Support GSSAPI SSH connections (Keberos)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 7.2k
- Forks
- 1.7k
- Avg merge
- 13d 8h
- Merged PRs (30d)
- 2
Description
Is it possible to perform GSSAPI authentication with SSH?
I'm able to login using regular docker, like so:
# kinit myuser@DOMAIN
# export DOCKER_HOST=ssh://myuser@myhost.domain
# docker ps
<usual results>
But if I try and do the same with the python docker:
>>> import docker
>>> client = docker.from_env()
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/t/venv/lib/python3.7/site-packages/docker/client.py", line 85, in from_env
timeout=timeout, version=version, **kwargs_from_env(**kwargs)
File "/t/venv/lib/python3.7/site-packages/docker/client.py", line 40, in __init__
self.api = APIClient(*args, **kwargs)
File "/t/venv/lib/python3.7/site-packages/docker/api/client.py", line 166, in __init__
base_url, timeout, pool_connections=num_pools
File "/t/venv/lib/python3.7/site-packages/docker/transport/sshconn.py", line 111, in __init__
self._connect()
File "/t/venv/lib/python3.7/site-packages/docker/transport/sshconn.py", line 119, in _connect
self.ssh_client.connect(**self.ssh_params)
File "/t/venv/lib/python3.7/site-packages/paramiko/client.py", line 446, in connect
passphrase,
File "/t/venv/lib/python3.7/site-packages/paramiko/client.py", line 765, in _auth
raise SSHException("No authentication methods available")
paramiko.ssh_exception.SSHException: No authentication methods available
The crux of the issue (I think) is that parmiko isn't including gssapi as an authentication method whereas the host's SSL library is. To get this to work from python we'd need to pass gss_auth=True to the paramiko client object. And also include some gssapi libraries as per the instructions here: http://www.paramiko.org/installing.html#gssapi
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in docker/transport/sshconn.py, where the Paramiko SSH client is connected, and compare its connection options with Paramiko's GSSAPI installation guidance. Verify the resulting behavior with the issue's kinit, DOCKER_HOST, and docker.from_env example; done means a GSSAPI-authenticated SSH connection can run docker ps.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, networking
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100