I want to be able to ssh from a FreeBSD host to a FreeBSD host, using my kerberos ticket generated when I first logged in.
FreeBSD 10.3 with working openldap-sasl-client, kerberos 5 (not heimdal), sssd, ssh, and joined to Active Directory (2008 R2). I had to compile sssd from the /usr/ports source location because by default sssd-ad is not included which I need.
I'm not using winbind, so reference 1 is not helpful. (Nor does FreeBSD have an authconfig command, apparently.)
I can perform a
kinit just fine:
[bgstack15@localhost /]$ kinit bgstack15@EXAMPLE.COM's Password: [bgstack15@localhost /]$ klist Credentials cache: FILE:/tmp/krb5cc_5532829429 Principal: bgstack15@EXAMPLE.COM Issued Expires Principal Aug 18 16:01:16 2016 Aug 19 02:01:16 2016 krbtgt/EXAMPLE.COM@EXAMPLE.COM
After that I can
ssh -K secondhost and it takes me right there.
The issue is I want to be able to generate a Kerberos ticket upon logging in, or at least so I don't have to enter my password in, at all. I used GSSAPI auth to get to localhost, so I got in with a kerberos ticket. Can I pass that one along, perhaps?
What I've already tried
auth sufficient pam_opie.so no_warn no_fake_prompts auth requisite pam_opieaccess.so no_warn allow_local auth sufficient pam_unix.so no_warn auth sufficient pam_krb5.so no_warn use_first_pass forwardable ccache=krb5cc_%u auth required pam_unix.so no_warn try_first_pass account required pam_nologin.so account required pam_login_access.so account sufficient /usr/local/lib/pam_sss.so ignore_unknown_user account required pam_unix.so session optional /usr/local/lib/pam_sss.so session required /usr/local/lib/pam_mkhomedir.so mode=0700 session required pam_permit.so password sufficient /usr/local/lib/pam_sss.so use_authtok password sufficient pam_krb5.so use_authtok forwardable password required pam_unix.so no_warn try_first_pass
I also tried
auth sufficient pam_krb5.so no_warn
There is an option to just run
kinit in the .profile, but I'm trying to avoid entering the password.
Is using pam_exec.so an option?
I can do
echo PASSWORD | kinit --password-file=STDIN which works, so can I call this somehow?
- Similar to this guy, but on FreeBSD 10.3 Initialise Kerberos ticket on ssh login using PAM
- man pam_krb5.so https://www.freebsd.org/cgi/man.cgi?query=pam_krb5&sektion=8
- Similar, but does not get around the no-password issue Get Kerberos ticket with SSH