** Package changed: openssh (Ubuntu) => openssh-gssapi (Ubuntu)
** Summary changed:
- ssh using gssapi will enforce FILE: credentials cache
+ FFe: ssh using gssapi will enforce FILE: credentials cache
** Description changed:
+ [ Introduction ]
+
+ We want to apply the ccache gssapi patch[1] to the Ubuntu src:openssh-
+ gssapi package. The patch was proposed to upstream[3] many years ago,
+ but after a while it stopped making progress.
+
+ Ubuntu has been doing this in a ppa[2] since jammy, including new
+ autopkgtests and and rebases on top of src:openssh in those ubuntu
+ releases, without issues. It's time to do this in the archive for real.
+
+ With the recent split[2] of src:openssh and src:openssh-gssapi, we can
+ apply the patch on src:openssh-gssapi while leaving the main src:openssh
+ package untouched. Should the patch fail to apply to a newer openssh
+ release (a concern we always have), then at least src:openssh can still
+ be built. In all these years since our first jammy attempt (and we are
+ now up to resolute in that ppa), the patch has always applied correctly,
+ and no surprises happened.
+
+ Internally to Canonical, we have a spec[4] where we proposed this work,
+ and with instructions on how to do the rebase on the ppa[2]. Since jammy
+ we have been following that spec, and have experience with the patch.
+
+ [ Behavior description ]
+
+ When a Kerberos ticket is acquired with kinit, the obtained credentials
+ are stored in a credentials cache. The default for this in Ubuntu/Debian
+ systems with MIT Kerberos is FILE:/tmp/krb5cc_<uid>, and comes from the
+ MIT Kerberos library. It can be overridden in /etc/krb5.conf via the
+ default_ccache_name option, which allows other types of credential
+ caches to be selected.
+
+ For example, the default ccache in Fedora systems is KEYRING:
+
+ default_ccache_name = KEYRING:persistent:%{uid}
+
+ When using GSSAPI authentication with openssh with the client option
+ GSSAPIDelegateCredentials, the kerberos ticket is forwarded to the
+ target host, and stored there in a new ccache. Upstream openssh
+ hardcodes the ccache value to FILE:/tmp/krb5cc_<uid>_<random>,
+ regardless of the value of default_ccache_name that comes from the
+ kerberos library (via its default setting, or via overriding it in
+ /etc/krb5.conf on the target host).
+
+ This is unexpected behavior, and sites that by policy are not allowed to
+ store plain text credentials in /tmp (or any other file) have no way to
+ override this behavior without this patch.
+
+ The patch also introduces a new configuration option where this behavior
+ can be reverted, but the default is to honor the target system's
+ /etc/krb5.conf setting for the ccache type.
+
+
+ 1.
https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/0015-openssh-7.7p1-gssapi-new-unique.patch
+ 2.
https://launchpad.net/~canonical-server/+archive/ubuntu/openssh-server-default-ccache
+ 3. https://bugzilla.mindrot.org/show_bug.cgi?id=2775
+ 4.
https://docs.google.com/document/d/1UJDtDNCbDxfaq10inp5nVlisbMh-zwxzpPR0Hp_UrnI/edit?tab=t.0
+
+
+ [ Original Description ]
+
Hi,
ssh connections from a client with the following in ssh_config...
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
... to an ubuntu 20.04 machine result in KRB5CCNAME being set to
'FILE:/tmp/krb5cc_[uid]_[random]' despite the following in
/etc/krb5.conf:
[libdefaults]
- ...
- default_ccache_name = KEYRING:persistent:%{uid}
+ ...
+ default_ccache_name = KEYRING:persistent:%{uid}
This means that we cannot enforce a policy to use KEYRING ccaches across
our systems. Authentications which go via the pam stack (e.g. login to
the machine at the console or over ssh using a password) can be
configured to use a KEYRING ccache, via libpam-krb5 settings in
/etc/krb5.conf.
The FILE: setting seems to be hard-coded in the openssh code (auth-
krb5.c). It would be great if ssh(gssapi-with-mic) connections either
(a) set KRB5CCNAME to the default_ccache_name value, if set in
/etc/krb5.conf, or (b) didn't set KRB5CCNAME at all, so the system
default is used.
Many thanks
Toby Blake
School of Informatics
University of Edinburgh
** Changed in: openssh-gssapi (Ubuntu)
Status: In Progress => New
** Changed in: openssh-gssapi (Ubuntu)
Assignee: Andreas Hasenack (ahasenack) => (unassigned)
** Description changed:
[ Introduction ]
We want to apply the ccache gssapi patch[1] to the Ubuntu src:openssh-
gssapi package. The patch was proposed to upstream[3] many years ago,
but after a while it stopped making progress.
Ubuntu has been doing this in a ppa[2] since jammy, including new
autopkgtests and and rebases on top of src:openssh in those ubuntu
releases, without issues. It's time to do this in the archive for real.
With the recent split[2] of src:openssh and src:openssh-gssapi, we can
apply the patch on src:openssh-gssapi while leaving the main src:openssh
package untouched. Should the patch fail to apply to a newer openssh
release (a concern we always have), then at least src:openssh can still
be built. In all these years since our first jammy attempt (and we are
now up to resolute in that ppa), the patch has always applied correctly,
and no surprises happened.
Internally to Canonical, we have a spec[4] where we proposed this work,
and with instructions on how to do the rebase on the ppa[2]. Since jammy
we have been following that spec, and have experience with the patch.
+
+ Note that the approach taken in the PPA builds is different: there we do
+ two builds of the same src:openssh package: one with the patch applied,
+ another without, and then use the alternatives system at run-time to
+ switch between the implementations. In the request here, we will plainly
+ apply the patch to the builds from src:openssh-gssapi.
[ Behavior description ]
When a Kerberos ticket is acquired with kinit, the obtained credentials
are stored in a credentials cache. The default for this in Ubuntu/Debian
systems with MIT Kerberos is FILE:/tmp/krb5cc_<uid>, and comes from the
MIT Kerberos library. It can be overridden in /etc/krb5.conf via the
default_ccache_name option, which allows other types of credential
caches to be selected.
For example, the default ccache in Fedora systems is KEYRING:
default_ccache_name = KEYRING:persistent:%{uid}
When using GSSAPI authentication with openssh with the client option
GSSAPIDelegateCredentials, the kerberos ticket is forwarded to the
target host, and stored there in a new ccache. Upstream openssh
hardcodes the ccache value to FILE:/tmp/krb5cc_<uid>_<random>,
regardless of the value of default_ccache_name that comes from the
kerberos library (via its default setting, or via overriding it in
/etc/krb5.conf on the target host).
This is unexpected behavior, and sites that by policy are not allowed to
store plain text credentials in /tmp (or any other file) have no way to
override this behavior without this patch.
The patch also introduces a new configuration option where this behavior
can be reverted, but the default is to honor the target system's
/etc/krb5.conf setting for the ccache type.
-
1.
https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/0015-openssh-7.7p1-gssapi-new-unique.patch
2.
https://launchpad.net/~canonical-server/+archive/ubuntu/openssh-server-default-ccache
3. https://bugzilla.mindrot.org/show_bug.cgi?id=2775
4.
https://docs.google.com/document/d/1UJDtDNCbDxfaq10inp5nVlisbMh-zwxzpPR0Hp_UrnI/edit?tab=t.0
-
[ Original Description ]
Hi,
ssh connections from a client with the following in ssh_config...
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
... to an ubuntu 20.04 machine result in KRB5CCNAME being set to
'FILE:/tmp/krb5cc_[uid]_[random]' despite the following in
/etc/krb5.conf:
[libdefaults]
...
default_ccache_name = KEYRING:persistent:%{uid}
This means that we cannot enforce a policy to use KEYRING ccaches across
our systems. Authentications which go via the pam stack (e.g. login to
the machine at the console or over ssh using a password) can be
configured to use a KEYRING ccache, via libpam-krb5 settings in
/etc/krb5.conf.
The FILE: setting seems to be hard-coded in the openssh code (auth-
krb5.c). It would be great if ssh(gssapi-with-mic) connections either
(a) set KRB5CCNAME to the default_ccache_name value, if set in
/etc/krb5.conf, or (b) didn't set KRB5CCNAME at all, so the system
default is used.
Many thanks
Toby Blake
School of Informatics
University of Edinburgh
** Description changed:
[ Introduction ]
We want to apply the ccache gssapi patch[1] to the Ubuntu src:openssh-
gssapi package. The patch was proposed to upstream[3] many years ago,
but after a while it stopped making progress.
Ubuntu has been doing this in a ppa[2] since jammy, including new
- autopkgtests and and rebases on top of src:openssh in those ubuntu
- releases, without issues. It's time to do this in the archive for real.
+ autopkgtests and rebases on top of src:openssh in those ubuntu releases,
+ without issues. It's time to do this in the archive for real.
With the recent split[2] of src:openssh and src:openssh-gssapi, we can
apply the patch on src:openssh-gssapi while leaving the main src:openssh
package untouched. Should the patch fail to apply to a newer openssh
release (a concern we always have), then at least src:openssh can still
be built. In all these years since our first jammy attempt (and we are
now up to resolute in that ppa), the patch has always applied correctly,
and no surprises happened.
Internally to Canonical, we have a spec[4] where we proposed this work,
and with instructions on how to do the rebase on the ppa[2]. Since jammy
we have been following that spec, and have experience with the patch.
Note that the approach taken in the PPA builds is different: there we do
two builds of the same src:openssh package: one with the patch applied,
another without, and then use the alternatives system at run-time to
switch between the implementations. In the request here, we will plainly
apply the patch to the builds from src:openssh-gssapi.
[ Behavior description ]
When a Kerberos ticket is acquired with kinit, the obtained credentials
are stored in a credentials cache. The default for this in Ubuntu/Debian
systems with MIT Kerberos is FILE:/tmp/krb5cc_<uid>, and comes from the
MIT Kerberos library. It can be overridden in /etc/krb5.conf via the
default_ccache_name option, which allows other types of credential
caches to be selected.
For example, the default ccache in Fedora systems is KEYRING:
default_ccache_name = KEYRING:persistent:%{uid}
When using GSSAPI authentication with openssh with the client option
GSSAPIDelegateCredentials, the kerberos ticket is forwarded to the
target host, and stored there in a new ccache. Upstream openssh
hardcodes the ccache value to FILE:/tmp/krb5cc_<uid>_<random>,
regardless of the value of default_ccache_name that comes from the
kerberos library (via its default setting, or via overriding it in
/etc/krb5.conf on the target host).
This is unexpected behavior, and sites that by policy are not allowed to
store plain text credentials in /tmp (or any other file) have no way to
override this behavior without this patch.
The patch also introduces a new configuration option where this behavior
can be reverted, but the default is to honor the target system's
/etc/krb5.conf setting for the ccache type.
1.
https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/0015-openssh-7.7p1-gssapi-new-unique.patch
2.
https://launchpad.net/~canonical-server/+archive/ubuntu/openssh-server-default-ccache
3. https://bugzilla.mindrot.org/show_bug.cgi?id=2775
4.
https://docs.google.com/document/d/1UJDtDNCbDxfaq10inp5nVlisbMh-zwxzpPR0Hp_UrnI/edit?tab=t.0
[ Original Description ]
Hi,
ssh connections from a client with the following in ssh_config...
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
... to an ubuntu 20.04 machine result in KRB5CCNAME being set to
'FILE:/tmp/krb5cc_[uid]_[random]' despite the following in
/etc/krb5.conf:
[libdefaults]
...
default_ccache_name = KEYRING:persistent:%{uid}
This means that we cannot enforce a policy to use KEYRING ccaches across
our systems. Authentications which go via the pam stack (e.g. login to
the machine at the console or over ssh using a password) can be
configured to use a KEYRING ccache, via libpam-krb5 settings in
/etc/krb5.conf.
The FILE: setting seems to be hard-coded in the openssh code (auth-
krb5.c). It would be great if ssh(gssapi-with-mic) connections either
(a) set KRB5CCNAME to the default_ccache_name value, if set in
/etc/krb5.conf, or (b) didn't set KRB5CCNAME at all, so the system
default is used.
Many thanks
Toby Blake
School of Informatics
University of Edinburgh
** Description changed:
[ Introduction ]
We want to apply the ccache gssapi patch[1] to the Ubuntu src:openssh-
gssapi package. The patch was proposed to upstream[3] many years ago,
but after a while it stopped making progress.
Ubuntu has been doing this in a ppa[2] since jammy, including new
autopkgtests and rebases on top of src:openssh in those ubuntu releases,
without issues. It's time to do this in the archive for real.
- With the recent split[2] of src:openssh and src:openssh-gssapi, we can
+ With the recent split[5] of src:openssh and src:openssh-gssapi, we can
apply the patch on src:openssh-gssapi while leaving the main src:openssh
package untouched. Should the patch fail to apply to a newer openssh
release (a concern we always have), then at least src:openssh can still
be built. In all these years since our first jammy attempt (and we are
now up to resolute in that ppa), the patch has always applied correctly,
and no surprises happened.
Internally to Canonical, we have a spec[4] where we proposed this work,
and with instructions on how to do the rebase on the ppa[2]. Since jammy
we have been following that spec, and have experience with the patch.
Note that the approach taken in the PPA builds is different: there we do
two builds of the same src:openssh package: one with the patch applied,
another without, and then use the alternatives system at run-time to
switch between the implementations. In the request here, we will plainly
apply the patch to the builds from src:openssh-gssapi.
[ Behavior description ]
When a Kerberos ticket is acquired with kinit, the obtained credentials
are stored in a credentials cache. The default for this in Ubuntu/Debian
systems with MIT Kerberos is FILE:/tmp/krb5cc_<uid>, and comes from the
MIT Kerberos library. It can be overridden in /etc/krb5.conf via the
default_ccache_name option, which allows other types of credential
caches to be selected.
For example, the default ccache in Fedora systems is KEYRING:
default_ccache_name = KEYRING:persistent:%{uid}
When using GSSAPI authentication with openssh with the client option
GSSAPIDelegateCredentials, the kerberos ticket is forwarded to the
target host, and stored there in a new ccache. Upstream openssh
hardcodes the ccache value to FILE:/tmp/krb5cc_<uid>_<random>,
regardless of the value of default_ccache_name that comes from the
kerberos library (via its default setting, or via overriding it in
/etc/krb5.conf on the target host).
This is unexpected behavior, and sites that by policy are not allowed to
store plain text credentials in /tmp (or any other file) have no way to
override this behavior without this patch.
The patch also introduces a new configuration option where this behavior
can be reverted, but the default is to honor the target system's
/etc/krb5.conf setting for the ccache type.
1.
https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/0015-openssh-7.7p1-gssapi-new-unique.patch
2.
https://launchpad.net/~canonical-server/+archive/ubuntu/openssh-server-default-ccache
3. https://bugzilla.mindrot.org/show_bug.cgi?id=2775
4.
https://docs.google.com/document/d/1UJDtDNCbDxfaq10inp5nVlisbMh-zwxzpPR0Hp_UrnI/edit?tab=t.0
+ 5. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141274
[ Original Description ]
Hi,
ssh connections from a client with the following in ssh_config...
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
... to an ubuntu 20.04 machine result in KRB5CCNAME being set to
'FILE:/tmp/krb5cc_[uid]_[random]' despite the following in
/etc/krb5.conf:
[libdefaults]
...
default_ccache_name = KEYRING:persistent:%{uid}
This means that we cannot enforce a policy to use KEYRING ccaches across
our systems. Authentications which go via the pam stack (e.g. login to
the machine at the console or over ssh using a password) can be
configured to use a KEYRING ccache, via libpam-krb5 settings in
/etc/krb5.conf.
The FILE: setting seems to be hard-coded in the openssh code (auth-
krb5.c). It would be great if ssh(gssapi-with-mic) connections either
(a) set KRB5CCNAME to the default_ccache_name value, if set in
/etc/krb5.conf, or (b) didn't set KRB5CCNAME at all, so the system
default is used.
Many thanks
Toby Blake
School of Informatics
University of Edinburgh
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1889548
Title:
FFe: ssh using gssapi will enforce FILE: credentials cache
To manage notifications about this bug go to:
https://bugs.launchpad.net/openssh/+bug/1889548/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
