Dear list members,

I have setted openssh to work with kerberos. My initial ideia is to
permit credential (tickets) or login password (/etc/passwd). In order
to achieve so, i have the following (relevant part only)

GSSAPIAuthentication yes
KerberosAuthentication no
KerberosGetAFSToken no
KerberosOrLocalPasswd no
KerberosTicketCleanup yes
PasswordAuthentication yes

I created a user with "*" password to force GSSAPI authentication.

I got surprised when without having pulled the ticket (and remenber,
with a "*" password entry in /etc/passwd) the user was still allowed
to login by providing a password (from the kerberos server principal)

Now, an explanation:


Use this directive to specify if a password must be accepted as proof
of identity at login. If KerberosAuthentication is disabled, the login
password is sufficient. However, when KerberosAuthentication is also
enabled, the Kerberos Server password is accepted as a proof of

Does anybody know where am i wrong?

PS: I am using openbsd 4.0 stable.

Relevant Pages

  • Re: OS X 10.4.2 kdestroy problem
    ... The problem here is that the Mach-IPC based CCacheServer gets registered as root by launchd. ... There is special code in the login process which tells the first instantiation of the CCacheServer to run as the user. ... However when you destroy your tickets and get new ones, launchd launches the second CCacheServer as root and thus you don't have access to your ticket cache. ... Unfortunately there is currently no workaround other than to not enable Kerberos at login. ...
  • Re: Solaris 10 ssh logins + w2k3 AD native mode
    ... SEAM, Kerberos). ... Unix system to map from the AD user attributes ... a Unix login session. ... Does putty support GSSAPI authentication for SSH and can it ...
  • Re: cisco catalyst 3750 help
    ... so only login password manually ... I am attempting to use MIT Kerberos to provide automatic logins via ... telnet on a Cisco Catalyst 3750. ... aaa authentication login telnet krb5-telnet ...
  • Re: Problem with kerberos telnet option
    ... I am trying to setup a test kdc server and workstation. ... After I did the setup I can login as user5 using the kerberos ... from ssh from station6 to station5 it request another login. ...
  • Re: Unexplained Failed Logins
    ... if the DC is attempting a login via a delegation, ... and directly attempt Kerberos authN on network exposed ... authentication which would show IIS and use NTLM. ... Can you suggest any other places/logs to check for external activity? ...