Re: GSSAPI and OpenSSH

On 5 Mar 2008, at 10:53, Jimmy Stewpot wrote:

> Within the environment we currently have "roving users" which work  
> from home/on the road etc. These users are all running some variety  
> of OSX or Linux on their desktops. For them to be able to access  
> the systems is enabling GSSAPI authentication in their SSH enough  
> or do they have to have the full kerberos running on their systems?

I'm not sure what you mean by 'full Kerberos'. In order to use GSSAPI  
authentication the machine must be installed as a Kerberos client.  
Essentially this means that it must have the Kerberos libraries  
installed and possibly have some minimal configuration performed  
(exactly what this entails depends upon how your cell is configured -  
in our case we can use Fedora, Debian and Mac OS X 'out of the box').

They will have to run the 'kinit' command on their local machine to  
obtain Kerberos credentials before running ssh.

> We currently have systems which require staging to on the internal  
> network, Currently we have the ssh-agent running to allow the  
> forwarding of key based requests back to the remote desktop. Does  
> this functionality still work with GSSAPI or is there no longer a  
> need to have the agent running?

Kerberos credential delegation will replace the need for the ssh-agent.

Cheers,

Simon.