I am setting up some debian squeeze boxes in a kerberos realm which will allow users to ssh from machine to machine in the realm without reentering their password.
This was working OK but something has changed meaning that the user is asked for a password on every box whether a valid kerberos ticket is held or not.
I have the following in /etc/ssh/ssh_config on all the boxes:
Code:
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
and in /etc/ssh/sshd_config
Code:
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
However, when ssh'ing from one to another a password is still required.. it seems that the gssapi-with-mic auth method is being skipped for some reason looking at the output of ssh -vvv:
Code:
...
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/testuser/.ssh/id_rsa
debug3: no such identity: /home/testuser/.ssh/id_rsa
debug1: Trying private key: /home/testuser/.ssh/id_dsa
debug3: no such identity: /home/testuser/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
Password:
Once the password is entered the user is allowed in no problems. But I'm puzzled as to why credential delegation isn't working.
Any clues why gssapi-with-mic is being dropped by ssh?
