Bug 1769833
| Summary: | sshd gssapi authN kerberos credentials not available to pam session | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Abhijit Roy <abroy> |
| Component: | openssh | Assignee: | Jakub Jelen <jjelen> |
| Status: | CLOSED NOTABUG | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.0 | CC: | tmraz |
| Target Milestone: | rc | ||
| Target Release: | 8.0 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-11-12 16:06:48 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Changing the component to openssh. This is completely intentional. In the past, there were too many problems with setting KRB5CCNAME environment variable so we got down to not setting it if the krb5.conf specifies unique location for a user (as in your example). All the tools using kerberos are able to find the tickets without problems. If you insist on having the environment variable set, there is the KerberosUniqueCCache configuration option for you as you already found out. If you have some other use case or need for this variable, please clarify that. Hi, can you clarify this? "too many problems with setting KRB5CCNAME environment variable" One of the examples was bug #1199363. What is the use case that does not work for you without this environment variable set? |
Steps to Reproduce: 1. Ensure that "GSSAPIAuthentication yes" is enabled in sshd_config and restart sshd if necessary 2. Set up krb5.conf and krb5.keytab for kerberos on the ssh server and the ssh client 2a. On the server, set the ticket cache type to "FILE", eg: [libdefaults] default_ccache_name = FILE:/tmp/krb5cc_%{uid} 3. On the ssh client, ensure that GSSAPIAuthentcation and Delegation are on: Host * GSSAPIAuthentication yes GSSAPIDelegateCredentials yes 4. On the client, kinit 5. On the client, ssh username@server 6. In your server session, type in: printenv KRB5CCNAME > > Actual results: > KRB5CCNAME is not set > > Expected results: > > KRB5CCNAME is set, eg: $ printenv KRB5CCNAME FILE:/tmp/krb5cc_261937 > Additional info: > With UsePAM on and doing password authentication, KRB5CCNAME is set (perhaps it is sssd that sets it in this case). Eg: ]$ ssh dwb7@dimension -o GSSAPIAuthentication=no dwb7@dimension's password: Last login: Wed Nov 6 13:59:28 2019 from 128.253.198.20 [dwb7@dimension ~]$ printenv KRB5CCNAME FILE:/tmp/krb5cc_261937 *Also* if in sshd_config, one turns on "KerberosUniqueCCache" (off by default), then with GSSAPIAuthentication, KRB5CCNAME is set: $ ssh dwb7@dimension Last login: Wed Nov 6 14:00:31 2019 from 128.253.198.20 [dwb7@dimension ~]$ printenv KRB5CCNAME FILE:/tmp/krb5cc_261937_0nQT67TinQ So, with KerberosUniqueCCache off (the default) and GSSAPIAuthentication, KRB5CCNAME is not set, and it should be.