Ssh client bug for Kerberos
Hello,
There is a bug in ssh client that is almost 9 year old and a patch has been included in various distributions, but not (yet?) in Arch Linux. This is the link: https://bugzilla.mindrot.org/show_bug.cgi?id=1008
As I'm in an environment using Round-Robin hosts ('srv' generic host name may actually be 'srv-0001', 'srv-0002'...) and we use Kerberos, I cannot connect without giving a password.
Would it be possible to include the patch in the ssh client package? Thank you in advance for your reply.
Hello. It is unlikely -- Arch tends to use vanilla sources where ever possible. You might create a PKGBUILD to build it with your desired patches, or you can make a request that someone do it in the "AUR Issues, Discussion, and PKGBUILD Request" sub-forum. The best way to make a request that the patch be included in the main line is to contact the developers using the mail lists. You are far more likely to attract the right set of eyeballs there.
Similar Messages
-
Hi ,
I am using solaris 4.8 as my ssh server , Mac OS x 10.5 as ssh client and Mac OS X server as my KDC. I am newbie in solaris. I have successfully configured password less ssh with the help of GSSAPI authentication for ssh server on mac machine. But I am not getting any pointers for configuring ssh server in solaries for password less authenitcation using kerberos authentication.
For Mac and linux we can enable GSSAPI authentication in sshd_config file but can we do simillar thing in solaris also ?
Any pointers will be very helpful.Are your client Mac Pros bound to your OD master?
Are you logging-in to the clients with OD accounts?
If both answers are yes, then type this in a Terminal window after logging-in to a client workstation with your OD account:
*kinit username*
(where 'username' is your OD username, you must be logged-in to the client with an OD account, then hit Return)
You should see this:
*Password for [email protected]:* (OD password goes here)
hit Return. then enter this next bit:
klist
and you should see something like this:
*Default principal: [email protected]*
*Valid starting Expires Service principal*
*03/15/08 17:40:28 03/16/08 03:40:34 krbtgt/[email protected] Renew until 03/16/08 17:40:28*
then enter:
*ssh servsername.psc.edu* (hit Return)
you should see your ssh banner (if configured) or just the standard 'Welcome to Darwin!' message.
More info can be found in the man files for klist and kinit. -
My company uses a telnet/ssh client for windows called putty and since they only make it for windows i need something like it. They use the putty client to access the companies wireless internet system on that has an assigned ip. Actually they only use the ssh part of the client so i guess that woudl be fine for me too. If my mac will do it itself that would be great too. I just am completely lost anything would be great.
and if you need to create ssh tunnels, have a look at SSH Tunnel Manager
tunnel manager is not really necessary if your already using the terminal.
ssh -L 5901:localhost:5902 serverip.
The above is an example of creating a listing port making a tunnel for the above port this what people use for tunneling to initiate a vnc session for example. -
Using SSH login to create Kerberos ticket?
Hello everyone,
Using a 10.5 server with Kerberos and GSSAPI, is it possible to get Leopard to take the passphrase used for a user to log in via SSH and have it use that to acquire a new Kerberos ticket?
This would mean that you only have to type in your password once... and not twice (once for SSH and another for the kerberos ticket).
I googled around a bit and I'm at a complete loss. Is this possible under Leopard?
Thank you!If I understand correctly, you want your users to be able to login to ssh via Kerberos?
Yes, but by default it is turned off in the client. You need to enable GSSAPIAuthentication with this configuration statement:
GSSAPIAuthentication yes
You can do it at a user level by entering this into ~/.ssh/config
Or at a workstation level by entering it in /etc/ssh_config (NOT sshd_config) -
Not able to login to FWSM via SSH client
When i am trying to login to FWSM via SSH client and it is throwing an error that "SSH server rejected your password Try again"
Hello,
Not sure how you want me to help. The error says it all! The password is wrong.
Do you have any other username/password that you could use to connect and change yours as it looks you forgot it. Otherwise try to access it via console and change it.
Regards.
Jcarvaja
Senior Network Security and Core Specialist
CCIE #42930, 2-CCNP, JNCIS-SEC
For inmediate assistance hire us at http://inetworks.cr/our-rates/ -
FTP Adapter where FTP server is SSH Tectia Server for IBM z/OS
We are purchasing "SSH Tectia Server for IBM z/OS" as the secure FTP server.
1. Has anyone used this with Oracle FTP Adapter to securely FTP files to the mainframe?
2. What is the best way to maintain the username and password in the oc4j-ra.xml of the FTP adapter?
3. Can this user and password be encrypted?
ThanksHI,
Unfortunately there are some concerns with FTPS connectivity with XI.
As you know SFTP is not yet possible with XI, but somehow you could use FTPS.
Please confirm below things this may help you
1. Please make sure to Activate Secure Storage in the File System after Deploying the SAP Java Cryptographic Toolkit. Check below thread for the detail procedure
http://help.sap.com/saphelp_nw04/helpdata/en/cd/14c93ec2f7df6ae10000000a114084/content.htm
2. You can go for Third Part adapters such as Seeburger adapter AS2, OFTPS etc. for better connectivity with FTPS
refer
EDI Adapter by SeeBurger
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/206e2b65-2ca8-2a10-edad-f2d1391644cb
B2B(EDI) Integration using SAP Netweaver XI and Seeburger AS2 Adapter
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/00f9cdf5-d812-2a10-03b4-aff3bbf792bf
Integrating XI with SeeBurger
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/6dc02f5d-0601-0010-cd9d-f4ff9a7e8c33
3. Search the options of your client's software to find where its public and private keys are stored, these are 2 files present on the FTP server, then put the Public key of the XI server on the Client FTP Server and likewise for the Public Key of the FTP Server on the XI Server.
This enables the SSL handshake, i.e. Exchange of certificates.
Thanks
Swarup -
Unable to create SASL client connection for authentication mechanism [PLAIN
I have problem to use dscc to admin my ds/dps servers, since I the dscc can't contact dscc agent. Though the agent is running on the default port number with network-bind-port of 0.0.0.0, there is nothing I can do to fix it.
I debug the problem, and found following errors in server.log under dscc (deployed on SUN AS 8.2):
Message: Unable to create SASL client connection for authentication mechanism [PLAIN]|#]
[#|2007-08-21T15:28:40.252-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.admin.directory.dcc.util.ViewBeanUtils:appendDebugLine | com.sun.jmx.remote.opt.security.SASLClientHandler.initialize(SASLClientHandler.java:124)|#]
[#|2007-08-21T15:28:40.253-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.admin.directory.dcc.util.ViewBeanUtils:appendDebugLine | com.sun.jmx.remote.opt.security.AdminClient.connectionOpen(AdminClient.java:131)|#]
[#|2007-08-21T15:28:40.254-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.admin.directory.dcc.util.ViewBeanUtils:appendDebugLine | com.sun.jmx.remote.generic.ClientSynchroMessageConnectionImpl.connect(ClientSynchroMessageConnectionImpl.java:71)|#]
[#|2007-08-21T15:28:40.256-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.admin.directory.dcc.util.ViewBeanUtils:appendDebugLine | javax.management.remote.generic.GenericConnector.connect(GenericConnector.java:177)|#]
[#|2007-08-21T15:28:40.257-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.admin.directory.dcc.util.ViewBeanUtils:appendDebugLine | javax.management.remote.jmxmp.JMXMPConnector.connect(JMXMPConnector.java:119)|#]
[#|2007-08-21T15:28:40.258-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.admin.directory.dcc.util.ViewBeanUtils:appendDebugLine | javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:248)|#]
[#|2007-08-21T15:28:40.260-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.admin.directory.dcc.util.ViewBeanUtils:appendDebugLine | com.sun.directory.nquickclient.NquickClient.getJmxConnector(NquickClient.java:816)|#]
[#|2007-08-21T15:28:40.261-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.admin.directory.dcc.util.ViewBeanUtils:appendDebugLine | com.sun.directory.nquickclient.NquickClient.getConnector(NquickClient.java:519)|#]
[#|2007-08-21T15:28:40.262-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.admin.directory.dcc.util.ViewBeanUtils:appendDebugLine | com.sun.directory.nquickclient.NquickClient.getConnectorSystemAuthentication(NquickClient.java:314)|#]
[#|2007-08-21T15:28:40.263-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.admin.directory.dcc.util.ViewBeanUtils:appendDebugLine | com.sun.directory.dcc.core.NquickPool.getSyncServerMBean(NquickPool.java:435)|#]
[#|2007-08-21T15:28:40.264-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.admin.directory.dcc.util.ViewBeanUtils:appendDebugLine | com.sun.directory.dcc.core.NquickPool$1.run(NquickPool.java:320)|#]
[#|2007-08-21T15:28:40.271-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.admin.directory.dcc.util.ViewBeanUtils:appendDebugLine | java.lang.Thread.run(Thread.java:534)|#]
[#|2007-08-21T15:28:40.289-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.ui.taglib.pagetitle.CCPageTitleTag:appendPageTitleAlertAndText | Node has no attributes.|#]
[#|2007-08-21T15:28:40.293-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.ui.taglib.pagetitle.CCPageTitleTag:appendPageActions | Could not obtain pageactions element.|#]
[#|2007-08-21T15:28:40.295-0400|INFO|sun-appserver-pe8.2|javax.enterprise.system.stream.out|_ThreadID=11;|
15:28:40 | httpWorkerThread-8080-0 | com.sun.web.ui.taglib.pagetitle.CCPageTitleTag:appendPageViewsMenu | Could not obtain pageviews element.|#]
Please help if you could figure out what's going on. Thanks!Bug ID: 6551672
Synopsis: SunAS claims "Unable to create SASL client conn for auth mechanism" and do not talk to Cacao
Work Around:
Work arround:
Change the JVM of used by App Server.
Edit the file:
/usr/appserver/config/asenv.conf
and replace
AS_JAVA="/usr/j2se"
by
AS_JAVA="/usr/java"
Then restart your AS domain. -
How to access web server with SSH client
I need to access my web server via SSH. I do not have clue how to go about. I have transmit for ftp but looks like I cannot use SSH with Tranmit.
I guess I need to know:
- What ssh client to I need to get?
- If not detailed instruction provided How do I go about? I know I need the port # and my ip address and I have both of those but not sure what else I am to do.
TIA for the help!Open up Terminal. It's in the Utilities folder.ssh -p <port#> <ipaddress> or, if you need to log on with a different user namessh -p <port#> <username>@<ipaddress>
-
After Security Update today: "Bus error" when starting "ssh" client
Hi,
I'm using OS X 10.5.2 and updated my system with the newest Safari 3.1 and Security Update a few hours ago. After I did this update, I cant use the command-line ssh client anymore. When I start the ssh, I immediately get a "Bus error" on the shell.
Any suggestions?
Thanks, MarcDisk Utility Permission Repair doesn't do any good either.
I now actually use my Parallels VM to ssh thanks to putty but still...
This is what Crash Reporter has to say:
The application ssh quit unexpectedly.
Process: ssh [323]
Path: /usr/bin/ssh
Identifier: ssh
Version: ??? (???)
Code Type: X86 (Native)
Parent Process: bash [189]
Date/Time: 2008-03-18 23:04:56.717 +0100
OS Version: Mac OS X 10.5.2 (9C31)
Report Version: 6
Exception Type: EXCBADACCESS (SIGBUS)
Exception Codes: KERNPROTECTIONFAILURE at 0x0000000000001014
Crashed Thread: 0
Thread 0 Crashed:
0 ??? 0x0004c4e7 0 + 312551
1 ??? 0x0004c56e 0 + 312686
2 ??? 0x0004c7f7 0 + 313335
3 ??? 0x0004b070 0 + 307312
Thread 0 crashed with X86 Thread State (32-bit):
eax: 0x00001000 ebx: 0x0004c7d5 ecx: 0x0004e338 edx: 0x0004e340
edi: 0x0000101c esi: 0x00000000 ebp: 0xbffffa18 esp: 0xbffff9f0
ss: 0x0000001f efl: 0x00010286 eip: 0x0004c4e7 cs: 0x00000017
ds: 0x0000001f es: 0x0000001f fs: 0x00000000 gs: 0x00000037
cr2: 0x00001014
Binary Images:
0x363d8000 - 0x36415fef +ssh ??? (???) <38f6d3ec24f0b372e64c12b15bb319d4> /usr/bin/ssh
0x8fe00000 - 0x8fe2da53 dyld 96.2 (???) <7af47d3b00b2268947563c7fa8c59a07> /usr/lib/dyld
0x90125000 - 0x90129fff libmathCommon.A.dylib ??? (???) /usr/lib/system/libmathCommon.A.dylib
0x90841000 - 0x909a0ff3 libSystem.B.dylib ??? (???) <4899376234e55593b22fc370935f8cdf> /usr/lib/libSystem.B.dylib
0x9316d000 - 0x9317bffd libz.1.dylib ??? (???) <5ddd8539ae2ebfd8e7cc1c57525385c7> /usr/lib/libz.1.dylib
0x9317c000 - 0x931a7fe7 libauto.dylib ??? (???) <42d8422dc23a18071869fdf7b5d8fab5> /usr/lib/libauto.dylib
0x931a9000 - 0x93206ffb libstdc++.6.dylib ??? (???) <04b812dcec670daa8b7d2852ab14be60> /usr/lib/libstdc++.6.dylib
0x936a2000 - 0x937d4fef com.apple.CoreFoundation 6.5.1 (476.10) <d5bed2688a5eea11a6dc3a3c5c17030e> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x93adf000 - 0x93b91ffb libcrypto.0.9.7.dylib ??? (???) <330b0e48e67faffc8c22dfc069ca7a47> /usr/lib/libcrypto.0.9.7.dylib
0x93be1000 - 0x93cc0fff libobjc.A.dylib ??? (???) <a53206274b6c2d42691f677863f379ae> /usr/lib/libobjc.A.dylib
0x93d20000 - 0x93e58ff7 libicucore.A.dylib ??? (???) <afcea652ff2ec36885b2c81c57d06d4c> /usr/lib/libicucore.A.dylib
0x93fbc000 - 0x93fdafff libresolv.9.dylib ??? (???) <0629b6dcd71f4aac6a891cbe26253e85> /usr/lib/libresolv.9.dylib
0x94c9c000 - 0x94d4cfff edu.mit.Kerberos 6.0.12 (6.0.12) <3dd13466876a8fe4549cfc1354233ec3> /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos
0x94d4d000 - 0x94d54ffe libbsm.dylib ??? (???) <d25c63378a5029648ffd4b4669be31bf> /usr/lib/libbsm.dylib
0x95ca0000 - 0x95e6bff7 com.apple.security 5.0.2 (33001) <0788969ffe7961153219be10786da436> /System/Library/Frameworks/Security.framework/Versions/A/Security
0x966d7000 - 0x966defe9 libgcc_s.1.dylib ??? (???) <f53c808e87d1184c0f9df63aef53ce0b> /usr/lib/libgcc_s.1.dylib
0xfffe8000 - 0xfffebfff libobjc.A.dylib ??? (???) /usr/lib/libobjc.A.dylib
0xffff0000 - 0xffff1780 libSystem.B.dylib ??? (???) /usr/lib/libSystem.B.dylib -
Hi Experts,
Can any one explain the client settings in Single SM land scape.
My solman is prompting for Transport Request while I do some SPRO settings.
What is standard client setting for single solman client.
Thanks
SambaHi Kata,
if you only have one SM client, you can change the client settings in SCC4 so as the system will not ask you for transport requests.
nevertheless, depending the number of people involed in working on the seetings of SOLAMN, i would recommend to set up the transport requests, just for the sake of keeping a better control of what is being modified, although these transport requests won´t be transported to any other system and/or client.
In my case, I have only one SOLMAN system, with only one working client. The majority of the SOLMAN customizing has been performed without having to store the information in transport requests although I have in SE06 the system set as modifiable, and in SCC4.
automatic recording of changes for client dependent objects
and "Changes to Repository and cross-client Customizing " option set in Cross-Client Object Changes.
This setting is not prompting for change requests when setting up SMSY (for example), but obligues me to register in transport changes any OSS Note which I have had to apply with SNOTE in order to avoid bugs. And this is very useful, becasue I know exactly how many OSS Notes and which ones I had to apply and when (although I won´t transport it anywhere).
Hope this helps
Antonio -
SSH Clients - What are people using?
What is everybody using for SSH clients to manage their boxes?
Anybody having any real problems getting SSH setup?
Thanks,
~ronHi Ron,
For Windows platform, Secure CRT is a good client , as well as Secure Shell Client. Sun box got SSH client build-in, it is in command line interface, quick and easy as well.
I am using all of them SSH to our cusomter's PIX and routers many times. It is very handy and easy to use.
For setting up SSH in a PIX , router , switch, it might only takes 5 minutes, here is the URL for that:
http://www.cisco.com/warp/customer/707/index.shtml#ssh
Best Regards, -
How to configure Login Modules Stack for Kerberos/LDAP
Hello collegues,
currenty we are working on UME configuration for the following use case.
Clustered portal instance NW2004s running on AIX should be able to authenificate two groups of users.
The first one is described by LDAP Data Source (Sun Directory Server) and using some artificial unique userID. Based on this userID, the SSO Ticket is created to get acces to the backend R/3 system. The LDAP schema has an "userdomain" attribute in it.
The new group using ADS. These users are happy using it, because they have windows-based authentification and don't forced to type any credentials during login.
There are plenty of blogs decribing how to connect ADS (even as a second DataSource) to UME.
There are two unsolved problems:
1. ADS account attributes does not have the userID needed to get an SSO Ticket
2. LDAP DataSource has no ADS password and can not be used for Kerberos authentification.
What could be a solution for this case? I am sure we need an extra login module which enrich the Subject (user, which is already authentificated by SPNego module) with userID, selected from LDAP DataSource based on user attributes.
Is there any other solution? May be I can mix some attributes in a DataSource configuration file?
Best regards
Sergej NaimarkHi Frank,
did you configure the SSO for an individual policy configuration or did you edit and save the changes the ticket policy config? I ask, b/c if you applied the changes to the individual policy config then the SSO with certificates will be used <b>only</b> when you access the applications for that policy config.
You can also double check the login module flags - perhaps the authentication check doesn't reach the ClientCertLM at all.
Since you followed the help portal instruction I assume you've enabled strong crypto - it is required for client cert SSO. Ano easily committed mistake is to also not use the HTTPS port in the access URL.
Let me know if this helps...
Yonko -
Does the N900 have an SSH-client? Or can it run as SSH server?
Support for VPN?
RDP client?
Greetings,
Evert
Regards,
EvertOpenSSH client:
http://maemo.org/downloads/product/raw/Maemo5/openssh-client?get_installfile
OpenSSH server:
http://maemo.org/downloads/product/raw/Maemo5/openssh-server?get_installfile
VNC Viewer:
http://maemo.org/downloads/product/raw/Maemo5/vncviewer?get_installfile
For the LOVE of GOD, please don't download and install build-essentials via apt... the N900 has a very small / partition.. All additional software should be installed into /opt (which is a much larger partition, actually symlinked to /home/opt)
If you install build-essentials you will possibly fill your root partition and effectively hose your device..
If you want to compile packages yourself, you'll need to use the Maemot5 SDK on a desktop.. either to produce the package you want OR to product a copy of gcc etc that installs in /opt..
OR, consult downloads.maemo.org where the package you want may already be listed -
Ssh client with key management
hi,
i search of a ssh client with rsa/dsa key management, and i can't find one
thanks
CNot sure precisely if this is what you're looking for, but Fugu
http://rsug.itd.umich.edu/software/fugu/
seems to be a pretty effective SSH client, with graphical interface.
Does running shh from the Terminal (command line) do what you need? -
LMS-TV SSH-Client with ttermpro
Hello,
Locking for a working SSH-Client-setup with ttermpro instead of putty (that is working, but customer will use tterm) using the campusmgr.properties procedure. With ttermpro "Invalid Host" returned in any case.
thx for help, SteffenI added read & execute access for C:\windows\system32\cmd.exe to everyone (in DE "Jeder") at the Computer where I start the LMS-browser.
Than I launched toplogy in Mozilla, after accessing Telnet in context menu a IE-Explorer Windows opens trying to access /">telnet:///
that shows "Die Webseite kann nicht angezeigt werden", means website is in accessable
The mentioned Regkey in LMS online help was:
[HKEY_LOCAL_ MACHINE\SOFTWARE \Microsoft\ Internet
Explorer\Main\ FeatureControl\ FEATURE_DISABLE_ TELNET_PROTOCOL]
"iexplore.exe" =dword:00000000
I gues it was the produre for the IE Telnet protocol handler???
Maybe you are looking for
-
How can I link to pages in a 2 level popup index/selection tree with java script?
I can do a single level popup index using the java script below (#1) and link the selections to pages but to change to a 2 level popup index selection tree as below (#2) I can't seem to figure out how to link to pages. Any help greatly appreciated.
-
Adobe AIR Launchpad - Not a valid archived project
I am trying to import the Adobe AIR Launchpad application into Adobe Flash Builder and receive "Not a valid archived project" error. I am using; Adobe AIR Launchpad version airlaunchpad_p8_3-0-1_081911 Adobe Flash Builder version 4.
-
Hi all, i have some problem with geting total in alv. so here i put my codeing for my field total . and my field name is "NETWR" and table name is " VBRK " So please help me out as soon as possible. DEFINE m_fieldcat. add 1 to ls_fieldcat-col_p
-
How can I use the report CRMC_ORGMAN_SWITCH_TO_ENH_MODEL
Dear all, I want to change the CRM organization from stardard version to enhanced version.Acoording to the help document, we must using the report CRMC_ORGMAN_SWITCH_TO_ENH_MODEL.But neither this transaction code nor this program in CRM system.Do you
-
Select-string and eliminate the file name of searched file
Is there a way with the select-string command to exclude the file name of the file you are searching and still get the line items that match your results? Similar to the DOS find command results. I am trying to become completely independent of a DO