Contents
Is there a localhost for SSH in Kerberos?
For Kerberos authentication, the SSH client requests a ticket for the host login service on the server; it does that by name, and there is no “localhost” principal ( host/[email protected]) in the KDC database. There couldn’t be, because the database is global, whereas “localhost” means something different on every host.
Can you use Kerberos tickets instead of passwords?
Modern OpenSSH provides support for GSSAPI (Generic Security Services Application Programming Interface) which allows for the use of Kerberos V5 with SSH2 protocols. Users can use Kerberos tickets instead of passwords to SSH to a properly configured SSHD service.
Where do I get Kerberos tickets for OpenSSH?
1 gssapi-keyex is also possible but was not accepted into official OpenSSH. To put the long story short: ideally, Kerberos tickets should be obtained on your terminal (L), either with kinit command or as part of the local login sequence in a so-called “single sign-on” setup.
How does S1 in Kerberos work with SSH?
On S1, PAM (usually pam_krb5 or pam_sss) requests a TGT (ticket-granting ticket) from the Kerberos KDC. S1 obtains a TGT. Old style (without preauth): S1 sends an AS-REQ and receives a AS-REP containing the TGT.
Can you do a passwordless logon on a Kerberos server?
Luckily, from the ssh -v output in your question, we can infer that your server has GSSAPI authentication enabled. This should allow you to perform a passwordless logon, provided you have a valid kerberos ticket for your realm. Do the following: Log on to server2, and run the klist program. This will return something along the following lines:
Can a SSH server ask for a password?
If you now run ssh -K server2, you should be able to log on, and the system should not ask for a password. Please note that due to how Kerberos works, a ticket cache has a limited validity. It is not possible to ask for a ticket cache with validity longer than what the realm administrator configured (which is usually something like 10 hours or so).
How to login to SSH server with OpenSSH?
With OpenSSH running on your server, you can login to your server with the ssh program, using command syntax: ssh