Research and Development Network

h1. Kerberized ssh

If you have kerberos properly installed, you will be able to use "kinit <principal>" to get tickets.  Once that is working, you can use those tickets to login to some hosts without using passwords or public keys.

h2. Centos

You will need to install kerberos and pam

<pre>

yum -y install krb5-workstation krb5_pam

authconfig --enablekrb5 --update

</pre>

h2. Setup ssh config

# Edit your @/etc/ssh/ssh_config@ and make sure it has these settings enabled somewhere under the "Host *" entry

<pre>

   ForwardX11 yes

   ForwardX11trusted yes

   GSSAPIAuthentication yes

   GSSAPIDelegateCredentials yes

   GSSAPITrustDNS yes

</pre>

# Even better, put those lines in your ~/.ssh_config like so:

<pre>

Host *

#   ForwardAgent no

#   ForwardX11 no

    ForwardX11Trusted yes

#   RhostsRSAAuthentication no

#   RSAAuthentication yes

#   PasswordAuthentication yes

#   HostbasedAuthentication no

    GSSAPIAuthentication yes

    GSSAPIDelegateCredentials yes

    GSSAPIKeyExchange yes

    GSSAPITrustDNS yes

    SendEnv LANG LC_*

    HashKnownHosts yes

</pre>

# Do a "kinit"

# Try ssh-ing to a host that has been setup for this.  It must have a valid Kerberos srvtab and DNS to work properly.

h2. For giving access to an account different than your username

If you want to allow ssh access for users that are different than it.  (for instance to root)

# Go to the user's homedirectory

# Create/edit a @.k5login@ file in that homedirectory

# Put the list of principals in that file (one per line) that should have access

# @kinit@ and get tickets

# Test by @ssh username@host@ and seeing if it works

# This will also enable the @ksu@ command to give you access when you are logged in locally