[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Heimdal 1.1 and OpenSSH 5.0 for SSO : GSSAPI Problems



Hi,

I've GSSAPI mech problem with Heimdal 1.1 / Arla 0.91-pre and OpenSSH 
5.0 on FreeBSD 7.0 (RELEASE).

What I've done :

# tar -xzf heimdal-1.1.tar.gz
# cd heimdal-1.1
# ./configure --prefix=/usr/heimdal (default, I know)
# make && make install

and

# checkout arla
# reconfigure
# cd arla-0.91
# ./configure --prefix=/usr/arla-0.91 --sysconfdir=/etc/afs 
--with-krb5=/usr/heimdal
# make && make install

and

# tar -xzf openssh-5.0p1.tar.gz
# cd openssh-5.0p1
# wget 
http://www.sxw.org.uk/computing/patches/openssh-5.0p1-gsskex-20080404.patch
# patch -p1 < openssh-5.0p1-gsskex-20080404.patch
# ./configure --prefix=/usr --sysconfdir=/etc/ssh 
--with-kerberos5=/usr/heimdal --enable-kerberos-tgt-passing (I want to 
replace system's default)
# make && make install

I set sshd_config :
# Kerberos options
KerberosAuthentication yes
KerberosOrLocalPasswd yes
KerberosTicketCleanup yes
KerberosGetAFSToken yes

# GSSAPI options
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
GSSAPIStrictAcceptorCheck yes
GSSAPIKeyExchange yes

and ssh_config:
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes
  GSSAPIKeyExchange yes
  GSSAPITrustDNS yes


And  also I put my krb5.conf in /etc :
[appdefaults]
       forwardable = true
       proxiable = true
       no-addresses = true
       ticket_lifetime = 86400
       renew_lifetime = 604800
       encrypt = true
       forward = true

[libdefaults]
       default_realm = EPITECH.NET
       clockskew = 600
       kdc_timeout = 1
       default_cc_name = /tmp/krb5cc_%{uid}
       kdc_timesync = true
       max_retries = 1
       ticket_lifetime = 86400
       renew_lifetime = 604800
       forwardable = true
       proxiable = true

[domain_realm]
       ig-iit.com = EPITECH.NET
       epitech.net = EPITECH.NET
       epitech.eu = EPITECH.NET
       epita.fr = EPITECH.NET

[realms]
       EPITECH.NET = {
                   kdc = kdc.epitech.net
                   admin_server = kdc.epitech.net
                   default_domain = kdc.epitech.net
                   kpasswd_server = kdc.epitech.net
       }

[domain_realm]
       ig-iit.com = EPITECH.NET
       .ig-iit.com = EPITECH.NET
       epitech.net = EPITECH.NET
       .epitech.net = EPITECH.NET
       epitech.eu = EPITECH.NET
       .epitech.eu = EPITECH.NET
       epita.fr = EPITECH.NET
       .epita.fr = EPITECH.NET

Now everithing seems working well :

# id
uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)
# /etc/rc.d/sshd start
Starting sshd.
# /usr/arla/sbin/startarla (looks good)
# kinit millet_a
# klist
Credentials cache: FILE:/tmp/krb5cc_0
       Principal: millet_a@EPITECH.NET

 Issued           Expires          Principal
Jul  3 11:52:05  Jul  4 11:52:06  krbtgt/EPITECH.NET@EPITECH.NET
Jul  3 11:52:05  Jul  4 11:52:06  afs@EPITECH.NET

Now I want to ssh on 2 remote host :
# ssh millet_a@ackbar
Connection closed by 10.42.20.1
# ssh -v millet_a@ackbar
OpenSSH_5.0p1, OpenSSL 0.9.8e 23 Feb 2007
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to ackbar [10.42.20.1] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_5.0
debug1: match: OpenSSH_5.0 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.0
debug1:  Miscellaneous failure (see text)
*unknown mech-code 2529639054 for mech 1 3 6 1 4 1 311 2 2 10*
debug1: Offering GSSAPI proposal: 
gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g== 

debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: Doing group exchange
debug1: Calling gss_init_sec_context
debug1: Delegating credentials
Connection closed by 10.42.20.1
# kdestroy
# ssh millet_a@ackbar
millet_a@ackbar's password: ********** (work well)
(millet_a@ackbar 2622) ssh amidal
Connection closed by 10.42.20.2
(millet_a@ackbar 2622) ssh -v amidal
OpenSSH_5.0p1, OpenSSL 0.9.8e 23 Feb 2007
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to amidal [10.42.20.2] port 22.
debug1: Connection established.
debug1: identity file /u/epitech_2009/millet_a/cu/.ssh/identity type -1
debug1: identity file /u/epitech_2009/millet_a/cu/.ssh/id_rsa type -1
debug1: identity file /u/epitech_2009/millet_a/cu/.ssh/id_dsa type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_5.0
debug1: match: OpenSSH_5.0 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.0
debug1:  Miscellaneous failure (see text)
*unknown mech-code 2529639054 for mech 1 3 6 1 4 1 311 2 2 10*
debug1: Offering GSSAPI proposal: 
gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g== 

debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: Doing group exchange
debug1: Calling gss_init_sec_context
debug1: Delegating credentials
Connection closed by 10.42.20.2

I want SSO in my school, last years I worked with FreeBSB 5.5 with 
OpenSSH4.7, Arla 0.93 and Heimdal 1.0.

I find this gss message in:
lib/gssapi/krb5/display_status.c
lib/gssapi/mech/gss_display_status.c

Has someone an Idee where's the problems, google isn't very helpfull.

Thanks a lot.

-- 
Antoine MILLET