[SSSD] SSSD GSSAPI Question
John Hodrien
J.H.Hodrien at leeds.ac.uk
Fri Feb 1 11:00:00 UTC 2013
On Fri, 1 Feb 2013, Sumit Bose wrote:
> I guess this might be a limitation of sshd. iirc it will not use all
> tickets from the keytab but only the one that matches
> host/fully.qualified.host.name where the fully.qualified.host.name is
> determined with uname() or gethostname(). This means by default a system
> is only accessible with one fully qualified name with ssh and GSSAPI.
Is this relevant?
GSSAPIStrictAcceptorCheck
Determines whether to be strict about the identity of the GSSAPI
acceptor a client authenticates against. If “yes” then the client
must authenticate against the host service on the current host-
name. If “no” then the client may authenticate against any ser-
vice key stored in the machine’s default store. This facility is
provided to assist with operation on multi homed machines. The
default is “yes”. Note that this option applies only to protocol
version 2 GSSAPI connections, and setting it to “no” may only
work with recent Kerberos GSSAPI libraries.
jh
More information about the sssd-devel
mailing list