is a KITTEN WG work item.
> >
> >__gss_userok() is not; should it be?
>
> I would say yes. Every service needs to do this, and use the GSS creds
> to test if it can use the local resou
Nicolas Williams wrote:
> On Wed, Aug 09, 2006 at 02:26:57PM -0500, Douglas E. Engert wrote:
>
>>
>>Nicolas Williams wrote:
>>
>>
>>>On Wed, Aug 09, 2006 at 09:52:51AM -0500, Douglas E. Engert wrote:
>>>
>>>
Markus Moeller wrote:
>There shouldn't be the need of compiling opens
Erich Weiler wrote:
>
> 1: I want SSH to automatically forward my krb5 credentials when I SSH
> into another machine using public keys.
>
Don't think OpenSSH will do this either with out mods.
>
>
> Kerberos mailing list Kerberos
On Wed, Aug 09, 2006 at 02:26:57PM -0500, Douglas E. Engert wrote:
>
>
> Nicolas Williams wrote:
>
> >On Wed, Aug 09, 2006 at 09:52:51AM -0500, Douglas E. Engert wrote:
> >
> >>Markus Moeller wrote:
> >>
> >>>There shouldn't be the need of compiling openssh with Kerberos as the
> >>>Solaris 10
Nicolas Williams wrote:
> On Wed, Aug 09, 2006 at 09:52:51AM -0500, Douglas E. Engert wrote:
>
>>Markus Moeller wrote:
>>
>>>There shouldn't be the need of compiling openssh with Kerberos as the
>>>Solaris 10 version supports GSSAPI authentication.
>>
>>Yes and no. Until you want to store the
On Wednesday, August 09, 2006 11:56:07 AM -0500 Nicolas Williams
<[EMAIL PROTECTED]> wrote:
> On Wed, Aug 09, 2006 at 09:36:30AM -0700, Erich Weiler wrote:
>> I am getting credentials through PAM. That much is working. My
>> problem, very specifically, is that:
>>
>> 1: I want SSH to automati
On Wed, Aug 09, 2006 at 09:52:51AM -0500, Douglas E. Engert wrote:
> Markus Moeller wrote:
> > There shouldn't be the need of compiling openssh with Kerberos as the
> > Solaris 10 version supports GSSAPI authentication.
>
> Yes and no. Until you want to store the delegated credential or do a
> kr
On Wed, Aug 09, 2006 at 09:36:30AM -0700, Erich Weiler wrote:
> I am getting credentials through PAM. That much is working. My
> problem, very specifically, is that:
>
> 1: I want SSH to automatically forward my krb5 credentials when I SSH
> into another machine using public keys.
This makes
> You fundamentally misunderstand how network authentication and
> credential forwarding work.
No, I think I do understand it. All you have written below are steps I
have taken and am sorted with. Perhaps I'm not making myself very clear
in describing the problem I'm having (which I can certai
On Wed, Aug 09, 2006 at 08:24:22AM -0700, Erich Weiler wrote:
> The main reason I need to compile OpenSSH with krb5 is because the way I
> have it working currently, OpenSSH using PAM, does not does _forward_
> krb5 creds when SSHing to another machine. I have seen OpenSSH using
> GSS-API auth
Another comment, if the problem is the Solaris 10 sshd is not saving
the forwarded credentials, it could be the pam.conf is not configured
correctly. sshd calls pam with a number of different services names,
including sshd-password, sshd-gssapi, sshd-kdbint. (If one of these
is not found, other is
Erich Weiler wrote:
>> With OpenSSH-4.1 at least ssh_gssapi_krb5_storecreds and
>> ssh_gssapi_krb5_userok make krb5 API calls as gss never had a simple
>> authz function or a way to save the delegated creds.
>>
>> Solaris 10's sshd uses PAM, to do these. OpenSSH should look at that
>> approach t
> With OpenSSH-4.1 at least ssh_gssapi_krb5_storecreds and
> ssh_gssapi_krb5_userok make krb5 API calls as gss never had a simple
> authz function or a way to save the delegated creds.
>
> Solaris 10's sshd uses PAM, to do these. OpenSSH should look at that
> approach too, then it would not need K
Markus Moeller wrote:
> There shouldn't be the need of compiling openssh with Kerberos as the
> Solaris 10 version supports GSSAPI authentication.
Yes and no. Until you want to store the delegated credential or do a
krb5_userok test.
With OpenSSH-4.1 at least ssh_gssapi_krb5_storecreds and
ss
Erich Weiler wrote:
> Hi all-
>
> I'm not sure this is the correct place to post about this but I'm
> getting no response over an OpenSSH.org, if there is a more appropriate
> place to post please let me know... And the people at Sun scream at me
> for even considering openssh when they supp
P.S. I should say we are using the Solaris ssh and sshd, as well as
their pam_krb5. But there are issues with the pam_krb5 with using
session based caches rather then user, and updating of the TGT
but leaving older tickets in the cache.
Erich Weiler wrote:
> Hi all-
>
> I'm not sure this is the
There shouldn't be the need of compiling openssh with Kerberos as the
Solaris 10 version supports GSSAPI authentication.
Markus
"Erich Weiler" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]
> Hi all-
>
> I'm not sure this is the correct place to post about this but I'm
> getting no
Crud, I was hoping you wouldn't say that... :(
-erich
Will Fiveash wrote:
> On Tue, Aug 08, 2006 at 04:49:14PM -0700, Erich Weiler wrote:
>> Hi all-
>>
>> I'm not sure this is the correct place to post about this but I'm
>> getting no response over an OpenSSH.org, if there is a more appropriate
On Tue, Aug 08, 2006 at 04:49:14PM -0700, Erich Weiler wrote:
> Hi all-
>
> I'm not sure this is the correct place to post about this but I'm
> getting no response over an OpenSSH.org, if there is a more appropriate
> place to post please let me know... And the people at Sun scream at me
> for
>libraries in... Not even sure they have GSSAPI at all, maybe just GSS?
> Does anyone have any hints on this, or has anyone ever done it? Or
>maybe a better place to post?
Solaris supports GSS-API but does not expose the Kerberos API or any of
the Kerberos mechanism-specific extensions. So w
Hi all-
I'm not sure this is the correct place to post about this but I'm
getting no response over an OpenSSH.org, if there is a more appropriate
place to post please let me know... And the people at Sun scream at me
for even considering openssh when they supply their own version of SSH
which
24 matches
Mail list logo
