442021-10-17 03:04:21RobinTempletonALL CAPS -> bold or italic for security warnings432021-09-28 18:52:05RobinTempletonstart guix section422017-04-29 17:54:40StephenMichelupdate fedora package name412016-05-09 17:32:56c-174-63-40-76.hsd1.ma.comcast.net402016-05-09 17:31:46c-174-63-40-76.hsd1.ma.comcast.netStraight from the mouth of unkown_lamer392013-10-17 06:00:58DaniilFruminAnother comment about GSSApiTrustDNS382013-10-17 05:56:49DaniilFruminUpdating the ssh config for it to work with Heimdal372013-01-13 18:10:05ClintonEbadignu/cat362010-01-10 08:46:0862.0.105.133352009-11-25 09:03:15wifi-gw.cli.di.unipi.it342009-11-25 08:55:46wifi-gw.cli.di.unipi.itspelling332009-10-22 19:40:33hst-210-178.medicom.bgI just followed the generic steps and it worked perfectly on a 64-bit ArchLinux machine.322009-06-30 03:46:51sca-ea-fw-1.Sun.COM312008-08-27 22:49:15netblock-68-183-203-20.dslextreme.com302008-08-27 22:47:46netblock-68-183-203-20.dslextreme.com292008-08-24 16:05:54netblock-68-183-203-20.dslextreme.com282008-08-24 16:04:48netblock-68-183-203-20.dslextreme.com272008-08-24 16:03:08netblock-68-183-203-20.dslextreme.com262008-08-24 16:02:05netblock-68-183-203-20.dslextreme.com252008-08-24 16:00:14netblock-68-183-203-20.dslextreme.com242008-07-07 04:28:02localhostconverted to 1.6 markup232008-06-17 23:06:28AdamMegacz222008-06-17 16:32:57AdamMegaczssh -> mire212008-05-09 21:44:09DavidCrawshawsimpler ssh_config exampler202008-04-30 14:40:15AdamChlipalamire -> ssh192008-03-08 01:02:40JustinLeitgebadd debugging tip, re-arrange troubleshooting section a bit and update email address for help to hcoop-help.182008-02-26 19:31:17netblock-68-183-198-235.dslextreme.com172008-01-06 20:42:5480-219-208-107.dclient.hispeed.chkinit/klist and friends are available on Mac OS 10.3 as well.162007-12-19 01:58:00pool-71-245-167-55.bltmmd.fios.verizon.netMac OS X Tiger comment152007-11-12 05:14:54MichaelOlsonFix link142007-11-12 04:23:25MichaelOlsonOverhaul132007-11-12 04:14:58MichaelOlsonMake part of member manual122007-11-11 21:38:49bzq-84-108-20-56.cablep.bezeqint.net112007-06-05 02:50:45AdamMegacz102007-06-03 06:09:56AnilNarayananClient side firewall setting for krb.92007-06-03 03:42:21MichaelOlsonMention krb5-user package82007-06-03 01:31:23netblock-68-183-25-2.dslextreme.com72007-06-03 01:29:58netblock-68-183-25-2.dslextreme.com62007-06-03 01:28:51netblock-68-183-25-2.dslextreme.com52007-06-03 01:28:32netblock-68-183-25-2.dslextreme.com42007-06-03 01:10:49netblock-68-183-25-2.dslextreme.com32007-06-03 01:10:39netblock-68-183-25-2.dslextreme.com22007-06-03 01:08:33netblock-68-183-25-2.dslextreme.com12007-06-03 01:07:57netblock-68-183-25-2.dslextreme.comThis page explains how to log in to our servers without having to type in a password. We use MitKerberos for this rather than RSA/DSA public keys. The main reason for doing so is MemberManual/DistributedSecurity; please see that page if you feel that the procedures described below are unduly cumbersome. An extra benefit is that passwordless logins using kerberos are noticably faster than passwordless logins using public key authentication. This is because kerberos uses symmetric cryptography (which is faster) and requires fewer round-trips during the authentication process. These instructions have been tested with the major unix variants (Debian, RedHat, Fedora, Ubuntu, MacOSX, etc). There are reports that the ssh client in certain minor distributions does not support this.

The openssh client 4.3 or later. Other versions may work, but we make no guarantees. The Kerberos 5 client. Installation instructions for various platforms are given below:

For OS X 10.5 and later, no additional software is required for the instructions below to work; earlier versions of Mac OS X might work if you install the MacPorts version of kerberos+ssh (but no guarantees!). For further details, check out MemberManual/TransferringFiles/OpenAFS, and follow just the Kerberos instructions.

You need the openssh-client and krb5-user packages:

You will need the krb5-workstation package:

You will need the mit-krb5 package:

Once a Kerberos client has been installed, you must obtain Kerberos tickets. If your username is "fred", you would do this by typing: Then type your password when prompted. (!) Important: You must capitalize HCOOP.NET and you must not capitalize your user name. Next, make sure you have your tickets. To do this, type You should see your tickets and their expiration dates. Last, type GSSAPI is the "generic name" for Kerberos-like authentication protocols. The first option tells your ssh client to use your Kerberos tickets to prove your identity to the hcoop servers. The second option tells your ssh client that it is safe to entrust the hcoop servers with a copy of your tickets once you have authenticated. If it still asks you for a password, you might have to add the -oGSSAPITrustDNS=yes option. Upon first invocation you might be asked to add the RSA public key of ssh.hcoop.net to the list of known hosts. This message looks something like this: Type yes to permanently store the fingerprint in ~/.ssh/known_hosts .

If you do this a lot, you can include the GSSAPIAuthentication and GSSAPIDelegateCredentials options in your ~/.ssh/config file. But you should not turn on GSSAPIDelegateCredentials for arbitrary hosts. Make sure you only enable it for HCoop hosts! You should never, ever use GSSAPIDelegateCredentials on a machine which is operated by somebody other than yourself and HCoop. Here is an example entry for ~/.ssh/config: This will allow you to type the following, instead of the longer command above.

Adding "-vvv" to the ssh command line makes it spit out lots of useful debugging information. If you see something like the following in the output: check to see if you have an /etc/hosts file with the host that you're trying to reach in it. If there is an entry for this host, make sure that the fully-qualified domain name is listed first, before any aliases that you may be using.

The likely cause is that you are trying to exchange Kerberos tickets and have none.

See the Troubleshooting Kerberos page for more diagnostics. You may also send the output of your ssh command with the "'-vvv'" to hcoop-help and we'll try to figure things out from there. CategoryMemberManual CategoryNeedsWork