GSSAPI SSH WIN 2003

From: satya vadali (satyavadali_at_gmail.com)
Date: 07/29/05 

Date: 29 Jul 2005 09:08:47 -0700

I got my GSSAPI authentication working. But, wondering how one restrict
users (if i want to) in reaching my hosts.

My setup:
SSH Server: HP-UX Secure Shell 4.0 (based OpenSSH 4.x)
KDC: Windows 2003
SSH Clients: Putty at this time.
(some how, F-secure SSH client some how not working with GSSAPI)

What I am looking for is:

AllowGroups/AllowUsers/DenyUsers based on their type of authentication.

Ex:
DenyUsers GSSAPI *
AllowGroups GSSAPI my_friends

Other option for me, restrict at service ticket level from Windows AD
2003 level. I am not sure how and is it possible?

Say i have global group in AD called "my friends":
Add my friends to "my friends" group and only users in "my friends"
group will get Service ticket for my HP-UX box.

Can any one give me right pointers in this.

any help in this regards will be helpful to me

thanks
satya

Relevant Pages

  • Re: SSH on 9.1
    ... > SSH works fine from some applications ... You set "PasswordAuthentication" to no. Did you put key material in ... > # Kerberos options ... > # GSSAPI options ...
    (alt.os.linux.suse)
  • OpenSSH 4.2p1 GSSAPI problem
    ... MIT Kerberos utilities all check out, I can get TGTs just fine, ... All GSSAPI and Kerberos options are ... I noticed that the SSH client is getting ... sshd debug dumps don't show anything relevant. ...
    (SSH)
  • SSH and Kerberos 5 revisited
    ... SSH does not support GSSAPI as of yet. ... realize that GSS and Kerberos are technically separate layers, ...
    (comp.security.ssh)