Linux Security Cookbook

4.14. Using Kerberos with SSH

Problem

You want to authenticate to your SSH server via Kerberos-5. We assume you already have an MIT Kerberos-5 infrastructure. [Recipe 4.11]

Solution

Suppose your SSH server and client machines are myserver and myclient, respectively:

1. Make sure your OpenSSH distribution is compiled with Kerberos-5 support on both myserver and myclient. The Red Hat OpenSSH distribution comes this way, but if you’re building your own, use:

   $ ./configure --with-kerberos5 ...

   before building and installing OpenSSH.

2. Configure the SSH server on myserver:

                        /etc/ssh/sshd_config:
   KerberosAuthentication yes
   KerberosTicketCleanup yes

   Decide whether you want sshd to fall back to ordinary password authentication if Kerberos authentication fails:

   KerberosOrLocalPasswd [yes|no]

3. Restart the SSH server:

   myserver# /etc/init.d/sshd restart

4. On myclient, obtain a ticket-granting ticket if you have not already done so, and connect to myserver via SSH. Kerberos-based authentication should occur.

   myclient$ kinit
   Password for username@REALM: ********
   
   myclient$ ssh -1 myserver                     That's the number one, not a lower-case L

Discussion

We use the older SSH-1 protocol:

$ ssh -1 kdc

because OpenSSH supports Kerberos-5 only for SSH-1. This is not ideal, as SSH-1 is deprecated for its known security weaknesses, but SSH-2 has no standard support for Kerberos yet. However, there is a proposal to add it via GSSAPI (Generic Security Services Application Programming Interface, RFC 1964). A set of patches for OpenSSH implements ...