PowerShell / PowerShell/Win32-OpenSSH
GSSAPI Authentication from Windows to Linux failed
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
Troubleshooting steps
https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps
Terminal issue? please go through wiki
https://github.com/PowerShell/Win32-OpenSSH/wiki/TTY-PTY-support-in-Windows-OpenSSH
Please answer the following
"OpenSSH for Windows" version
OpenSSH_for_Windows_8.1p1, LibreSSL 2.9.2
Server OperatingSystem
Ubuntu 20.04.3 LTS
OpenSSH_8.2p1 Ubuntu-4ubuntu0.3, OpenSSL 1.1.1f
Client OperatingSystem
Windows Server 2019 Standard
OpenSSH_for_Windows_8.1p1, LibreSSL 2.9.2
What is failing
The corporate environment is running on a Windows Domain Controller and we are trying to get Windows Client computer to SSH to Linux server to execute linux programs remotely. Both client and servers are domain joined. Ubuntu server runs sssd and PAM for authentication domain accounts and the following GSSAPI options are turned on:
GSSAPIAuthentication yes
GSSAPIKeyExchange yes
What we are trying to achieve with GSSAPI auth is SSO through pam stack for passwordless automation and file share mount (pam_mount). Pub-Key auth works but it does not integrate with sssd so PAM modules are triggered without AD credential, therefore fail to mount the SMB file share. We are hoping that GSSAPI can provide passwordless auth while passing keytab to the server for mounting (via mount.cifs -o sec=krb5)
However, ssh seems to attempt authentication via gssapi but without success. Since it is using Microsoft SSPI, I don't have a way to dig further into the what went wrong.
On the AD side, we didn't turn on the encryption for the service account we are using to connect since it isn't on by default. On the server machine we also didn't turn on "Trust this computer for delegation" option. Would you recommend to retry with these two options turned on?
Expected output for client logs:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: send packet: type 50
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: receive packet: type 60
debug1: Delegating credentials
debug1: sspi delegation was requested but not fulfilled
debug3: send packet: type 61
debug3: receive packet: type 61
debug1: Delegating credentials
debug1: sspi delegation was requested but not fulfilled
debug3: send packet: type 66
debug3: receive packet: type 52
debug1: Authentication succeeded (gssapi-with-mic).
Actual output
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: send packet: type 50
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: receive packet: type 60
debug1: Delegating credentials
debug1: sspi delegation was requested but not fulfilled
debug3: send packet: type 61
debug3: receive packet: type 61
debug1: Delegating credentials
debug1: sspi delegation was requested but not fulfilled
debug3: send packet: type 66
debug3: receive packet: type 51
Full client and server logs will be provided below
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Troubleshooting Steps wiki and compare the expected and actual client traces, then review the full client and server logs mentioned in the issue. Check the GSSAPI, AD service-account encryption, delegation, SSSD, PAM, and mount.cifs context described here; done means GSSAPI authentication succeeds and the required passwordless PAM flow works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, ubuntu
- Domain
- authentication, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100