[SSSD] SSSD GSSAPI Question

John Hodrien J.H.Hodrien at leeds.ac.uk
Fri Feb 1 11:00:00 UTC 2013


On Fri, 1 Feb 2013, Sumit Bose wrote:

> I guess this might be a limitation of sshd. iirc it will not use all
> tickets from the keytab but only the one that matches
> host/fully.qualified.host.name where the fully.qualified.host.name is
> determined with uname() or gethostname(). This means by default a system
> is only accessible with one fully qualified name with ssh and GSSAPI.

Is this relevant?

      GSSAPIStrictAcceptorCheck
              Determines whether to be strict about the identity of the GSSAPI
              acceptor a client authenticates against. If “yes” then the client
              must authenticate against the host service on the current host-
              name. If “no” then the client may authenticate against any ser-
              vice key stored in the machine’s default store. This facility is
              provided to assist with operation on multi homed machines.  The
              default is “yes”.  Note that this option applies only to protocol
              version 2 GSSAPI connections, and setting it to “no” may only
              work with recent Kerberos GSSAPI libraries.

jh


More information about the sssd-devel mailing list