MIT Kerberos在对OpenSSH进行身份validation时一直要求input密码

我试图设置一个由Kerberos服务器（KDC），客户机和运行OpenSSH守护进程的服务器组成的简单Kerberos环境。 在build立与服务器机器的SSH连接时，客户端应该通过Kerberos进行身份validation。

我尝试authentication的Kerberos用户的名字是krbuser 。 该用户存在于服务机器上，具有1001的uid。 奇怪的是我用SSHlogin时需要inputKerberos用户的密码。 每次我login。 不仅为我的第一个连接。 这似乎很奇怪，因为Kerberos的整个要点是无需密码进行身份validation。

我在身份validation过程中使用了tcpdump，并注意到客户端正在使用cname root对KDC执行AS-REQ。 这Kerberos的用户名不，我不知道为什么客户端使用这个名字。 正如所料，KDC响应eRR-C-PRINCIPAL-UNKNOWN消息，因为数据库中没有root用户。

对我来说，主要问题似乎是客户端尝试以root身份而不是krbuser进行身份validation。

• Linux域 – 中央authentication和笔记本电脑caching
• 发送NTLM令牌而不是Kerberos票证
• 使用Java和ActiveDirectory的Kerberos身份validation：KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN
• Kerberos令牌大小错误
• 提供基于LDAP信息的Samba访问？

我会在下面发布一些关于我当前configuration的信息。 请让我知道，如果你需要任何额外的信息。

在KDC上：

/etc/krb5.conf

 [logging] default = FILE:/usr/local/krb5/var/log/krb5lib.log kdc = FILE:/usr/local/krb5/var/log/krb5kdc.log admin_server = FILE:/usr/local/krb5/var/log/kadmin.log [libdefaults] default_realm = metz.prac.os3.nl rdns = false # The following krb5.conf variables are only for MIT Kerberos. krb4_config = /etc/krb.conf krb4_realms = /etc/krb.realms kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true [realms] metz.prac.os3.nl = { kdc = krb-0.metz.prac.os3.nl admin_server = krb-0.metz.prac.os3.nl } 

在服务机器上：

/etc/ssh/sshd config （摘录）

 # Kerberos options KerberosAuthentication yes # KerberosGetAFSToken no # KerberosOrLocalPasswd no # KerberosTicketCleanup yes # GSSAPI options GSSAPIAuthentication yes # GSSAPICleanupCredentials yes 

在SSHauthentication期间捕获日志文件：

 debug1: rekey after 4294967296 blocks [preauth] debug1: SSH2_MSG_NEWKEYS received [preauth] debug1: KEX done [preauth] debug1: userauth-request for user root service ssh-connection method none [preauth] debug1: attempt 0 failures 0 [preauth] debug1: PAM: initializing for "root" debug1: PAM: setting PAM_RHOST to "218.65.30.30" debug1: PAM: setting PAM_TTY to "ssh" debug1: userauth-request for user root service ssh-connection method password [preauth] debug1: attempt 1 failures 0 [preauth] debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: restore_uid: 0/0 debug1: Kerberos password authentication failed: Client '[email protected]' not found in Kerberos database debug1: krb5_cleanup_proc called debug1: inetd sockets after dupping: 5, 5 Connection from 145.100.110.115 port 51946 on 145.100.110.116 port 22 debug1: Client protocol version 2.0; client software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 pat OpenSSH* compat 0x04000000 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 debug1: permanently_set_uid: 106/65534 [preauth] debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth] debug1: SSH2_MSG_KEXINIT sent [preauth] debug1: SSH2_MSG_KEXINIT received [preauth] debug1: kex: algorithm: [email protected] [preauth] debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth] debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none [preauth] debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none [preauth] debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth] debug1: rekey after 134217728 blocks [preauth] debug1: SSH2_MSG_NEWKEYS sent [preauth] debug1: expecting SSH2_MSG_NEWKEYS [preauth] debug1: rekey after 134217728 blocks [preauth] debug1: SSH2_MSG_NEWKEYS received [preauth] debug1: KEX done [preauth] debug1: userauth-request for user krbuser service ssh-connection method none [preauth] debug1: attempt 0 failures 0 [preauth] debug1: PAM: initializing for "krbuser" debug1: PAM: setting PAM_RHOST to "145.100.110.115" debug1: PAM: setting PAM_TTY to "ssh" debug1: userauth-request for user krbuser service ssh-connection method gssapi-with-mic [preauth] debug1: attempt 1 failures 0 [preauth] debug1: PAM: password authentication failed for root: Authentication failure Failed password for root from 218.65.30.30 port 18460 ssh2 debug1: userauth-request for user root service ssh-connection method password [preauth] debug1: attempt 2 failures 1 [preauth] debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: restore_uid: 0/0 debug1: Kerberos password authentication failed: Client '[email protected]' not found in Kerberos database debug1: krb5_cleanup_proc called debug1: PAM: password authentication failed for root: Authentication failure Failed password for root from 218.65.30.30 port 18460 ssh2 debug1: userauth-request for user root service ssh-connection method password [preauth] debug1: attempt 3 failures 2 [preauth] debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: restore_uid: 0/0 debug1: Kerberos password authentication failed: Client '[email protected]' not found in Kerberos database debug1: krb5_cleanup_proc called debug1: PAM: password authentication failed for root: Authentication failure Failed password for root from 218.65.30.30 port 18460 ssh2 debug1: userauth-request for user krbuser service ssh-connection method password [preauth] debug1: attempt 2 failures 0 [preauth] debug1: temporarily_use_uid: 1001/1001 (e=0/0) debug1: restore_uid: 0/0 debug1: temporarily_use_uid: 1001/1001 (e=0/0) debug1: restore_uid: 0/0 debug1: do_pam_account: called Accepted password for krbuser from 145.100.110.115 port 51946 ssh2 debug1: monitor_child_preauth: krbuser has been authenticated by privileged process debug1: monitor_read_log: child log fd closed debug1: temporarily_use_uid: 1001/1001 (e=0/0) debug1: ssh_gssapi_storecreds: Not a GSSAPI mechanism debug1: restore_uid: 0/0 debug1: PAM: establishing credentials User child is on pid 20617 debug1: SELinux support disabled debug1: PAM: establishing credentials debug1: permanently_set_uid: 1001/1001 debug1: rekey after 134217728 blocks debug1: rekey after 134217728 blocks debug1: ssh_packet_set_postauth: called debug1: Entering interactive session for SSH2. debug1: server_init_dispatch_20 debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384 debug1: input_session_request debug1: channel 0: new [server-session] debug1: session_new: session 0 debug1: session_open: channel 0 debug1: session_open: session 0: link with channel 0 debug1: server_input_channel_open: confirm session debug1: server_input_global_request: rtype [email protected] want_reply 0 debug1: server_input_channel_req: channel 0 request pty-req reply 1 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req pty-req debug1: Allocating pty. debug1: session_new: session 0 debug1: SELinux support disabled debug1: session_pty_req: session 0 alloc /dev/pts/2 debug1: server_input_channel_req: channel 0 request env reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req env debug1: server_input_channel_req: channel 0 request env reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req env debug1: server_input_channel_req: channel 0 request env reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req env debug1: server_input_channel_req: channel 0 request env reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req env debug1: server_input_channel_req: channel 0 request env reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req env debug1: server_input_channel_req: channel 0 request env reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req env debug1: server_input_channel_req: channel 0 request env reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req env debug1: server_input_channel_req: channel 0 request env reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req env debug1: server_input_channel_req: channel 0 request env reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req env debug1: server_input_channel_req: channel 0 request env reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req env debug1: server_input_channel_req: channel 0 request shell reply 1 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req shell Starting session: shell on pts/2 for krbuser from 145.100.110.115 port 51946 id 0 debug1: Setting controlling tty using TIOCSCTTY. debug1: userauth-request for user root service ssh-connection method password [preauth] debug1: attempt 4 failures 3 [preauth] debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: restore_uid: 0/0 debug1: Kerberos password authentication failed: Client '[email protected]' not found in Kerberos database debug1: krb5_cleanup_proc called debug1: PAM: password authentication failed for root: Authentication failure Failed password for root from 218.65.30.30 port 18460 ssh2 debug1: userauth-request for user root service ssh-connection method password [preauth] debug1: attempt 5 failures 4 [preauth] debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: restore_uid: 0/0 debug1: Kerberos password authentication failed: Client '[email protected]' not found in Kerberos database debug1: krb5_cleanup_proc called debug1: PAM: password authentication failed for root: Authentication failure Failed password for root from 218.65.30.30 port 18460 ssh2 debug1: userauth-request for user root service ssh-connection method password [preauth] debug1: attempt 6 failures 5 [preauth] debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: restore_uid: 0/0 debug1: Kerberos password authentication failed: Client '[email protected]' not found in Kerberos database debug1: krb5_cleanup_proc called debug1: PAM: password authentication failed for root: Authentication failure Failed password for root from 218.65.30.30 port 18460 ssh2 maximum authentication attempts exceeded for root from 218.65.30.30 port 18460 ssh2 [preauth] Disconnecting: Too many authentication failures [preauth] debug1: do_cleanup [preauth] debug1: monitor_read_log: child log fd closed debug1: do_cleanup debug1: PAM: cleanup debug1: Killing privsep child 20604 debug1: audit_event: unhandled event 12 debug1: inetd sockets after dupping: 5, 5 Connection from 218.65.30.30 port 58146 on 145.100.110.116 port 22 debug1: Client protocol version 2.0; client software version nsssh2_4.0.0032 NetSarang Computer, Inc. debug1: no match: nsssh2_4.0.0032 NetSarang Computer, Inc. debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 debug1: permanently_set_uid: 106/65534 [preauth] debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth] debug1: SSH2_MSG_KEXINIT sent [preauth] debug1: SSH2_MSG_KEXINIT received [preauth] debug1: kex: algorithm: diffie-hellman-group14-sha1 [preauth] debug1: kex: host key algorithm: ssh-rsa [preauth] debug1: kex: client->server cipher: aes128-ctr MAC: hmac-sha1 compression: none [preauth] debug1: kex: server->client cipher: aes128-ctr MAC: hmac-sha1 compression: none [preauth] debug1: expecting SSH2_MSG_KEXDH_INIT [preauth] 

在客户机上：

kinit和klistauthentication之前：

 $ kinit -p krbuser $ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: [email protected] Valid starting Expires Service principal 06/15/17 00:24:05 06/15/17 10:24:05 krbtgt/[email protected] renew until 06/16/17 00:23:56 

/etc/ssh/ssh config （摘录）：

  GSSAPIAuthentication yes GSSAPIDelegateCredentials yes # GSSAPIKeyExchange no # GSSAPITrustDNS no 

最后是SSHauthentication：

 $ ssh [email protected] -vvv ... debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for * debug2: resolving "service-0.metz.prac.os3.nl" port 22 debug2: ssh_connect_direct: needpriv 0 debug1: Connecting to service-0.metz.prac.os3.nl [145.***.***.***] port 22. debug1: Connection established. debug1: key_load_public: No such file or directory debug1: identity file /home/client/.ssh/id_rsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/client/.ssh/id_rsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/client/.ssh/id_dsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/client/.ssh/id_dsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/client/.ssh/id_ecdsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/client/.ssh/id_ecdsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/client/.ssh/id_ed25519 type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/client/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 ... debug1: Found key in /home/client/.ssh/known_hosts:3 debug3: send packet: type 21 debug2: set_newkeys: mode 1 debug1: rekey after 134217728 blocks debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug3: receive packet: type 21 debug2: set_newkeys: mode 0 debug1: rekey after 134217728 blocks debug1: SSH2_MSG_NEWKEYS received debug2: key: /home/client/.ssh/id_rsa ((nil)) debug2: key: /home/client/.ssh/id_dsa ((nil)) debug2: key: /home/client/.ssh/id_ecdsa ((nil)) debug2: key: /home/client/.ssh/id_ed25519 ((nil)) debug3: send packet: type 5 debug3: receive packet: type 7 debug1: SSH2_MSG_EXT_INFO received debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512> debug3: receive packet: type 6 debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug3: send packet: type 50 debug3: receive packet: type 51 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_lookup gssapi-keyex debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_is_enabled gssapi-keyex debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug2: we did not send a packet, disable method debug3: authmethod_lookup gssapi-with-mic debug3: remaining preferred: publickey,keyboard-interactive,password debug3: authmethod_is_enabled gssapi-with-mic debug1: Next authentication method: gssapi-with-mic debug3: send packet: type 50 debug2: we sent a gssapi-with-mic packet, wait for reply debug3: receive packet: type 51 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug3: send packet: type 50 debug2: we sent a gssapi-with-mic packet, wait for reply debug3: receive packet: type 51 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug3: send packet: type 50 debug2: we sent a gssapi-with-mic packet, wait for reply debug3: receive packet: type 51 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug3: send packet: type 50 debug2: we sent a gssapi-with-mic packet, wait for reply debug3: receive packet: type 51 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug2: we did not send a packet, disable method debug3: authmethod_lookup publickey debug3: remaining preferred: keyboard-interactive,password debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey ... debug1: Next authentication method: password [email protected]'s password: <entering PW of Kerberos user> !!! debug3: send packet: type 50 debug2: we sent a password packet, wait for reply debug3: receive packet: type 52 debug1: Authentication succeeded (password). Authenticated to service-0.metz.prac.os3.nl ([145.***.***.***]:22). debug1: channel 0: new [client-session] debug3: ssh_session2_open: channel_new: 0 debug2: channel 0: send open debug3: send packet: type 90 debug1: Requesting [email protected] debug3: send packet: type 80 debug1: Entering interactive session. debug1: pledge: network debug3: receive packet: type 80 debug1: client_input_global_request: rtype [email protected] want_reply 0 debug3: receive packet: type 91 debug2: callback start debug2: fd 3 setting TCP_NODELAY debug3: ssh_packet_set_tos: set IP_TOS 0x10 debug2: client_session2_setup: id 0 debug2: channel 0: request pty-req confirm 1 debug3: send packet: type 98 ... debug3: Ignored env _ debug2: channel 0: request shell confirm 1 debug3: send packet: type 98 debug2: callback done debug2: channel 0: open confirm rwindow 0 rmax 32768 debug3: receive packet: type 99 debug2: channel_input_status_confirm: type 99 id 0 debug2: PTY allocation request accepted on channel 0 debug2: channel 0: rcvd adjust 2097152 debug3: receive packet: type 99 debug2: channel_input_status_confirm: type 99 id 0 debug2: shell request accepted on channel 0 Last login: Thu Jun 15 00:28:57 2017 Connection established 

现在klist显示以下票据：

 $ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: [email protected] Valid starting Expires Service principal 06/15/17 00:24:05 06/15/17 10:24:05 krbtgt/[email protected] renew until 06/16/17 00:23:56 06/15/17 00:27:37 06/15/17 10:24:05 host/service-0.metz.prac.os3.nl@ renew until 06/16/17 00:23:56 06/15/17 00:27:37 06/15/17 10:24:05 host/[email protected] renew until 06/16/17 00:23:56 

因此，总结一下：客户端上的Kerberos用户可以通过inputKerberos（！）密码与服务器build立SSH会话。 不是它的UNIX密码。 tcpdump显示客户端authentication为不是Kerberos用户的root ，我不知道为什么它使用这个用户名而不是krbuser 。 这是我用kinit命令使用的那个。

谁能告诉我为什么这个身份validation不能正常工作？ 如果您需要其他信息，请告诉我。 我试图保持简短。

 [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false default_realm = EXAMPLE.COM default_ccache_name = KEYRING:persistent:%{uid} [realms] EXAMPLE.COM = { kdc = kerberos.example.com admin_server = kerberos.example.com } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM 

 [kdcdefaults] kdc_ports = 88 kdc_tcp_ports = 88 [realms] EXAMPLE.COM = { master_key_type = aes256-cts default_principal_flags = +preauth acl_file = /var/kerberos/krb5kdc/kadm5.acl dict_file = /usr/share/dict/words admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal } 

 # Kerberos options #KerberosAuthentication yes #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no #KerberosUseKuserok yes # GSSAPI options GSSAPIAuthentication yes GSSAPICleanupCredentials yes #GSSAPIStrictAcceptorCheck yes #GSSAPIKeyExchange no #GSSAPIEnablek5users no 

 [user01@kerberos ~]$ klist Ticket cache: KEYRING:persistent:1001:1001 Default principal: [email protected] Valid starting Expires Service principal 06/16/2017 07:18:18 06/17/2017 07:18:18 krbtgt/[email protected] 

 [root@client ~]# su - user01 Last login: Fri Jun 16 08:16:28 UTC 2017 from client2.example.com on pts/1 [user01@client ~]$ klist Ticket cache: KEYRING:persistent:1001:1001 Default principal: [email protected] Valid starting Expires Service principal 06/16/2017 08:16:27 06/17/2017 08:16:27 krbtgt/[email protected] 

 [root@client2 jason]# su - user01 Last login: Fri Jun 16 08:18:51 UTC 2017 on pts/0 [user01@client2 ~]$ klist Ticket cache: KEYRING:persistent:1003:1003 Default principal: [email protected] Valid starting Expires Service principal 06/16/2017 08:18:58 06/17/2017 08:18:54 krbtgt/[email protected] 

 [root@client2 jason]# ssh [email protected] Password: Last login: Fri Jun 16 08:17:59 2017 [user01@client ~]$