Re: libapache2-mod-auth-kerb and cross-realm

2014-08-12 Thread Russ Allbery
Jaap Winius writes: > On Tue, 12 Aug 2014 18:20:47 -0700, Russ Allbery wrote: >> That sounds like you didn't get the right aname_to_localname >> configuration in your krb5.conf file, since it can't find a mapping. > Do you mean an auth_to_local mapping in krb5.conf? Yes -- I think there are mul

Re: libapache2-mod-auth-kerb and cross-realm

2014-08-12 Thread Jaap Winius
On Tue, 12 Aug 2014 18:20:47 -0700, Russ Allbery wrote: >> krb5_aname_to_localname() found no mapping for principal >> jwin...@myrealm.com > > That sounds like you didn't get the right aname_to_localname > configuration in your krb5.conf file, since it can't find a mapping. Do you mean an auth_t

Re: libapache2-mod-auth-kerb and cross-realm

2014-08-12 Thread Russ Allbery
Jaap Winius writes: > On Tue, 12 Aug 2014 17:28:06 -0700, Russ Allbery wrote: >> I believe KrbLocalUserMapping calls krb5_aname_to_localname, so another >> option is to leave it on and change, in the Kerberos configuration, how >> local user mapping is done to, for example, treat MYREALM.COM as a

Re: libapache2-mod-auth-kerb and cross-realm

2014-08-12 Thread Jaap Winius
On Tue, 12 Aug 2014 17:28:06 -0700, Russ Allbery wrote: > I believe KrbLocalUserMapping calls krb5_aname_to_localname, so another > option is to leave it on and change, in the Kerberos configuration, how > local user mapping is done to, for example, treat MYREALM.COM as a > second local realm (if

Re: libapache2-mod-auth-kerb and cross-realm

2014-08-12 Thread Russ Allbery
Jaap Winius writes: > First, I started out with this configuration for > libapache2-mod-auth-kerb (v5.4-2 on Debian wheezy): > AuthType Kerberos > KrbAuthRealms EXAMPLE.COM > KrbServiceName Any > Krb5Keytab /etc/apache2/krb5-apache.keytab > KrbLocalUserMapping On > AuthName "Example

libapache2-mod-auth-kerb and cross-realm

2014-08-12 Thread Jaap Winius
Hi folks, As I make progress with my Kerberos configuration for Apache, cross-realm support leaves something to be desired. First, I started out with this configuration for libapache2-mod-auth-kerb (v5.4-2 on Debian wheezy): AuthType Kerberos KrbAuthRealms EXAMPLE.COM KrbServiceName Any

krb5-1.12.2 is released

2014-08-12 Thread Tom Yu
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 The MIT Kerberos Team announces the availability of MIT Kerberos 5 Release 1.12.2. Please see below for a list of some major changes included, or consult the README file in the source tree for a more detailed list of significant changes. RETRIEVING K

Re: libapache2-mod-auth-kerb and multi-homed hosts

2014-08-12 Thread Jaap Winius
On Tue, 12 Aug 2014 08:56:03 -0700, Russ Allbery wrote: > Make sure that you added HTTP keys (all caps), not lowercase http. The > case matters. Okay, I was using lower case. I've changed it to upper case and now it's working. Earlier, I thought I had a lower-case configuration working on a le

Re: libapache2-mod-auth-kerb and multi-homed hosts

2014-08-12 Thread Russ Allbery
Jaap Winius writes: > Until recently, using ssh with Kerberos authentication to connect to > these same hosts was also a problem, until I set GSSAPIStrictAcceptorCheck > to 'off' in sshd_config and added lots of host keys to the system keytab > to match the reverse lookup names of the machine'

Re: Machine authentication

2014-08-12 Thread jarek
Thanks! Dnia 2014-08-09, sob o godzinie 16:20 +0100, Dameon Wagner pisze: > On Sat, Aug 09 2014 at 00:41:07 -0400, Greg Hudson scribbled > in "Re: Machine authentication": > > On 08/08/2014 03:37 AM, jarek wrote: > > > Is it possible to receive ticket for host principal and use > > > this tic

libapache2-mod-auth-kerb and multi-homed hosts

2014-08-12 Thread Jaap Winius
Hi folks, My site has a number of multi-homed Apache web servers for which I can't get Kerberos authentication to work properly. Until recently, using ssh with Kerberos authentication to connect to these same hosts was also a problem, until I set GSSAPIStrictAcceptorCheck to 'off' in sshd_conf