CODEWITHSUNDEEP
macosauthenticationsshkerberosgssapi
Nicholas Terry
Nicholas Terry

Reputation: 1930

SSH/Kerberos not working on OSX

So I have tried and tried to get my ssh to work with kerberos on Mavericks to no avail. Here are my versions:

ssh: OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
kerberos: Heimdal 1.5.1apple1

I also tried the built in ssh with no effect as well. Here is my config:

ForwardAgent yes
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
GSSAPIKeyExchange yes

i have checked, there are no overriding settings in my user config

After all of this, I still get prompted for a password when ssh'ing to a linux host that does work with linux clients. (I am able to successfully kinit and i do get a ticket)

Any clues what I am missing? Has anyone has this problem before.

HERE is a link to the ssh connection log. It just seems to abandon gssapi without even trying it... why????

Upvotes: 0

Views: 3948

Answers (2)

Nicholas Terry
Nicholas Terry

Reputation: 1930

NOTE ON OSX SIERRA:

It appears that Apple broke it again.... The gssapitrusdns stuff is actually a third-party contribution and Apple revved to a newer ssh that doesn't include those patches... See HERE and HERE

ORIGINAL ANSWER (pre Sierra):

Ok, so after even more head-scratching, giving up, and violent attempts to strangle my computer with a power cord, I have found the answer... Turns out, OSX need to be told to explicitly trust DNS.... Add the following line to your ssh config:

GSSAPITrustDNS yes

Source (check the 'Problems and Workarounds' section)

Upvotes: 3

Sujal Sheth
Sujal Sheth

Reputation: 392

From the logs it looks like server is sending "gssapi-keyex,gssapi-with-mic" methods but somehow client doesn't have support for it. Look at this logs

preferred publickey,keyboard-interactive,password

can you check your client whether it supports it or not ? you can check client config file /user//.ssh/config -> on linux system.

Upvotes: 0

Related Questions