We have mostly unix/linux server in our data center. We access them from our workstations running windows using putty. All the workstations are part of an AD domain but the servers are not. Kerberos is configured in the workstations and while loging in, the AD is generating kerberos tickets and are visible using command klist.(This is in use currently by sap portal single signon using spnego).

What i am trying to achieve is to use this kerberos ticket for password-less authentication to unix/linux servers using putty. Such as, while logged in to the workstation, using putty to connect, the server access will be based on the kerberos ticket, without the user having to type in any password. Further from that server, one can do ssh and login to other server,without passwords, using the same tickets. Since the linux machines are not part of the AD, a mapping between the AD userids and the local user ids of the servers might be necessary.

I was exploring but couldn't get any solid documentation on this. If anybody have implemented the same at their place,point me to a source which can guide me ,it would be really helpful. Thanks in advance.

  • 2
    The easiest thing to do is probably to set up a FreeIPA domain, join the Linux servers to it, and then set up a trust between the FreeIPA domain and the AD domain. – Michael Hampton Jan 20 '16 at 13:04
  • Thanks for the comment Michael, but creating another domain for the linux machines is not an option. – varun Jan 20 '16 at 14:06
  • What do you mean by "not an option"? – Michael Hampton Jan 20 '16 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.