Bug 20504
| Summary: | [PATCH] ssh (openssh) cannot connect to sshd (ssh.com) using kerberos5 | ||
|---|---|---|---|
| Product: | Base System | Reporter: | mark.andrews <mark.andrews> |
| Component: | misc | Assignee: | assar <assar> |
| Status: | Closed FIXED | ||
| Severity: | Affects Only Me | ||
| Priority: | Normal | ||
| Version: | Unspecified | ||
| Hardware: | Any | ||
| OS: | Any | ||
|
Description
mark.andrews
2000-08-09 15:20:01 UTC
Responsible Changed From-To: freebsd-bugs->assar Assar's looking at getting OpenSSH + Heimdal working nicely. Code for this has been added to -current, done somewhat differently from your patch. Could you verify that it works for you too? Thanks. /assar State Changed From-To: open->feedback code has been comitted to do this and mail sent to the originator of the PR asking him to test it > Code for this has been added to -current, done somewhat differently > from your patch. Could you verify that it works for you too? Thanks. > > /assar It looks like the code that was commited addresses the server side of the issue. It does not address the case where OpenSSH is the client which is what my patch addresses. Note 1 I have only got krb5 installed, no krb4 at all. Note 2 supported_authentications is only tested for SSH_AUTH_KRB5 in the cvs repository and that bit is NOT set by the Secure Shell sshd which sets only SSH_AUTH_KRB4 (or as it sees it SSH_AUTH_KERBEROS). Mark Unpatched: /usr/obj/usr/src/secure/usr.bin/ssh/ssh -v bb.rc.vix.com SSH Version OpenSSH_2.3.0, protocol versions 1.5/2.0. Compiled with SSL (0x0090600f). debug: Reading configuration data /usr/home/marka/.ssh/config debug: Applying options for *.vix.com debug: Applying options for * debug: Reading configuration data /etc/ssh/ssh_config debug: Applying options for * debug: ssh_connect: getuid 1001 geteuid 1001 anon 1 debug: Connecting to bb.rc.vix.com [204.152.187.11] port 22. debug: Connection established. debug: Remote protocol version 1.99, remote software version 2.4.0 SSH Secure Shell (non-commercial) debug: match: 2.4.0 SSH Secure Shell (non-commercial) pat ^2\.[2-9]\. debug: Local version string SSH-1.5-OpenSSH_2.3.0 debug: Waiting for server public key. debug: Received server public key (768 bits) and host key (1024 bits). debug: Host 'bb.rc.vix.com' is known and matches the RSA host key. debug: Encryption type: 3des debug: Sent encrypted session key. debug: Installing crc compensation attack detector. debug: Received encrypted confirmation. debug: Doing password authentication. marka@bb.rc.vix.com's password: drugs:src {3086} % Patched ssh -v bb.rc.vix.com SSH Version OpenSSH_2.3.0, protocol versions 1.5/2.0. Compiled with SSL (0x0090600f). debug: Reading configuration data /usr/home/marka/.ssh/config debug: Applying options for *.vix.com debug: Applying options for * debug: Reading configuration data /etc/ssh/ssh_config debug: Applying options for * debug: ssh_connect: getuid 1001 geteuid 1001 anon 1 debug: Connecting to bb.rc.vix.com [204.152.187.11] port 22. debug: Connection established. debug: Remote protocol version 1.99, remote software version 2.4.0 SSH Secure Shell (non-commercial) debug: match: 2.4.0 SSH Secure Shell (non-commercial) pat ^2\.[2-9]\. debug: Local version string SSH-1.5-OpenSSH_2.3.0 debug: Waiting for server public key. debug: Received server public key (768 bits) and host key (1024 bits). debug: Host 'bb.rc.vix.com' is known and matches the RSA host key. debug: Encryption type: 3des debug: Sent encrypted session key. debug: Installing crc compensation attack detector. debug: Received encrypted confirmation. debug: Trying Kerberos V5 authentication. debug: Kerberos V5 authentication accepted. debug: Requesting pty. debug: Requesting X11 forwarding with authentication spoofing. debug: Requesting shell. debug: Entering interactive session. Last login: Thu Mar 1 21:58:41 2001 from drugs.dv.isc.org BSDI BSD/OS 3.1 Kernel #4: Thu Oct 16 16:16:52 MDT 1997 ** Nominum staff mail has been moved from bb to shell.nominum.com ** 1 bb <marka> % Mark -- Mark Andrews, Nominum Inc. 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: Mark.Andrews@nominum.com Mark.Andrews@nominum.com writes: > It looks like the code that was commited addresses the > server side of the issue. It does not address the case > where OpenSSH is the client which is what my patch addresses. Weird, I did try that and it worked for me. > Note 1 I have only got krb5 installed, no krb4 at all. My testing has been with both krb4 and krb5. > Note 2 supported_authentications is only tested for > SSH_AUTH_KRB5 in the cvs repository and that bit is NOT > set by the Secure Shell sshd which sets only SSH_AUTH_KRB4 > (or as it sees it SSH_AUTH_KERBEROS). There's only a SSH_AUTH_KERBEROS now. I'll re-build with only krb5 and test against the Finnish sshd again. /assar I just ran "cvs update" again. This time there was the following changes. Note the auth-krb5.c is for heimdal 0.3e. This set of changes appears to work. Thanks Mark P auth-krb4.c RCS file: /home/ncvs/src/crypto/openssh/auth-krb5.c,v retrieving revision 1.2.2.2 retrieving revision 1.2.2.3 Merging differences between 1.2.2.2 and 1.2.2.3 into auth-krb5.c M auth-krb5.c P auth-passwd.c P auth1.c P auth2.c P readconf.c P readconf.h P servconf.c P servconf.h P ssh.h P sshconnect.c P sshconnect1.c P sshd.c > Mark.Andrews@nominum.com writes: > > It looks like the code that was commited addresses the > > server side of the issue. It does not address the case > > where OpenSSH is the client which is what my patch addresses. > > Weird, I did try that and it worked for me. > > > Note 1 I have only got krb5 installed, no krb4 at all. > > My testing has been with both krb4 and krb5. > > > Note 2 supported_authentications is only tested for > > SSH_AUTH_KRB5 in the cvs repository and that bit is NOT > > set by the Secure Shell sshd which sets only SSH_AUTH_KRB4 > > (or as it sees it SSH_AUTH_KERBEROS). > > There's only a SSH_AUTH_KERBEROS now. > > I'll re-build with only krb5 and test against the Finnish sshd again. > > /assar -- Mark Andrews, Nominum Inc. 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: Mark.Andrews@nominum.com Mark.Andrews@nominum.com writes: > I just ran "cvs update" again. This time there was the following > changes. Note the auth-krb5.c is for heimdal 0.3e. This set of > changes appears to work. Aha, ok. It might have been that not everything was merged into stable at that time. I did my testing with -current (which I should have mentioned). Thanks for your feedback and do tell me if you have any more problem with this. /assar State Changed From-To: feedback->closed submitter says it works for him now |
