0

Env:- 16.04.4 LTS (Xenial Xerus) 4.13.0-36-generic

I'm following this article (https://wiki.ubuntu.com/Enterprise/Authentication/KerberosServices ) for setting up kerberised ssh. Tried with domain instead of IP, still no luck..

Also I want to enable these kerberised users needs have sudo access on the machine, so that every kerberised users will get admin prvileges. This can be achieved by adding entry in sudoers file.

For enabling kerberized ssh its not working.

Below is the client configuration.

    $grep -i  ad.ny /etc/krb5.conf 
    kdc = ad.test.edu
    admin_server = ad.test.edu

I'm able to get the kerberos ticket without any issues

$kinit test@AD.TEST.EDU
 Password for test@AD.TEST.EDU: 

Below is the ticket details

 $klist 
 Ticket cache: FILE:/tmp/krb5cc_1000
 Default principal: test@AD.TEST.EDU

   Valid starting       Expires              Service principal
   03/19/2019 16:36:05  03/20/2019 02:36:05  
 krbtgt/AD.TEST.EDU@AD.TEST.EDU

Below is the ssh configuration

 $ grep -v ^# /etc/ssh/sshd_config  | grep -v -e '^$'
  Port 22
  Protocol 2
  HostKey /etc/ssh/ssh_host_rsa_key
  HostKey /etc/ssh/ssh_host_dsa_key
  HostKey /etc/ssh/ssh_host_ecdsa_key
  HostKey /etc/ssh/ssh_host_ed25519_key
  UsePrivilegeSeparation yes
  KeyRegenerationInterval 3600
  ServerKeyBits 1024
  SyslogFacility AUTH
  LogLevel INFO
  LoginGraceTime 120
  PermitRootLogin prohibit-password
  StrictModes yes
  RSAAuthentication yes
  PubkeyAuthentication yes
  IgnoreRhosts yes
  RhostsRSAAuthentication no
  HostbasedAuthentication no
  PermitEmptyPasswords no
  ChallengeResponseAuthentication no
  X11Forwarding yes
  X11DisplayOffset 10
  PrintMotd no
  PrintLastLog yes
  TCPKeepAlive yes
  AcceptEnv LANG LC_*
  Subsystem sftp /usr/lib/openssh/sftp-server
  UsePAM yes
  KerberosAuthentication yes
  KerberosTicketCleanup yes
  GSSAPIAuthentication yes
  GSSAPICleanupCredentials yes

Below is the ssh verbose output

  $ssh -K -v test/AD.TEST.EDU@192.168.115.23
  << .snip>
    ..
   <snip>
  debug1: Authentications that can continue: publickey,gssapi- 
  keyex,gssapi-with-mic,password
  debug1: Trying private key: /Users/test/.ssh/id_dsa
  debug1: Trying private key: /Users/test/.ssh/id_ecdsa
  debug1: Trying private key: /Users/test/.ssh/id_ed25519
  debug1: Trying private key: /Users/test/.ssh/id_xmss
  debug1: Next authentication method: password
  test/AD.TEST.EDU@192.168.115.23's password: 
  • Tried with domain name no luck. Yes the server registered to AD. – user183980 Mar 19 '19 at 13:45
  • Does the server have a keytab installed? – teksisto Mar 19 '19 at 13:48
  • yes keytab installed, here centos 7.x works perfectly. I'm trying to setup on Ubuntu 16.04 desktop. – user183980 Mar 19 '19 at 14:14
  • @SebastianStark tried with this directive, still no luck :( – user183980 Mar 19 '19 at 17:09
  • @SebastianStark I have one doubt, regarding the ssh format to specify the kerberos ID. In my case user=test , domain = AD.TEST.EDU hostname = test.com , so I'm hitting ssh in this format #ssh -vvv test\AD.TEST.EDU@test.com . Please correct me the syntax is correct or not – user183980 Mar 19 '19 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.