PowerShell / PowerShell/Win32-OpenSSH

GSSAPI Authentication from Windows to Linux failed

Open
#1,875 47 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

Troubleshooting steps
https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps

Terminal issue? please go through wiki
https://github.com/PowerShell/Win32-OpenSSH/wiki/TTY-PTY-support-in-Windows-OpenSSH

Please answer the following

"OpenSSH for Windows" version
OpenSSH_for_Windows_8.1p1, LibreSSL 2.9.2

Server OperatingSystem
Ubuntu 20.04.3 LTS
OpenSSH_8.2p1 Ubuntu-4ubuntu0.3, OpenSSL 1.1.1f

Client OperatingSystem
Windows Server 2019 Standard
OpenSSH_for_Windows_8.1p1, LibreSSL 2.9.2

What is failing
The corporate environment is running on a Windows Domain Controller and we are trying to get Windows Client computer to SSH to Linux server to execute linux programs remotely. Both client and servers are domain joined. Ubuntu server runs sssd and PAM for authentication domain accounts and the following GSSAPI options are turned on:

GSSAPIAuthentication yes
GSSAPIKeyExchange yes

What we are trying to achieve with GSSAPI auth is SSO through pam stack for passwordless automation and file share mount (pam_mount). Pub-Key auth works but it does not integrate with sssd so PAM modules are triggered without AD credential, therefore fail to mount the SMB file share. We are hoping that GSSAPI can provide passwordless auth while passing keytab to the server for mounting (via mount.cifs -o sec=krb5)

However, ssh seems to attempt authentication via gssapi but without success. Since it is using Microsoft SSPI, I don't have a way to dig further into the what went wrong.

On the AD side, we didn't turn on the encryption for the service account we are using to connect since it isn't on by default. On the server machine we also didn't turn on "Trust this computer for delegation" option. Would you recommend to retry with these two options turned on?

Expected output for client logs:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: send packet: type 50
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: receive packet: type 60
debug1: Delegating credentials
debug1: sspi delegation was requested but not fulfilled
debug3: send packet: type 61
debug3: receive packet: type 61
debug1: Delegating credentials
debug1: sspi delegation was requested but not fulfilled
debug3: send packet: type 66
debug3: receive packet: type 52
debug1: Authentication succeeded (gssapi-with-mic).

Actual output
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: send packet: type 50
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: receive packet: type 60
debug1: Delegating credentials
debug1: sspi delegation was requested but not fulfilled
debug3: send packet: type 61
debug3: receive packet: type 61
debug1: Delegating credentials
debug1: sspi delegation was requested but not fulfilled
debug3: send packet: type 66
debug3: receive packet: type 51

Full client and server logs will be provided below

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked Troubleshooting Steps wiki and compare the expected and actual client traces, then review the full client and server logs mentioned in the issue. Check the GSSAPI, AD service-account encryption, delegation, SSSD, PAM, and mount.cifs context described here; done means GSSAPI authentication succeeds and the required passwordless PAM flow works.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, ubuntu
Domain
authentication, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.