Re: OpenSSH with gssapi-with-mic hostname questions



On Mon, September 17, 2007 8:10 am, Simon Wilkinson wrote:
When I try and connect to
that server the GSSAPI functionality in the SSH client tries to obtain a
Kerberos host key for the actual reverse hostname (as noted in the
KDC logs)
which is not what I requested and of course fails.

This name canonicalisation step is being performed by the GSSAPI
library you are linking against. This behaviour was mandated by RFC1964, but
has since been deprecated by the more recent Kerberos revisions. Some
libraries may offer the ability to disable canonicalisation, but that will
be controlled as part of your Kerberos configuration, rather than in the
OpenSSH code.

Thanks, that's what I was wondering, the reference was great.

For the completeness of the thread and archive posterity, the solution when
using MIT Kerberos (unsure of heimdal or shishi) was to add an "rdns = no"
entry to the [libdefaults] section of the krb5.conf file. I've posted a
message to the MIT Kerberos mailing list to see if this can be done on a
finer granularity but haven't heard yet.

Thanks again.

Joel



Relevant Pages

  • kadmin ktadd and F_WRLCK
    ... The server is debian sargewith kerberos from Backports and Kernel 2.6.18. ... ii krb5-ftpd 1.4.4-7etch1~b Secure FTP server supporting MIT Kerberos ... ii krb5-telnetd 1.4.4-7etch1~b Secure telnet server supporting MIT Kerberos ... ii libkrb5-17-hei 0.6.3-10sarge2 Libraries for Heimdal Kerberos ...
    (Debian-User)
  • Re: OpenSSH with gssapi-with-mic hostname questions
    ... Kerberos host key for the actual reverse hostname (as noted in the KDC logs) ... This behaviour was mandated by RFC1964, but has since been deprecated by the more recent Kerberos revisions. ... Some libraries may offer the ability to disable canonicalisation, but that will be controlled as part of your Kerberos configuration, rather than in the OpenSSH code. ...
    (SSH)
  • Re: Windows 2008 Trust To MIT Kerberos Server
    ... What method did you use to point your client to the MIT realm? ... However my point is that there is no traffic happening between my Active Directory Server and the MIT Kerberos Server. ... I can connect between the AD and MIT Kerberos server using other protocols like RDP and SSH as well as ping both directions but Windows is never requesting a TGT from the MIT Kerberos Server. ...
    (microsoft.public.windows.server.active_directory)
  • MITKRB5-SA-2008-001: double-free, uninitialized data vulnerabilities in krb5kdc
    ... When Kerberos 4 support is enabled in the MIT Kerberos 5 KDC, ... MIT Kerberos security advisory page at: ...
    (Bugtraq)
  • MITKRB5-SA-2008-001: double-free, uninitialized data vulnerabilities in krb5kdc
    ... When Kerberos 4 support is enabled in the MIT Kerberos 5 KDC, ... MIT Kerberos security advisory page at: ...
    (comp.protocols.kerberos)