gssapi-with-mic and krb5 MIT problems

From: Brendan Bank (brendan-nomail_at_moc.lla4pami)
Date: 10/08/04

  • Next message: Marvin Massih: "Binding Tunnels To Different IP Addresses" 
    Date: Fri, 08 Oct 2004 12:24:53 +0200

    Hi,

    I have a MIT KDC(running 1.3) and I'm trying to get openssl with gssapi working. It used to work for us very well under earlier version of openssh but now it fails. And I'm realy not sure why. I've tried to compile openssh with Heimdal but that failed completely with the error:

    Oct 7 22:28:48 srv1 sshd[37521]: fatal: Couldn't convert client name

    Tried to compile with OpenSSH 3.8 with the Dia

    Below is part of a logfile which is a server running OpenSSH 3.9p1 compiled with the krb5 libs from MIT version 1.3.4

    Client side:

    debug3: remaining preferred: publickey,keyboard-interactive,password
    debug3: authmethod_is_enabled gssapi-with-mic
    debug1: Next authentication method: gssapi-with-mic
    debug2: we sent a gssapi-with-mic packet, wait for reply
    debug1: Authentications that can continue: publickey,gssapi-with-mic,password,keyboard-interactive
    debug2: we did not send a packet, disable method
    debug3: authmethod_lookup publickey
    debug3: remaining preferred: keyboard-interactive,password
    debug3: authmethod_is_enabled publickey

    Server side:

    Oct 7 22:37:47 srv1 sshd[50072]: debug3: Trying to reverse map address a.b.c.d.
    Oct 7 22:37:47 srv1 sshd[50072]: debug1: userauth-request for user brendan service ssh-connection method none
    Oct 7 22:37:47 srv1 sshd[50072]: debug1: attempt 0 failures 0
    Oct 7 22:37:47 srv1 sshd[50072]: debug2: input_userauth_request: setting up authctxt for brendan
    Oct 7 22:37:47 srv1 sshd[50072]: debug2: input_userauth_request: try method none
    Oct 7 22:37:47 srv1 sshd[50072]: Failed none for brendan from a.b.c.d port 2786 ssh2
    Oct 7 22:37:47 srv1 sshd[50072]: debug1: userauth-request for user brendan service ssh-connection method gssapi-with-mic
    Oct 7 22:37:47 srv1 sshd[50072]: debug1: attempt 1 failures 1
    Oct 7 22:37:47 srv1 sshd[50072]: debug2: input_userauth_request: try method gssapi-with-mic
    Oct 7 22:37:47 srv1 sshd[50072]: debug1: \n\n
    Oct 7 22:37:47 srv1 sshd[50072]: Failed gssapi-with-mic for brendan from a.b.c.d port 2786 ssh2
    Oct 7 22:37:47 srv1 sshd[50072]: debug1: userauth-request for user brendan service ssh-connection method keyboard-interactive
    Oct 7 22:37:47 srv1 sshd[50072]: debug1: attempt 2 failures 2

    openssh is complied with :

    ./configure --prefix=/usr/local/openssh --with-md5-passwords --with-pam --with-tcp-wrappers --disable-suid-ssh --with-kerberos5=/usr/local/krb5 --sysconfdir=/usr/local/openssh/etc/ssh --with-privsep-path=/var/empty --without-rpath --with-ssl-dir=/usr --prefix=/usr/local/openssh i386-portbld-freebsd4.10

    Can someone give me some advice how to make openssh/gssapi and MIT krb5 working again?

    Many thanks,

    - Brendan

  • Next message: Marvin Massih: "Binding Tunnels To Different IP Addresses"

    Relevant Pages

    • question about keys
      ... debug2: bits set: 1599/3191 ... debug3: check_host_in_hostfile: match line 1 ... debug1: Host 'serverXXX' is known and matches the RSA host key. ... debug1: Next authentication method: keyboard-interactive ...
      (comp.security.ssh)
    • Assistence with OpenSSH build/config on Red Hat 7.2
      ... OpenSSH mail archives at length but have not found the solution yet. ... debug1: keyboard-interactive devs ... debug3: mm_request_send entering: type 10 ...
      (comp.security.ssh)
    • OpenSSH 3.4p1 on FreeBSD and pam-opie module
      ... OpenSSH 3.4 is having quite a few problems with authentication. ... debug3: Trying to reverse map address 192.168.0.3. ... debug1: userauth-request for user astjean service ssh-connection method ... debug2: input_userauth_request: setting up authctxt for astjean ...
      (comp.security.ssh)
    • RE: OpenSSH protocol 2 wont use identity file
      ... OpenSSH running V2 will ... debug1: Reading configuration data ... debug3: cipher ok: aes128-cbc ... debug2: kex_parse_kexinit: ...
      (SSH)
    • public key auth using exported putty keys.
      ... I have openssh version 3.4p1 on two linux boxes. ... debug1: got SSH2_MSG_SERVICE_ACCEPT ... debug3: preferred publickey,keyboard-interactive,password ... debug3: authmethod_is_enabled publickey ...
      (comp.security.ssh)