Get Kerberos ticket with SSH

Question

I'd like to get a Kerberos 5 ticket when ssh-ing to get to a fully-automated login solution.

Typically, you use kinit first and then ssh:

> kinit user@DOMAIN
user@DOMAIN's Password: (enter password)
> ssh user@host
(successful login)

I'd like to simply run ssh user@host and automatically check for a Kerberos ticket. If one isn't there, I'd like it to get a ticket and then log in.

> kdestroy
> ssh user@host
user@DOMAIN's Password: (enter password)
(successful login)
(log off of host)
> klist
(show ticket info)

I'd like this to be configured on a per-host basis, as not every host I log into supports Kerberos.

Answer 1

I'm assuming you're using OpenSSH, in which case it just doesn't work that way. Besides, getting the TGT is considered the job of the primary authentication program, the client would just be involved in using the TGT to get a service ticket for the client, so if the project did add that functionality, it would look very odd and likely lead to constant confusion on a subject people are already pretty confused on.

That said, you can actually just write a script that wraps around ssh and klist/kinit and either use that directly or alias "ssh" to your script. Once you're executing a script you wrote you can go based off whatever criteria you feel like going off of.

Answer 2

This is actually somewhat possible if you use pam-krb5 in your PAM chain (before normal password). This will automatically check your username and password against kerberos and attempt to fetch a ticket.

This also works for ssh if you have PAM configured correctly (i.e. entry is in common-auth and common-session). So any host which supports Kerberos for login will also grant a ticket on ssh if a principal with the ssh username exists.

Answer 3

Here is the small wrapper script that I'm currently experimenting with:

#!/bin/bash

# Obtains a kerberos TGT if we don't
# already have one, prior to SSH'ing.
klist

if [ $? -eq 1 ]
then
    echo "Obtaining kerberos ticket"
    kinit
fi

/usr/bin/ssh $@