Unable to authenticate ssh via krb5 / PAM

Question

Anyone able to help with a PAM / krb5 issue? I've got it to the point where it will generate a ticket with kinit and my principal and password, (shown with klist) when I try to ssh to my test box though, ssh authentication fails. looking through the logs (with debugging on, it looks like it's getting past the password check and then failing on something else? In otherwords, everything from the PAM-KRB5 module is indicating a success in the logs(PAM-KRB5 (auth): end: Success), but immediately after that, I get the following coming from sshd : Keyboard-interactive (PAM) userauth failed[7] while authorizing: Permission denied. Is it authenticating against more than one stack maybe?
Relevant stack lines from pam.conf (as far as I know) are:
sshd-kbdint auth required pam_unix_cred.so.1 debug
sshd-kbdint auth binding pam_krb5.so.1 debug
sshd-kbdint auth required pam_unix_auth.so.1 debug
Note* I've tried using both binding and sufficient for pam_krb5.so.1, keytab check is turned off via krb5.conf (verify_ap_req_nofail = false). I've been digging through man pages, manuals, mailing list archives and whatnot for a day or two, I figure there's just something simple that I'm missing.
Test host box is Solaris 10 update 3
Test client box is Solaris 10 update 3
kinit <principal> on the host prompts me for my password and when I enter it, it generates a ticket successfully (verified with klist)
client-machine$ ssh <kerberosprincipal>@<host>
returns the prompt:
Enter Kerberos password for <principal>
The original Kerberos configuration on my test host was done with a sys-unconfig and then plugging in the appropriate Kerberos info when prompted. I edited the krb5.conf as mentioned earlier to disable the keytab file requirement.
Any and all advice on what to check on this would be appreciated. In the meantime, I'm going to go back to the Sys Admin Docs Security Services guide and read the PAM section cover to cover again in case I missed something.
Thanks!
Below is my full pam.conf and a cut and paste of a full log transaction from the time an ssh request goes in until the login fails.
____begin /etc/pam.conf______
# Authentication management
# login service (explicit because of pam_dial_auth)
login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth required pam_unix_cred.so.1
login auth required pam_unix_auth.so.1
login auth required pam_dial_auth.so.1
# rlogin service (explicit because of pam_rhost_auth)
rlogin auth sufficient pam_rhosts_auth.so.1
rlogin auth requisite pam_authtok_get.so.1
rlogin auth required pam_dhkeys.so.1
rlogin auth required pam_unix_cred.so.1
rlogin auth required pam_unix_auth.so.1
# Kerberized rlogin service
krlogin auth required pam_unix_cred.so.1
krlogin auth binding pam_krb5.so.1
krlogin auth required pam_unix_auth.so.1
# rsh service (explicit because of pam_rhost_auth,
# and pam_unix_auth for meaningful pam_setcred)
rsh auth sufficient pam_rhosts_auth.so.1
rsh auth required pam_unix_cred.so.1
# Kerberized rsh service
krsh auth required pam_unix_cred.so.1
krsh auth binding pam_krb5.so.1
krsh auth required pam_unix_auth.so.1
# Kerberized telnet service
ktelnet auth required pam_unix_cred.so.1
ktelnet auth binding pam_krb5.so.1
ktelnet auth required pam_unix_auth.so.1
##### - NOTE- This is the section I added
# Kerberized ssh service
sshd-kbdint auth required pam_unix_cred.so.1 debug
sshd-kbdint auth binding pam_krb5.so.1 debug
sshd-kbdint auth required pam_unix_auth.so.1 deb
##### - NOTE - End of the section I added.
# PPP service (explicit because of pam_dial_auth)
ppp auth requisite pam_authtok_get.so.1
ppp auth required pam_dhkeys.so.1
ppp auth required pam_unix_cred.so.1
ppp auth required pam_unix_auth.so.1
ppp auth required pam_dial_auth.so.1
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth required pam_unix_cred.so.1
other auth required pam_unix_auth.so.1
# passwd command (explicit because of a different authentication module)
passwd auth required pam_passwd_auth.so.1
# cron service (explicit because of non-usage of pam_roles.so.1)
cron account required pam_unix_account.so.1
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
other account requisite pam_roles.so.1
other account required pam_unix_account.so.1
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
other session required pam_unix_session.so.1
# Default definition for Password management
# Used when service name is not explicitly mentioned for password management
other password required pam_dhkeys.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1
other password required pam_authtok_store.so.1
# Support for Kerberos V5 authentication and example configurations can
# be found in the pam_krb5(5) man page under the "EXAMPLES" section.
______end pam.conf__________
The ssh debug log entries for the entire transaction look like this:
* Sanitized - test host replaced with my.test.host, username replaced with the word principal, ssh client ip replaced with clientip
----- Begin ssh log-----
Feb 22 21:22:46 my.test.host sshd[398]: [ID 800047 auth.debug] debug1: Forked child 1127.
Feb 22 21:22:46 my.test.host sshd[1127]: [ID 800047 auth.info] Connection from clientip port 46175
Feb 22 21:22:46 my.test.host sshd[1127]: [ID 800047 auth.info] Connection from clientip port 46175
Feb 22 21:22:46 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: Client protocol version 2.0; client software version Sun_SSH_1.1
Feb 22 21:22:46 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: no match: Sun_SSH_1.1
Feb 22 21:22:46 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: Enabling compatibility mode for protocol 2.0
Feb 22 21:22:46 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: Local version string SSH-2.0-Sun_SSH_1.1
Feb 22 21:22:46 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: list_hostkey_types: ssh-rsa,ssh-dss
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible
Feb 22 21:22:47 my.test.host Unknown code 0
Feb 22 21:22:47 my.test.host )
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: SSH2_MSG_KEXINIT sent
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: SSH2_MSG_KEXINIT received
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: kex: client->server aes128-ctr hmac-md5 none
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: kex: server->client aes128-ctr hmac-md5 none
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: Peer sent proposed langtags, ctos: i-default
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: Peer sent proposed langtags, stoc: i-default
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: We proposed langtags, ctos: ar-EG,ar-SA,bg-BG,ca-ES,cs-CZ,da-DK,de,de-AT,de-CH,de-DE,de-LU,el-CY,el-GR,en-AU,en-CA,en-GB,en-IE,en-MT,en-NZ,en-US,es,es-AR,es-BO,es-CL,es-CO,es-CR,es-EC,es-ES,es-GT,es-MX,es-NI,es-PA,es-PE,es-PY,es-SV,es-UY,es-VE,et-EE,fi-FI,fr,fr-BE,fr-CA,fr-CH,fr-FR,fr-LU,he-IL,hi-IN,hr-HR,hu-HU,is-IS,it,it-IT,ja-JP,ko,ko-KR,lt-LT,lv-LV,mk-MK,mt-MT,nb-NO,nl-BE,nl-NL,nn-NO,pl,pl-PL,pt-BR,pt-PT,ro-RO,ru,ru-RU,sh-BA,sk-SK,sl-SI,sq-AL,sr-CS,sv,sv-SE,th-TH,tr-TR,zh,zh-CN,zh-HK
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: We proposed langtags, stoc: ar-EG,ar-SA,bg-BG,ca-ES,cs-CZ,da-DK,de,de-AT,de-CH,de-DE,de-LU,el-CY,el-GR,en-AU,en-CA,en-GB,en-IE,en-MT,en-NZ,en-US,es,es-AR,es-BO,es-CL,es-CO,es-CR,es-EC,es-ES,es-GT,es-MX,es-NI,es-PA,es-PE,es-PY,es-SV,es-UY,es-VE,et-EE,fi-FI,fr,fr-BE,fr-CA,fr-CH,fr-FR,fr-LU,he-IL,hi-IN,hr-HR,hu-HU,is-IS,it,it-IT,ja-JP,ko,ko-KR,lt-LT,lv-LV,mk-MK,mt-MT,nb-NO,nl-BE,nl-NL,nn-NO,pl,pl-PL,pt-BR,pt-PT,ro-RO,ru,ru-RU,sh-BA,sk-SK,sl-SI,sq-AL,sr-CS,sv,sv-SE,th-TH,tr-TR,zh,zh-CN,zh-HK
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: Negotiated main locale: C
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: Negotiated messages locale: C
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: dh_gen_key: priv key bits set: 131/256
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: bits set: 1617/3191
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: bits set: 1617/3191
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: newkeys: mode 1
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: SSH2_MSG_NEWKEYS sent
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: expecting SSH2_MSG_NEWKEYS
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: newkeys: mode 0
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: SSH2_MSG_NEWKEYS received
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: KEX done
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: userauth-request for user principal service ssh-connection method none
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: attempt 0 initial attempt 0 failures 0 initial failures 0
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.info] Failed none for principal from clientip port 46175 ssh2
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.info] Failed none for principal from clientip port 46175 ssh2
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: userauth-request for user principal service ssh-connection method keyboard-interactive
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: attempt 1 initial attempt 0 failures 1 initial failures 0
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: keyboard-interactive devs
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 655841 auth.debug] PAM-KRB5 (auth): pam_sm_authenticate flags=0
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 549540 auth.debug] PAM-KRB5 (auth): attempt_krb5_auth: start: user='principal'
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 704353 auth.debug] PAM-KRB5 (auth): Forwardable tickets requested
Feb 22 21:22:47 my.test.host sshd[1127]: [ID 912857 auth.debug] PAM-KRB5 (auth): Renewable tickets requested
Feb 22 21:22:58 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: got 1 responses
Feb 22 21:22:58 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: PAM conv function returns PAM_SUCCESS
Feb 22 21:22:58 my.test.host sshd[1127]: [ID 179272 auth.debug] PAM-KRB5 (auth): attempt_krb5_auth: krb5_get_init_creds_password returns: SUCCESS
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 833335 auth.debug] PAM-KRB5 (auth): attempt_krb5_auth returning 0
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 914654 auth.debug] PAM-KRB5 (auth): pam_sm_auth finalize ccname env, result =0, env ='KRB5CCNAME=FILE:/tmp/krb5cc_100', age = 0, status = 0
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 525286 auth.debug] PAM-KRB5 (auth): end: Success
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[7] while authorizing: Permission denied
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[7] while authorizing: Permission denied
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 800047 auth.info] Failed keyboard-interactive for principal from clientip port 46175 ssh2
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 800047 auth.info] Failed keyboard-interactive for principal from clientip port 46175 ssh2
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: userauth-request for user principal service ssh-connection method keyboard-interactive
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: attempt 2 initial attempt 1 failures 2 initial failures 1
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 800047 auth.debug] debug1: keyboard-interactive devs
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 490997 auth.debug] PAM-KRB5 (auth): krb5_cleanup auth_status = 0
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 655841 auth.debug] PAM-KRB5 (auth): pam_sm_authenticate flags=0
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 549540 auth.debug] PAM-KRB5 (auth): attempt_krb5_auth: start: user='principal'
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 704353 auth.debug] PAM-KRB5 (auth): Forwardable tickets requested
Feb 22 21:22:59 my.test.host sshd[1127]: [ID 912857 auth.debug] PAM-KRB5 (auth): Renewable tickets requested
------ end ssh log -------

Answer 1

Downgrade openssh to 5.5p1.
There is another post and a bug report about it.