welcome: please sign in

Diff for "MemberManual/ShellAccess/PasswordlessLogin"

Differences between revisions 10 and 35 (spanning 25 versions)
Revision 10 as of 2007-06-03 06:09:56
Size: 2494
Comment: Client side firewall setting for krb.
Revision 35 as of 2009-11-25 09:03:15
Size: 4010
Comment:
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
== How to log in to mire without typing your password == #pragma section-numbers off
Line 3: Line 3:
Zeroth, you must have openssh client 4.3 or later. Other versions may work, but we make no guarantees. You will also want the {{{krb5-user}}} package if you are using Debian or Ubuntu. This page explains how to log in to our servers without having to type in a password. We use kerberos for this rather than RSA/DSA public keys. The main reason for doing so is [[MemberManual/DistributedSecurity]]; please see that page if you feel that the procedures described below are unduly cumbersome.
Line 5: Line 5:
First, you must make sure that your `/etc/krb5.conf` (or, on MacOS, your `/Library/Preferences/edu.mit.Kerberos` file) is sane. All you need to do is make sure that there are NOT entries in there which disable the `dns_lookup_kdc` or `dns_lookup_realm` options (unfortunately Fedora ships with these crippled). If you don't see those options in the file, you're fine. An extra benefit is that passwordless logins using kerberos are noticably faster than passwordless logins using public key authentication. This is because kerberos uses symmetric cryptography (which is faster) and requires fewer round-trips during the authentication process.
Line 7: Line 7:
Then, you must obtain kerberos tickets. If your username is "fred", you would do this by typing These instructions have been tested with the major unix variants (Debian, RedHat, Fedora, Ubuntu, MacOSX, etc). There are reports that the ssh client in certain minor distributions does not support this.

<<TableOfContents>>

= Prerequisites =

You must have openssh client 4.3 or later. Other versions may work, but we make no guarantees. You will also want the {{{krb5-user}}} package if you are using Debian or Ubuntu. For Mac OS X 10.5 and later no additional software is required for the instructions below to work; earlier versions of Mac OS X might work if you install the MacPorts version of kerberos+ssh (but no guarantees!). For further details, check out [[MemberManual/TransferringFiles/OpenAFS]], and follow just the Kerberos instructions.

== On Fedora ==

You will need the '''krb5-workstation-clients''' package:
Line 9: Line 19:
   kinit fred@HCOOP.NET # yum -y install krb5-workstation-clients
Line 12: Line 22:
Then type your password when prompted. Note that you MUST capitalize HCOOP.NET and you MUST NOT capitalize your user name. This is important. = Instructions =

Once a Kerberos client has been installed, you must obtain Kerberos tickets. If your username is "fred", you would do this by typing:

{{{
kinit -f fred@HCOOP.NET
}}}

Then type your password when prompted. Note that you '''must''' capitalize HCOOP.NET and you '''must not''' capitalize your user name. This is important.
Line 15: Line 33:
Line 16: Line 35:
   klist klist
Line 18: Line 37:
Line 21: Line 41:
{{{
   ssh -o 'GSSAPIAuthentication yes' -o 'GSSAPIDelegateCredentials yes' mire.hcoop.net
}}}
(GSSAPI is sort of like Kerberos. Don't worry about the difference at this point.)

If that doesn't work, add "`-vvv`" to the command line and copy and paste the ENTIRE output into an email to hcoop-discuss and we'll tell you what's up.

If you do this a lot, you can include the `GSSAPIAuthentication` and `GSSAPIDelegateCredentials` options in your `.ssh/config` file. But you should NOT turn on `GSSAPIDelegateCredentials` for arbitrary hosts (make sure you only enable it for HCOOP hosts). Here's what AdamMegacz uses:
Line 31: Line 43:
Host deleuze.hcoop.net
  ForwardX11Trusted yes
ssh -oGSSAPIAuthentication=yes -oGSSAPIDelegateCredentials=yes fred@mire.hcoop.net
}}}

{{{GSSAPI}}} is the "generic name" for Kerberos-like authentication protocols. The first option tells your ssh client to use your Kerberos tickets to prove your identity to the hcoop servers. The second option tells your ssh client that it is safe to entrust the hcoop servers with a copy of your tickets once you have authenticated.



= Automating things =

If you do this a lot, you can include the `GSSAPIAuthentication` and `GSSAPIDelegateCredentials` options in your `~/.ssh/config` file. But you should NOT turn on `GSSAPIDelegateCredentials` for arbitrary hosts. Make sure you only enable it for HCOOP hosts! You should never, ever use {{{GSSAPIDelegateCredentials}}} on a machine which is operated by somebody other than yourself and HCoop.

Here is an example entry for `~/.ssh/config`:

{{{
Host hcoop
  HostName mire.hcoop.net
Line 35: Line 61:
  User megacz_admin
Host mire.hcoop.net
  ForwardX11Trusted yes
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes
  User megacz_admin
  User fred
Line 43: Line 64:
== Client side firewall Setting ==

If you are using a firewall you might want to open it for UDP packets to and from deleuze.hcoop.net:88. Lines
for [http://www.netfilter.org/ iptables] saved rules ''might'' look like the following:
This will allow you to type the following, instead of the longer command above.
Line 49: Line 67:
 [0:0] -A INPUT -s 69.90.123.67 -p udp -m udp --sport 88 --dport 1024:65535 -j ACCEPT ssh hcoop
Line 52: Line 70:
= Troubleshooting =

Adding "-vvv" to the ssh command line makes it spit out lots of useful debugging information.

If you see something like the following in the output:
Line 53: Line 77:
 [0:0] -A OUTPUT -d 69.90.123.67 -p udp -m udp --dport 88 --sport 1024:65535 -j ACCEPT debug1: Unspecified GSS failure. Minor code may provide more information
Server not found in Kerberos database
Line 56: Line 81:
Put them before any rules that conflicts them (and before 'COMMIT' line in the saved rules file). check to see if you have an /etc/hosts file with the host that you're trying to reach in it. If there is an entry for this host, make sure that the fully-qualified domain name is listed first, before any aliases that you may be using.

== If it still doesn't work ==

See the [[MemberManual/ShellAccess/TroubleshootingKerberos|Troubleshooting Kerberos]] page for more diagnostics. You may also send the output of your ssh command with the "'-vvv'" to hcoop-help and we'll try to figure things out from there.
----
CategoryOutdated

This page explains how to log in to our servers without having to type in a password. We use kerberos for this rather than RSA/DSA public keys. The main reason for doing so is MemberManual/DistributedSecurity; please see that page if you feel that the procedures described below are unduly cumbersome.

An extra benefit is that passwordless logins using kerberos are noticably faster than passwordless logins using public key authentication. This is because kerberos uses symmetric cryptography (which is faster) and requires fewer round-trips during the authentication process.

These instructions have been tested with the major unix variants (Debian, RedHat, Fedora, Ubuntu, MacOSX, etc). There are reports that the ssh client in certain minor distributions does not support this.

Prerequisites

You must have openssh client 4.3 or later. Other versions may work, but we make no guarantees. You will also want the krb5-user package if you are using Debian or Ubuntu. For Mac OS X 10.5 and later no additional software is required for the instructions below to work; earlier versions of Mac OS X might work if you install the MacPorts version of kerberos+ssh (but no guarantees!). For further details, check out MemberManual/TransferringFiles/OpenAFS, and follow just the Kerberos instructions.

On Fedora

You will need the krb5-workstation-clients package:

# yum -y install krb5-workstation-clients

Instructions

Once a Kerberos client has been installed, you must obtain Kerberos tickets. If your username is "fred", you would do this by typing:

kinit -f fred@HCOOP.NET

Then type your password when prompted. Note that you must capitalize HCOOP.NET and you must not capitalize your user name. This is important.

Next, make sure you have your tickets. To do this, type

klist

You should see your tickets and their expiration dates.

Last, type

ssh -oGSSAPIAuthentication=yes -oGSSAPIDelegateCredentials=yes fred@mire.hcoop.net

GSSAPI is the "generic name" for Kerberos-like authentication protocols. The first option tells your ssh client to use your Kerberos tickets to prove your identity to the hcoop servers. The second option tells your ssh client that it is safe to entrust the hcoop servers with a copy of your tickets once you have authenticated.

Automating things

If you do this a lot, you can include the GSSAPIAuthentication and GSSAPIDelegateCredentials options in your ~/.ssh/config file. But you should NOT turn on GSSAPIDelegateCredentials for arbitrary hosts. Make sure you only enable it for HCOOP hosts! You should never, ever use GSSAPIDelegateCredentials on a machine which is operated by somebody other than yourself and HCoop.

Here is an example entry for ~/.ssh/config:

Host hcoop
  HostName mire.hcoop.net
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes
  User fred

This will allow you to type the following, instead of the longer command above.

ssh hcoop

Troubleshooting

Adding "-vvv" to the ssh command line makes it spit out lots of useful debugging information.

If you see something like the following in the output:

debug1: Unspecified GSS failure.  Minor code may provide more information
Server not found in Kerberos database

check to see if you have an /etc/hosts file with the host that you're trying to reach in it. If there is an entry for this host, make sure that the fully-qualified domain name is listed first, before any aliases that you may be using.

If it still doesn't work

See the Troubleshooting Kerberos page for more diagnostics. You may also send the output of your ssh command with the "'-vvv'" to hcoop-help and we'll try to figure things out from there.


CategoryOutdated

MemberManual/ShellAccess/PasswordlessLogin (last edited 2021-10-17 03:04:21 by RobinTempleton)