1

Right, so I am struggling a bit with PAM in Centos7.

I have no idea how to configure it manually and make the changes permanent so that I get a kerberos ticket after a successful ssh login.

The primary authentication method as you can see is winbind and I want it to stay like this.

So far I have in my /etc/pam.d/system-auth which is auto-generated using authconfig:

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient    pam_winbind.so use_first_pass
auth        required      pam_deny.so

In earlier releases I would add:

auth optional       pam_krb5.so       try_first_pass

Any idea how to do this in Centos7? I don't want to use kerberos for authentication as it will probably mess up with everything on a password change.

2 Answers 2

1

Set krb5_auth = yes in /etc/security/pam_winbind.conf. This file should be safe from any updates by authconfig.

You could use auth sufficient pam_winbind.so use_first_pass krb5_auth in pam, but that might be overridden by authconfig.

2
  • Somewhere in the process the server doesn't accept the krb5 ticket that the user sents and fails to just simple password authentication.
    – koullislp
    Apr 21, 2016 at 10:44
  • client ssh-> "debug2: we sent a gssapi-with-mic packet, wait for reply"
    – koullislp
    Apr 21, 2016 at 10:53
1

I ended up using authconfig afterall, which means that I had to prepare a full kerberized environment.

authconfig --enablewinbindkrb5 --update

Note for anyone else who is planning to use this, this command updates the PAM stack, I believe it invalidates the config in /etc/security/pam_winbind.conf and also modifies /etc/samba/smb.conf.

In order to use it properly the machine must have a valid krb5.conf, belong to the domain and have a valid system keytab.

Then on every successful ssh login a krbtgt key will be created which allows ticket generation and usage for authentication. This means that ssh won't ask for a password to login on the next server if it has a proper kerberized setup.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .