TL;DR
I want to be able to ssh from a FreeBSD host to a FreeBSD host, using my kerberos ticket generated when I first logged in.
Question
Environment
FreeBSD 10.3 with working openldap-sasl-client, kerberos 5 (not heimdal), sssd, ssh, and joined to Active Directory (2008 R2). I had to compile sssd from the /usr/ports source location because by default sssd-ad is not included which I need.
I'm not using winbind, so reference 1 is not helpful. (Nor does FreeBSD have an authconfig command, apparently.)
I can perform a kinit
just fine:
[bgstack15@localhost /]$ kinit
[email protected]'s Password:
[bgstack15@localhost /]$ klist
Credentials cache: FILE:/tmp/krb5cc_5532829429
Principal: [email protected]
Issued Expires Principal
Aug 18 16:01:16 2016 Aug 19 02:01:16 2016 krbtgt/[email protected]
After that I can ssh -K secondhost
and it takes me right there.
The issue is I want to be able to generate a Kerberos ticket upon logging in, or at least so I don't have to enter my password in, at all. I used GSSAPI auth to get to localhost, so I got in with a kerberos ticket. Can I pass that one along, perhaps?
What I've already tried
Here's my /etc/pam.d/sshd
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
auth sufficient pam_unix.so no_warn
auth sufficient pam_krb5.so no_warn use_first_pass forwardable ccache=krb5cc_%u
auth required pam_unix.so no_warn try_first_pass
account required pam_nologin.so
account required pam_login_access.so
account sufficient /usr/local/lib/pam_sss.so ignore_unknown_user
account required pam_unix.so
session optional /usr/local/lib/pam_sss.so
session required /usr/local/lib/pam_mkhomedir.so mode=0700
session required pam_permit.so
password sufficient /usr/local/lib/pam_sss.so use_authtok
password sufficient pam_krb5.so use_authtok forwardable
password required pam_unix.so no_warn try_first_pass
I also tried
auth sufficient pam_krb5.so no_warn
try_first_pass
forwardable ccache=krb5cc_%u
There is an option to just run kinit
in the .profile, but I'm trying to avoid entering the password.
Is using pam_exec.so an option?
I can do echo PASSWORD | kinit --password-file=STDIN
which works, so can I call this somehow?
References
- Similar to this guy, but on FreeBSD 10.3 Initialise Kerberos ticket on ssh login using PAM
- man pam_krb5.so https://www.freebsd.org/cgi/man.cgi?query=pam_krb5&sektion=8
- Similar, but does not get around the no-password issue Get Kerberos ticket with SSH
- http://web.archive.org/web/20150315074946/http://howtovmlinux.com/articles/infrastructure-management/red-hat-idm/automate-kinit-kerberos-ticket-during-ssh-login.html
Accepted gssapi-with-mic
line.