https://bugzilla.mindrot.org/show_bug.cgi?id=3203
Bug ID: 3203
Summary: Could default_ccache_name from krb5.conf be used for
GSSAPI connections?
Product: Portable OpenSSH
Version: 8.3p1
Hardware: ix86
OS: Linux
Status: NEW
Severity: enhancement
Priority: P5
Component: Kerberos support
Assignee: unassigned-bugs@mindrot.org
Reporter: toby@inf.ed.ac.uk
Hi there,
I'm filing this bug upstream as suggested in this ubuntu bug report:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1889548
I'll recreate my original text from that ticket here:
"
ssh connections from a client with the following in ssh_config...
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
... to an ubuntu 20.04 machine result in KRB5CCNAME being set to
'FILE:/tmp/krb5cc_[uid]_[random]' despite the following in
/etc/krb5.conf:
[libdefaults]
...
default_ccache_name = KEYRING:persistent:%{uid}
This means that we cannot enforce a policy to use KEYRING ccaches
across our systems. Authentications which go via the pam stack (e.g.
login to the machine at the console or over ssh using a password) can
be configured to use a KEYRING ccache, via libpam-krb5 settings in
/etc/krb5.conf.
The FILE: setting seems to be hard-coded in the openssh code
(auth-krb5.c). It would be great if ssh(gssapi-with-mic) connections
either (a) set KRB5CCNAME to the default_ccache_name value, if set in
/etc/krb5.conf, or (b) didn't set KRB5CCNAME at all, so the system
default is used.
"
Redhat already patch for this, but they patch the upstream source quite
heavily (as do ubuntu, but in different ways).
I'm hoping to spend more time on getting a patch to do this on ubuntu,
but I suspect that wouldn't be of much use upstream.
Would there be interest in implementing this functionality upstream?
Thanks
Toby Blake
School of Informatics
University of Edinburgh
--
You are receiving this mail because:
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
Bug ID: 3203
Summary: Could default_ccache_name from krb5.conf be used for
GSSAPI connections?
Product: Portable OpenSSH
Version: 8.3p1
Hardware: ix86
OS: Linux
Status: NEW
Severity: enhancement
Priority: P5
Component: Kerberos support
Assignee: unassigned-bugs@mindrot.org
Reporter: toby@inf.ed.ac.uk
Hi there,
I'm filing this bug upstream as suggested in this ubuntu bug report:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1889548
I'll recreate my original text from that ticket here:
"
ssh connections from a client with the following in ssh_config...
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
... to an ubuntu 20.04 machine result in KRB5CCNAME being set to
'FILE:/tmp/krb5cc_[uid]_[random]' despite the following in
/etc/krb5.conf:
[libdefaults]
...
default_ccache_name = KEYRING:persistent:%{uid}
This means that we cannot enforce a policy to use KEYRING ccaches
across our systems. Authentications which go via the pam stack (e.g.
login to the machine at the console or over ssh using a password) can
be configured to use a KEYRING ccache, via libpam-krb5 settings in
/etc/krb5.conf.
The FILE: setting seems to be hard-coded in the openssh code
(auth-krb5.c). It would be great if ssh(gssapi-with-mic) connections
either (a) set KRB5CCNAME to the default_ccache_name value, if set in
/etc/krb5.conf, or (b) didn't set KRB5CCNAME at all, so the system
default is used.
"
Redhat already patch for this, but they patch the upstream source quite
heavily (as do ubuntu, but in different ways).
I'm hoping to spend more time on getting a patch to do this on ubuntu,
but I suspect that wouldn't be of much use upstream.
Would there be interest in implementing this functionality upstream?
Thanks
Toby Blake
School of Informatics
University of Edinburgh
--
You are receiving this mail because:
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs