Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

A conclusion is simply the place where someone got tired of thinking.


devel / comp.protocols.kerberos / Re: Using an alternate principal for ssh

SubjectAuthor
o Re: Using an alternate principal for sshGreg Hudson

1
Re: Using an alternate principal for ssh

<mailman.74.1654024125.8148.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=273&group=comp.protocols.kerberos#273

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!feed1.usenet.blueworldhosting.com!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: ghud...@mit.edu (Greg Hudson)
Newsgroups: comp.protocols.kerberos
Subject: Re: Using an alternate principal for ssh
Date: Tue, 31 May 2022 15:08:13 -0400
Organization: TNet Consulting
Lines: 10
Message-ID: <mailman.74.1654024125.8148.kerberos@mit.edu>
References: <622B5998-57E0-450C-88C4-96FA04220AB8@prime.gushi.org>
<410be09d-0680-96f9-ef59-599c0a9996e3@mit.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="17329"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
Thunderbird/91.7.0
To: Dan Mahoney <danm@prime.gushi.org>, kerberos@mit.edu
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=outgoing;
t=1654024123; bh=ga633dPdINf++TAxTZOxz6rzKimjXDrMejvXavo88Qg=;
h=Date:Subject:To:References:From:In-Reply-To;
b=f41zEpHpJrMrTwwxSR+2RmSBjKtPfMoP600DQtQN77r5pumY1oj3csbWQEPoiZh4O
HqrLO7Q2DhYM5k/nMfFLvzte87a+6hjqAYe/SLynaoINDqal3/ivyf0k/qlJlUW+x2
gBdv2lAi5PdL81OJz1vdW1i4vBSXSAA2yej04dAgJ1WzOmSCMp8Rt7fm7qGYIjvu5+
IZ+PTmJ4cFMjOVD+Uyd4KYXbpoydQhzRjNxGx+Lw1rhnuKHj/+vNMd8NAZNoJvywCX
THYG4a99QO0eNHbH7QexpYKNPs8KM4gy7J0Dw6x9I1u11jk1yoM+XB9IhDqRSckByE
kbOL8FO1Cme/g==
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=aznxbD+Z3x1XMWNJvIfsivObWn+CzibrqoG5IDNbtC1Dk7tNFvD+2/ITTFjCR313iyvnR1ghmvhNRWIWraf3q366P5mouHwwqM4oDKBK9wpfN1td/VHNkLwZY8ntDHfZh1ZW7P7azPyHPwwgJy8zAHTcTJ3qEXXxL9FiaGxJmE3pDGhTb1YRFzHI/LLQth/PdpJ/b5qQzJrjFFj6P8ITK/f3O3SMLsquCgTwGKSnRCpW8YSRt4sDvWIQf/yfcB12nXRz+nv3Ff61rJzEY5UYu7h/I0/MF+svQ2cvYZbnvL8gkkU/aRUpvrxIF7lHAkJyPQbswp8szfLwT4gob7a8sw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=ga633dPdINf++TAxTZOxz6rzKimjXDrMejvXavo88Qg=;
b=iGQo8plsP2sm1e+xr3NTNUqasV+3RdHjtn5p2lKXg4qOeXn7X4xOAcgi9DiyfSkmz8S93Jblko3YmNMnH88SorqzD2FG53u/If1dPwkxtayLyFZHPQCA1vXiLLJoz4qYmRi5zWQcIcbsgR0fxgZ60d/Hi/58NooPVzkprvUjzPakWTAw5mwq2hn+OzcBBvvy0XkmOumglBHCgrA6xTUHWHAqPa/fa+8waWhxDpdKtfR0VKK8qBBonA56vzcnHxww/gz4u2bh3zD8XP7LycJfe6WBr5odKqzVNSiU2Djb7OXK1PRMYqslezHZxkIp34d5qGfd+d6dK0tpIDxu7HEh0g==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
18.9.28.11) smtp.rcpttodomain=mit.edu smtp.mailfrom=mit.edu; dmarc=pass
(p=none sp=none pct=100) action=none header.from=mit.edu; dkim=pass
(signature was verified) header.d=mit.edu; arc=none (0)
Authentication-Results: spf=pass (sender IP is 18.9.28.11)
smtp.mailfrom=mit.edu; dkim=pass (signature was verified)
header.d=mit.edu;dmarc=pass action=none header.from=mit.edu;
Received-SPF: Pass (protection.outlook.com: domain of mit.edu designates
18.9.28.11 as permitted sender) receiver=protection.outlook.com;
client-ip=18.9.28.11; helo=outgoing.mit.edu; pr=C
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=outgoing;
t=1654024096; bh=ga633dPdINf++TAxTZOxz6rzKimjXDrMejvXavo88Qg=;
h=Date:Subject:To:References:From:In-Reply-To;
b=iCiBhSNH92rGAG9WP+HNASQC83xhkbeND7cOIEsXCYC7oFQOKhgJbTJ7elCI+gVfM
OtE5c2v6KdAxkVxqUVawKEgzJmBQugQI0l+KetUi5R4IkPv+Z+RToDaHuxNR8xfotP
ChjN8KotEGKx2KvLIcmHnPKTMb/JDOr+O+DEGC/FZe8K8nBdYJFkUjdM5rpGgOOqZB
IPKFclasgCEy2yukENm4QStf8vM6HtFh4D9OODRcT8ZhbUg2HPk6caIOozVen6ZrkL
L/ja9OwFUsdM5Ocj/BC1n44RafVQutc6ZkzRhW5TADKcGz3wHzJQr8Bjzm9WT+AfuD
Y13nGFCSRZhMA==
Content-Language: en-US
In-Reply-To: <622B5998-57E0-450C-88C4-96FA04220AB8@prime.gushi.org>
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: a04aac34-f308-47cd-ef59-08da4338f09c
X-MS-TrafficTypeDiagnostic: BYAPR01MB5622:EE_
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <BYAPR01MB5622AB1BF060A2661A380E66BCDC9@BYAPR01MB5622.prod.exchangelabs.com>
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: E6nMLhBJEaVI4d0ajkvbVx4xj8Af/pkddt3AmrPng1eIdBvMHKodfMxUsRBVyRjRUNz+pFSbYZCzM3G1YqQ/NOApkdO8/WZUzogvohdtG7jFi/rIn6MyUz3HcxAXCixJrDADjNRWxuu4R3PWz5VOcis4zDpT0m7hpz7XwYjjbY1mvSreaapqZNMCwGwY/9PtNzQqd3xDr1rVC0lzFx7HBgw+SyitYp+TJurrWyr+0lxdB8A8NLBBO+tgYd3h6nJzztEG8zqX+KIR5ENYQ2Rf5uGwo/ueWnfNF+5z0j6jdHU9HttpnCKRBCkleL9H+ecwmnRfJ/5NEPhFcPJCo/DxuolrDqbsg3TEdpeXPH6MPqTqifHOz5mX1aCO8Ikki8et6cSBla2Pz7Ab2ebT5US/OBWvQrhLX8o1SjLwYlVgI+X4M14/wdl4xwKEfYtmSRua9HeuNah94LhcL38zeaGISxF8nVRkjQ8Po62b4PxZmjhEtW76u9g6yLtL1m8hi8rEZJyZN9+LsfKgHn+mP1DxZ9UpZePWxnf181qSDLn5hsf6c2x9QyY2zAcZgyL/+FfxHcqnacs8e6Uv80gMX9PWarUb0DVLWv6dXd4Y8RjSbXsADDzQTlhq9hVkmgXzPlX7Yk30/uoJpAqO6VHyW4jcf3jYja5x4xJ26H0qzmK8uOeBkz+QDO/62hiRtMEjlE4x
X-Forefront-Antispam-Report: CIP:18.9.28.11; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:CAL; SFV:NSPM; H:outgoing.mit.edu; PTR:outgoing-auth-1.mit.edu; CAT:NONE;
SFS:(13230001)(4636009)(36756003)(31686004)(31696002)(316002)(6706004)(6636002)(426003)(336012)(83380400001)(8676002)(75432002)(70586007)(68406010)(2616005)(508600001)(4744005)(53546011)(86362001)(956004)(5660300002)(26005)(2906002)(786003)(7696005)(356005)(43740500002);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2022 19:08:25.7736 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: a04aac34-f308-47cd-ef59-08da4338f09c
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT013.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR01MB5622
X-OriginatorOrg: mit.edu
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <410be09d-0680-96f9-ef59-599c0a9996e3@mit.edu>
X-Mailman-Original-References: <622B5998-57E0-450C-88C4-96FA04220AB8@prime.gushi.org>
 by: Greg Hudson - Tue, 31 May 2022 19:08 UTC

On 5/31/22 12:05, Dan Mahoney wrote:
> On most of our boxes, ssh is the ONLY kerberized app, but there's no provision in krb5.conf to say what the default principal based on a username is. None of the PAM modules seem to be able to set it, either. I conjured up an elaborate way to do this by forcing the .k5logindir to be something the users couldn't touch, and forcing a create for each user, but this doesn't help the password case.
>
> Does anyone know of a simple way to accomplish this? There are some clients, like mobile ones, where, VPN or no, kinit'ing is not an option.

The OpenSSH sshd code decides the principal name, not libkrb5. Looking
at the OpenSSH auth-krb5.c, I don't think there's any configurability;
it picks a principal name of
authctxt->pw->pw_name (except on AIX), parses that, and calls
krb5_get_init_creds_password().

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor