Single Sign on with Kerberos/OpenSSH (see also OpenSSH-3.9p1 and MIT Kerberos by Matt Miller)

From: Hans Kramer (Hans.Kramer_at_xs4all.nl)
Date: 06/24/05

  • Next message: Robert Campbell: "FW: Returned post for secureshell@securityfocus.com"
    To: secureshell@securityfocus.com
    Date: Fri, 24 Jun 2005 12:52:37 +0200
    
    

    Hi,

    I am trying to configure Kerberos, to create a Single Sign On
    environment using OpenSSH. I am running Fedora Core 3.

    My understanding is that gssapi-with-mic is a mechanism for passing my
    Kerberos credentials to the sshd server, which can verify them against
    the kerberos server. However, for some reason the communication between
    shh and sshd breaks down. From looking in the source code I understand
    that in my configuration sshd excepts only the gssapi_kerberos_mech
    mechanism (sounds good to me). However, ssh seems not to try to use this
    mechanism (but two different kind, which I was unable to resolve)....
    why???

    Now, perhaps what I want to do is perhaps not supported yet or
    misconfigured by the Fedora people (or by me ;-). (in addition I tried
    openssh-4.0p1-3.src.rpm from FC4, without any luck either).

    Any pointer are welcome!!!! such as how gssapi-with-mic works and is
    configured, to points in the code were I can look.

    Thanks guys,

    Hans.

    My configuration:
    ssh_config
       GSSAPIAuthentication yes
       GSSAPIDelegateCredentials yes
    sshd_config
       KerberosAuthentication yes
       GSSAPIAuthentication yes

    Client side:

    $ ssh -vvv -o PreferredAuthentications=gssapi-with-mic hermosillo
    OpenSSH_3.9p1, OpenSSL 0.9.7a Feb 19 2003
    debug1: Reading configuration data /etc/ssh/ssh_config
    debug1: Applying options for *
    debug2: ssh_connect: needpriv 0
    .....
    debug3: preferred gssapi-with-mic
    debug3: authmethod_lookup gssapi-with-mic
    debug3: remaining preferred:
    debug3: authmethod_is_enabled gssapi-with-mic
    debug1: Next authentication method: gssapi-with-mic
    debug2: we sent a gssapi-with-mic packet, wait for reply
    debug1: Authentications that can continue: publickey,gssapi-with-
    mic,password
    debug2: we sent a gssapi-with-mic packet, wait for reply
    debug1: Authentications that can continue: publickey,gssapi-with-
    mic,password
    debug2: we did not send a packet, disable method
    debug1: No more authentication methods to try.
    Permission denied (publickey,gssapi-with-mic,password).

    Server Side:
    Starting sshd: debug2: load_server_config: filename /etc/ssh/sshd_config
    debug2: load_server_config: done config len = 409
    debug2: parse_server_config: config /etc/ssh/sshd_config len 409
    debug1: sshd version OpenSSH_4.0p1
    debug3: Not a RSA1 key file /etc/ssh/ssh_host_rsa_key.
    debug1: read PEM private key done: type RSA
    debug1: private host key: #0 type 1 RSA
    debug3: Not a RSA1 key file /etc/ssh/ssh_host_dsa_key.
    debug1: read PEM private key done: type DSA
    debug1: private host key: #1 type 2 DSA
    debug1: rexec_argv[0]='/usr/sbin/sshd'
    debug1: rexec_argv[1]='-ddd'
    debug2: fd 3 setting O_NONBLOCK
    debug1: Bind to port 22 on ::.
    Server listening on :: port 22.
    debug2: fd 4 setting O_NONBLOCK
    debug1: Bind to port 22 on 0.0.0.0.
    Bind to port 22 on 0.0.0.0 failed: Address already in use.
    debug3: fd 4 is not O_NONBLOCK
    debug1: Server will not fork when running in debugging mode.
    debug3: send_rexec_state: entering fd = 7 config len 409
    debug3: ssh_msg_send: type 0
    debug3: send_rexec_state: done
    debug1: rexec start in 4 out 4 newsock 4 pipe -1 sock 7
    debug1: inetd sockets after dupping: 3, 3
    Connection from ::ffff:192.168.2.10 port 36895
    debug1: Client protocol version 2.0; client software version OpenSSH_4.0
    debug1: match: OpenSSH_4.0 pat OpenSSH*
    debug1: Enabling compatibility mode for protocol 2.0
    debug1: Local version string SSH-2.0-OpenSSH_4.0
    debug2: fd 3 setting O_NONBLOCK
    debug3: privsep user:group 74:74
    debug1: permanently_set_uid: 74/74
    debug1: list_hostkey_types: ssh-rsa,ssh-dss
    debug1: SSH2_MSG_KEXINIT sent
    debug1: SSH2_MSG_KEXINIT received
    debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-
    hellman-group14-sha1,diffie-hellman-group1-sha1
    debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
    debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-
    cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-
    ctr,aes192-ctr,aes256-ctr
    debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-
    cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-
    ctr,aes192-ctr,aes256-ctr
    debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-
    ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-
    ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: none,zlib
    debug2: kex_parse_kexinit: none,zlib
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit: first_kex_follows 0
    debug2: kex_parse_kexinit: reserved 0
    debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-
    hellman-group14-sha1,diffie-hellman-group1-sha1
    debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
    debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-
    cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-
    ctr,aes192-ctr,aes256-ctr
    debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-
    cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-
    ctr,aes192-ctr,aes256-ctr
    debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-
    ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-
    ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: none,zlib
    debug2: kex_parse_kexinit: none,zlib
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit: first_kex_follows 0
    debug2: kex_parse_kexinit: reserved 0
    debug2: mac_init: found hmac-md5
    debug1: kex: client->server aes128-cbc hmac-md5 none
    debug2: mac_init: found hmac-md5
    debug1: kex: server->client aes128-cbc hmac-md5 none
    debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
    debug3: mm_request_send entering: type 0
    debug3: mm_choose_dh: waiting for MONITOR_ANS_MODULI
    debug3: mm_request_receive_expect entering: type 1
    debug3: mm_request_receive entering
    debug2: Network child is on pid 5096
    debug3: preauth child monitor started
    debug3: mm_request_receive entering
    debug3: monitor_read: checking request 0
    debug3: mm_answer_moduli: got parameters: 1024 1024 8192
    debug3: mm_request_send entering: type 1
    debug2: monitor_read: 0 used once, disabling now
    debug3: mm_request_receive entering
    debug3: mm_choose_dh: remaining 0
    debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
    debug2: dh_gen_key: priv key bits set: 119/256
    debug2: bits set: 516/1024
    debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
    debug2: bits set: 504/1024
    debug3: mm_key_sign entering
    debug3: mm_request_send entering: type 5
    debug3: monitor_read: checking request 5
    debug3: mm_answer_sign
    debug3: mm_answer_sign: signature 0x9fab068(143)
    debug3: mm_request_send entering: type 6
    debug2: monitor_read: 5 used once, disabling now
    debug3: mm_request_receive entering
    debug3: mm_key_sign: waiting for MONITOR_ANS_SIGN
    debug3: mm_request_receive_expect entering: type 6
    debug3: mm_request_receive entering
    debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
    debug2: kex_derive_keys
    debug2: set_newkeys: mode 1
    debug1: SSH2_MSG_NEWKEYS sent
    debug1: expecting SSH2_MSG_NEWKEYS
    debug2: set_newkeys: mode 0
    debug1: SSH2_MSG_NEWKEYS received
    debug1: KEX done
    debug1: userauth-request for user hans service ssh-connection method
    none
    debug1: attempt 0 failures 0
    debug3: mm_getpwnamallow entering
    debug3: mm_request_send entering: type 7
    debug3: monitor_read: checking request 7
    debug3: mm_answer_pwnamallow
    debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
    debug3: mm_request_send entering: type 8
    debug2: monitor_read: 7 used once, disabling now
    debug3: mm_request_receive entering
    debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM
    debug3: mm_request_receive_expect entering: type 8
    debug3: mm_request_receive entering
    debug2: input_userauth_request: setting up authctxt for hans
    debug3: mm_start_pam entering
    debug3: mm_request_send entering: type 46
    debug3: monitor_read: checking request 46
    debug1: PAM: initializing for "hans"
    debug3: Normalising mapped IPv4 in IPv6 address
    debug3: Trying to reverse map address 192.168.2.10.
    debug1: PAM: setting PAM_RHOST to "hermosillo.hanskramer.com"
    debug1: PAM: setting PAM_TTY to "ssh"
    debug2: monitor_read: 46 used once, disabling now
    debug3: mm_request_receive entering
    debug3: mm_inform_authserv entering
    debug3: mm_request_send entering: type 3
    debug3: monitor_read: checking request 3
    debug3: mm_answer_authserv: service=ssh-connection, style=
    debug2: monitor_read: 3 used once, disabling now
    debug3: mm_request_receive entering
    debug3: mm_inform_authrole entering
    debug3: mm_request_send entering: type 4
    debug3: monitor_read: checking request 4
    debug3: mm_answer_authrole: role=
    debug2: monitor_read: 4 used once, disabling now
    debug3: mm_request_receive entering
    debug2: input_userauth_request: try method none
    Failed none for hans from ::ffff:192.168.2.10 port 36895 ssh2
    debug1: userauth-request for user hans service ssh-connection method
    gssapi-with-mic
    debug1: attempt 1 failures 1
    debug2: input_userauth_request: try method gssapi-with-mic
    debug3: mm_request_send entering: type 38
    debug3: monitor_read: checking request 38
    debug1: Miscellaneous failure
    No such file or directory

    debug3: mm_request_send entering: type 39
    debug3: mm_request_receive entering
    debug3: mm_request_receive_expect entering: type 39
    debug3: mm_request_receive entering
    Failed gssapi-with-mic for hans from ::ffff:192.168.2.10 port 36895 ssh2
    debug1: userauth-request for user hans service ssh-connection method
    gssapi-with-mic
    debug1: attempt 2 failures 2
    debug2: input_userauth_request: try method gssapi-with-mic
    Failed gssapi-with-mic for hans from ::ffff:192.168.2.10 port 36895 ssh2
    Connection closed by ::ffff:192.168.2.10
    debug1: do_cleanup
    debug1: PAM: cleanup
    debug3: PAM: sshpam_thread_cleanup entering
    debug1: do_cleanup
    debug1: PAM: cleanup
    debug3: PAM: sshpam_thread_cleanup entering


  • Next message: Robert Campbell: "FW: Returned post for secureshell@securityfocus.com"

    Relevant Pages

    • Unable to get shell prompt after logon
      ... debug1: Reading configuration data /etc/ssh/ssh_config ... debug1: Entering interactive session. ... debug2: Network child is on pid 950 ... debug3: preauth child monitor started ...
      (SSH)
    • Problem with some user autentification error on sshd
      ... debug1: Reading configuration data /etc/ssh/ssh_config ... debug2: kex_parse_kexinit: none,zlib ... debug3: check_host_in_hostfile: match line 3 ... debug1: Next authentication method: keyboard-interactive ...
      (SSH)
    • ssh works, scp hangs
      ... debug1: read PEM private key done: type RSA ... debug2: Network child is on pid 8182 ... debug3: preauth child monitor started ... debug3: mm_request_send entering: type 0 ...
      (Debian-User)
    • Openssh 3.7.1p2 hangs on Solaris 2.6
      ... debug1: read PEM private key done: type RSA ... debug2: Network child is on pid 2466 ... debug3: preauth child monitor started ... debug3: mm_request_send entering: type 0 ...
      (SSH)
    • RE: trying to use keys...been asked a bunch, didnt find many solutio ns
      ... debug1: read PEM private key done: type RSA ... debug3: preauth child monitor started ... debug2: kex_parse_kexinit: ... debug3: entering: type 0 ...
      (SSH)