Re: [Samba] SSH SSO without keytab file
- Date: Tue, 15 Jan 2019 10:08:48 +0100
- From: "L.P.H. van Belle via samba" <samba@xxxxxxxxxxxxxxx>
- Subject: Re: [Samba] SSH SSO without keytab file
Lets start here.
Handy for us to know.
AD or member setup?
And I suggest, set this in the ssh server.
# GSSAPI options
Restart the ssh server and try to SSO login.
If its a AD server this should work.
Yes, you dont get home dir etc, end up in / after login, but lets check if this works.
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces@xxxxxxxxxxxxxxx] Namens
> Harpoon via samba
> Verzonden: dinsdag 15 januari 2019 9:45
> Aan: samba@xxxxxxxxxxxxxxx
> Onderwerp: [Samba] SSH SSO without keytab file
> Hi all,
> I've setup a SambaAD server. I joined two Linux test hosts, a
> Windows test host and an SSH server to the domain. Here are
> my requirements:
> 1. I plan to use Samba accounts to authenticate the users for SSH.
> 2. Users shouldn't have to re-enter their passwords to connect to SSH.
> The link at  gives some hints on setting up SSO and SSH.
> But that guide requires creation (and re-creation upon
> password change) of keytab files.
> Is there a way to get SSO without using keytab files? My
> rather theoretical knowledge of Kerberos says that the user
> should get a TGT when logging in for a new session (using
> LightDM). Can't the same TGT be used by ssh client to request
> a ticket from Kerberos Authentication Server for SSH server?
> This approach will save me from management and routine
> re-creation of keytab files.
> Kind regards,
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
To unsubscribe from this list go to the following URL and read the