Bug 113247

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1)
Gecko/20030225

Description of problem:
I am not able to use a public key when connecting to a Fedora Core 1
system (called "leibniz") via ssh.  When attempting to establish a
connection, it fails as follows: 

[aleahy@gregory ~]$ ssh leibniz w
Read from remote host leibniz: Connection reset by peer
[aleahy@gregory ~]$

On closer examination, this problem seems to be limited only to those
who authenticate through the pam_krb5 module.  For instance, if I copy
the authorized_keys file from my account to the root account, I am
able to login to the system as root without a problem:

[aleahy@gregory ~]$ ssh -l root leibniz w
 09:49:52  up 10 days, 23:34,  2 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU  WHAT
root     pts/0    gregory.lab.knet  9:39am  3:10   0.04s  0.04s  -bash
root     pts/1    gregory.lab.knet  9:41am  7:52   0.03s  0.03s  -bash
[aleahy@gregory ~]$

On a Redhat 9 system with identical /etc/pam.d/{sshd,system-auth} and
/etc/krb5.conf files, both of these commands succeed.  

We also use a local LDAP database to hold our UNIX account information
and some authentication information for individuals who do not have
network-wide accounts.  However, I have been able to eliminate this
set-up as a possibility.  'mathlink' is one such account--i.e., it
only exists in the local LDAP directory and does not do any
authentication via kerberos.  When I copy the authorized_keys file
into this account, I am still able to successfully login via ssh:

[aleahy@gregory ~]$ ssh -l mathlink leibniz w
 10:11:09  up 10 days, 23:55,  3 users,  load average: 1.22, 0.93, 0.48
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU  WHAT
root     pts/0    gregory.lab.knet  9:39am  7.00s  0.11s  0.11s  -bash
root     pts/1    gregory.lab.knet  9:41am 29:09   0.03s  0.03s  -bash
root     pts/2    gregory.lab.knet  9:51am 19:04   0.03s  0.03s  -bash
[aleahy@gregory ~]$

Note that our kerberos server is a Windows Active Directory server. 
I've included a copy of /etc/pam.d/system-auth below.


Version-Release number of selected component (if applicable):
pam_krb5-2.0.4-1

How reproducible:
Always

Steps to Reproduce:
1. create .ssh/authorized_keys in affected system
2. ssh to affected system

    

Actual Results:  "Connection reset by peer" error message as described
above.

Expected Results:  login should have succeeded

Additional info:

Here are the contents of /var/log/secure when a public key login
attempt fails:

Jan 10 09:43:58 leibniz sshd[21859]: PAM rejected by account
configuration[7]: Authentication failure
Jan 10 09:43:58 leibniz sshd[21859]: fatal: monitor_read: unsupported
request: 24

Here are the contents of /etc/pam.d/system-auth:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/$ISA/pam_krb5.so use_first_pass
auth        sufficient    /lib/security/$ISA/pam_ldap.so use_first_pass
auth        required      /lib/security/$ISA/pam_deny.so

account     required      /lib/security/$ISA/pam_unix.so
account     [default=bad success=ok user_unknown=ignore
service_err=ignore system_err=ignore] /lib/security/$ISA/pam_ldap.so
account     [default=bad success=ok user_unknown=ignore
service_err=ignore system_err=ignore] /lib/security/$ISA/pam_krb5.so

password    required      /lib/security/$ISA/pam_cracklib.so retry=3 type=
password    sufficient    /lib/security/$ISA/pam_unix.so nullok
use_authtok md5 shadow
password    sufficient    /lib/security/$ISA/pam_krb5.so use_authtok
password    sufficient    /lib/security/$ISA/pam_ldap.so use_authtok
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
session     optional      /lib/security/$ISA/pam_krb5.so
session     optional      /lib/security/$ISA/pam_ldap.so

Here are the contents of /etc/pam.d/sshd:

#%PAM-1.0
auth       required     pam_stack.so service=system-auth
auth       required     pam_nologin.so
account    required     pam_stack.so service=system-auth
password   required     pam_stack.so service=system-auth
session    required     pam_stack.so service=system-auth
session    required     pam_limits.so
session    optional     pam_console.so

Here are the contents of /etc/krb5.conf:

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 ticket_lifetime = 24000
 default_realm = KNOX.EDU
 dns_lookup_realm = false
 dns_lookup_kdc = false

[realms]
 EXAMPLE.COM = {
  kdc = kerberos.example.com:88
  admin_server = kerberos.example.com:749
  default_domain = example.com
 }

 KNOX.EDU = {
  kdc = pugsly.knox.edu:88
  kdc = leibniz.lab.knet.edu
  admin_server = pugsly.knox.edu:749
 }

[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM
 .lab.knet.edu = KNOX.EDU
 lab.knet.edu = KNOX.EDU

[kdc]
 profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
 pam = {
   debug = false
   ticket_lifetime = 36000
   renew_lifetime = 86500
   forwardable = true
   krb4_convert = false
 }