Kerberos SSHD

Question

Hello All,
First i don't know if this is the right place for my question but i don't know where else.
I have some Problemes with SSHD and Kerberos on Mac OS X Leopard (10.5.8):
First some configuration:
/Library/Preferences/edu.mit.Kerberos:
KRBREALM means our Kerberos Realm.
[domain_realm]
.dns.domain = KRBREALM
dns.domain = KRBREALM
[libdefaults]
default_realm = KRBREALM
dnslookupkdc = false
forwardable = true
noaddresses = true
[realms]
KRBREALM = {
kdc = 192.168.10.20
admin_server = 192.168.10.20
/etc/authorization:
<key>system.login.console</key>
<dict>
<key>class</key>
<string>evaluate-mechanisms</string>
<key>comment</key>
<string>Login mechanism based rule. Not for general use, yet.</string>
<key>mechanisms</key>
<array>
<string>builtin:smartcard-sniffer,privileged</string>
<string>loginwindow:login</string>
<string>builtin:reset-password,privileged</string>
<string>builtin:auto-login,privileged</string>
<string>builtin:krb5authnoverify,privileged</string>
<string>HomeDirMechanism:login,privileged</string>
<string>HomeDirMechanism:status</string>
<string>MCXMechanism:login</string>
<string>loginwindow:success</string>
<string>loginwindow:done</string>
</array>
</dict>
So if i login in the GUI everything works fine, i can login and become my ticket.
If i login by ssh (and haven't any ticket yet) i can login but don't become any ticket:
[11:55:29]|[USER@MACHINE]|~ $ssh 192.168.10.27 -l test02
Password:
Last login: Fri Sep 18 11:55:27 2009 from 192.168.10.105
krbtestcli03:~ test02$ klist
klist: No Kerberos 5 tickets in credentials cache
krbtestcli03:~ test02$
If i come from another Computer and have already a ticket i can login but then i lost my Ticket...
On other linux machines it works all perfect. Only the mac makes this Problmes....
Here are the logs on the KDC when i login from a other machine (without having a ticket):
Sep 18 12:00:37 krbtestsrv01.KRBREALM krb5kdc[2328](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 192.168.10.27: NEEDED_PREAUTH: test02@KRBREALM for krbtgt/KRBREALM@KRBREALM, Additional pre-authentication required
Sep 18 12:00:37 krbtestsrv01.KRBREALM krb5kdc[2328](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 192.168.10.27: ISSUE: authtime 1253268037, etypes {rep=18 tkt=18 ses=18}, test02@KRBREALM for krbtgt/KRBREALM@KRBREALM
Sep 18 12:00:37 krbtestsrv01.KRBREALM krb5kdc[2328](info): DISPATCH: repeated (retransmitted?) request from 192.168.10.27, resending previous response
Sep 18 12:00:37 krbtestsrv01.KRBREALM krb5kdc[2328](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 192.168.10.27: ISSUE: authtime 1253268037, etypes {rep=18 tkt=18 ses=18}, test02@KRBREALM for krbtgt/KRBREALM@KRBREALM

Answer 1

Try the OS X Server forums. There should be one dealing with directory services, etc. Alternatively, search these forums for Kerberos and SSHD