0

When setting up sshd with Kerberos on Ubuntu, one needs to "make sure that each each user has a valid account, either on the local host (via adduser or similar), or through a shared source such as LDAP

Why is that?

I can see if you use the GSSAPIAuthentication option or KerberosAuthentication, you've validated the user against a KDC.

Is this simply a matter of needing to map the username to a userid?

jouell
  • 601
  • 1
  • 5
  • 20

2 Answers2

1

I can see if you use the GSSAPIAuthentication option or KerberosAuthentication, you've validated the user against a KDC

KDC validates the principal, not user account. (a principal can be created for a user, service etc.. for KDC, it's all principals and it verifies the identify of the same).

Linux require a username and it's corresponding uid & gid (and few optional attributes) to consider it as a valid user account. KDC has no idea/can't provide these details, hence the user details must be made available to OS via NSS. Depending on the configuration, it can fetch the user details from files [local user], ldap or some other source.

Once OS know it's a valid user account(getent passwd user_name), then you may use any available authentication mechanism (local passwd, ldap auth, kerberos etc..) to validate the user account.

For kerberos auth: the system maps the principal (abc@REALM) to user 'abc' by stripping the REALM portion(by default) and grants access if kerberos validation is successful for principal abc@REALM.

Najmuddin
  • 115
  • 4
0

Kerberos authentication tokens do not give security context, such as group permissions, which ldap provides, only if the credential was valid

Jacob Evans
  • 7,636
  • 3
  • 25
  • 55
  • Thanks - can you expand on 'tokens do not give security context' a bit? Why would I need group perms to login to a box that does not care about groups? – jouell Nov 20 '17 at 05:35
  • You care about groups, just one group being a domain use. Authentication tokens without context have no properties or purpose – Jacob Evans Nov 20 '17 at 11:32
  • Personally, I don't care per se. I am seeking to find out why the server cares. You spoke much about groups. I don't see a connection to login and groups, especially if there are no restrictions at login for groups. One reason I see is being able to map the username to an id for the sake of allowing/denying permissions to file. – jouell Nov 21 '17 at 15:24