|
Size: 2494
Comment: Client side firewall setting for krb.
|
Size: 2122
Comment: kinit/klist and friends are available on Mac OS 10.3 as well.
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 1: | Line 1: |
| == How to log in to mire without typing your password == | #pragma section-numbers off |
| Line 3: | Line 3: |
| Zeroth, you must have openssh client 4.3 or later. Other versions may work, but we make no guarantees. You will also want the {{{krb5-user}}} package if you are using Debian or Ubuntu. | This page explains how to log in to our servers without having to type in a password. |
| Line 5: | Line 5: |
| First, you must make sure that your `/etc/krb5.conf` (or, on MacOS, your `/Library/Preferences/edu.mit.Kerberos` file) is sane. All you need to do is make sure that there are NOT entries in there which disable the `dns_lookup_kdc` or `dns_lookup_realm` options (unfortunately Fedora ships with these crippled). If you don't see those options in the file, you're fine. | [[TableOfContents]] |
| Line 7: | Line 7: |
| Then, you must obtain kerberos tickets. If your username is "fred", you would do this by typing | = Prerequisites = You must have openssh client 4.3 or later. Other versions may work, but we make no guarantees. You will also want the {{{krb5-user}}} package if you are using Debian or Ubuntu. For Mac OS X 10.3 and later no additional software is required for the instructions below to work. For further details, check out ["MemberManual/TransferringFiles/OpenAFS"], and follow just the Kerberos instructions. = Instructions = Once a Kerberos client hsa been installed, you must obtain Kerberos tickets. If your username is "fred", you would do this by typing: |
| Line 9: | Line 16: |
| kinit fred@HCOOP.NET | kinit fred@HCOOP.NET |
| Line 12: | Line 19: |
| Then type your password when prompted. Note that you MUST capitalize HCOOP.NET and you MUST NOT capitalize your user name. This is important. | Then type your password when prompted. Note that you '''must''' capitalize HCOOP.NET and you '''must not''' capitalize your user name. This is important. |
| Line 15: | Line 22: |
| Line 16: | Line 24: |
| klist | klist |
| Line 18: | Line 26: |
| Line 21: | Line 30: |
| Line 22: | Line 32: |
| ssh -o 'GSSAPIAuthentication yes' -o 'GSSAPIDelegateCredentials yes' mire.hcoop.net | ssh -o 'GSSAPIAuthentication yes' -o 'GSSAPIDelegateCredentials yes' fred@mire.hcoop.net |
| Line 24: | Line 34: |
| Line 28: | Line 39: |
| If you do this a lot, you can include the `GSSAPIAuthentication` and `GSSAPIDelegateCredentials` options in your `.ssh/config` file. But you should NOT turn on `GSSAPIDelegateCredentials` for arbitrary hosts (make sure you only enable it for HCOOP hosts). Here's what AdamMegacz uses: | = Automating things = If you do this a lot, you can include the `GSSAPIAuthentication` and `GSSAPIDelegateCredentials` options in your `~/.ssh/config` file. But you should NOT turn on `GSSAPIDelegateCredentials` for arbitrary hosts (make sure you only enable it for HCOOP hosts). Here is an example entry for `~/.ssh/config`: |
| Line 31: | Line 46: |
| Host deleuze.hcoop.net ForwardX11Trusted yes |
Host mire.hcoop.net |
| Line 35: | Line 49: |
| User megacz_admin Host mire.hcoop.net ForwardX11Trusted yes GSSAPIAuthentication yes GSSAPIDelegateCredentials yes User megacz_admin |
User fred |
| Line 43: | Line 52: |
| == Client side firewall Setting == If you are using a firewall you might want to open it for UDP packets to and from deleuze.hcoop.net:88. Lines for [http://www.netfilter.org/ iptables] saved rules ''might'' look like the following: |
This will allow you to type the following, instead of the longer command above. |
| Line 49: | Line 55: |
| [0:0] -A INPUT -s 69.90.123.67 -p udp -m udp --sport 88 --dport 1024:65535 -j ACCEPT | ssh fred@mire.hcoop.net |
| Line 52: | Line 58: |
| {{{ [0:0] -A OUTPUT -d 69.90.123.67 -p udp -m udp --dport 88 --sport 1024:65535 -j ACCEPT }}} |
= If it doesn't work = |
| Line 56: | Line 60: |
| Put them before any rules that conflicts them (and before 'COMMIT' line in the saved rules file). | See the [:MemberManual/ShellAccess/TroubleshootingKerberos:Troubleshooting Kerberos] page if you run into any problems. |
This page explains how to log in to our servers without having to type in a password.
Prerequisites
You must have openssh client 4.3 or later. Other versions may work, but we make no guarantees. You will also want the krb5-user package if you are using Debian or Ubuntu. For Mac OS X 10.3 and later no additional software is required for the instructions below to work. For further details, check out ["MemberManual/TransferringFiles/OpenAFS"], and follow just the Kerberos instructions.
Instructions
Once a Kerberos client hsa been installed, you must obtain Kerberos tickets. If your username is "fred", you would do this by typing:
kinit fred@HCOOP.NET
Then type your password when prompted. Note that you must capitalize HCOOP.NET and you must not capitalize your user name. This is important.
Next, make sure you have your tickets. To do this, type
klist
You should see your tickets and their expiration dates.
Last, type
ssh -o 'GSSAPIAuthentication yes' -o 'GSSAPIDelegateCredentials yes' fred@mire.hcoop.net
(GSSAPI is sort of like Kerberos. Don't worry about the difference at this point.)
If that doesn't work, add "-vvv" to the command line and copy and paste the ENTIRE output into an email to hcoop-discuss and we'll tell you what's up.
Automating things
If you do this a lot, you can include the GSSAPIAuthentication and GSSAPIDelegateCredentials options in your ~/.ssh/config file. But you should NOT turn on GSSAPIDelegateCredentials for arbitrary hosts (make sure you only enable it for HCOOP hosts).
Here is an example entry for ~/.ssh/config:
Host mire.hcoop.net GSSAPIAuthentication yes GSSAPIDelegateCredentials yes User fred
This will allow you to type the following, instead of the longer command above.
ssh fred@mire.hcoop.net
If it doesn't work
See the [:MemberManual/ShellAccess/TroubleshootingKerberos:Troubleshooting Kerberos] page if you run into any problems.