Hi,
I've been tasked with investigating the possibility of centralized
authentication for my company. I've looked at a number of options and
Kerberized SSH seems to fit the bill.
However, I'm having problems making everything work within a staging
environment.
I'm using my FreeBSD-5.4p2 desktop as a KDC, it's using the default
kerberos OS daemons (Heimdal), kdc, kpasswdd, kadmind.
I have a Centos 3.4 and RedHat ES3 machine and a Windows 2000 box and
would like all clients to be able to talk to all servers (except Win2K).
On the Linux boxen I've recompiled from SRPM the OpenSSH package to use
the gssapi package as per the instuctions at
http://itinfo.mit.edu/answer.php?id=7436.
My FreeBSD is happy authenticate from itself to itself via its own KDC.
The Linux boxen are happy to authenticate with themselves and with each
other via the FreeBSD KDC.
However the I can't get my FreeBSD box to talk the linuces and vice
versa. I believe the issue here is FreeBSD's OpenSSH (3.8.1p1) using
gssapi-with-mic and the Linux boxen running OpenSSH-3.6.1p2 with a
backport of Simon Wilkinson's gssapi patch (not gssapi-with-mic).
So, my first question is, is there any easy way to resolve this? I
would much rather use a stock-ish OpenSSH RPM than roll my own.
The Windows Kerberized PuTTY client works fine and will authenticate
with everyone, (so I know it can be done ;-). However I've just
downloaded WinSCP 375 beta which claims to have SSH2/MIT Kerberos V
support.
It will connect to my FreeBSD box (Heimdal) but not to the Linux boxen
(MIT) I can't get any kind of logging to find out where it's failing.
My second question is: Can anyone help with this? Perhaps this should go
to the WinSCP developers, so I apologise if this is the case in advance.
It's hard to find a mailing that covers all the systems I'm using.
My third question is: Does anyone have a working network similar to the
above that I can mimic without going through the headaches myself?
Google has not been my friend :-(
Thanks in advance for any advice or help. There's a couple of beers in
it for anyone who lives or works in South London (UK)!!
Regards,
Richard Jones
--
Richard Jones
MSN: msn.co.uk@jonze.com
Y!M: rwkjones
http://www.jonze.com
