docker / docker/docker-py

Support GSSAPI SSH connections (Keberos)

Open
#2,615 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
7.2k
Forks
1.7k
Avg merge
13d 8h
Merged PRs (30d)
2

Description

Is it possible to perform GSSAPI authentication with SSH?

I'm able to login using regular docker, like so:

# kinit myuser@DOMAIN
# export DOCKER_HOST=ssh://myuser@myhost.domain
# docker ps
<usual results>

But if I try and do the same with the python docker:

>>> import docker
>>> client = docker.from_env() 
Traceback (most recent call last): 
  File "<stdin>", line 1, in <module>
  File "/t/venv/lib/python3.7/site-packages/docker/client.py", line 85, in from_env
    timeout=timeout, version=version, **kwargs_from_env(**kwargs) 
  File "/t/venv/lib/python3.7/site-packages/docker/client.py", line 40, in __init__
    self.api = APIClient(*args, **kwargs)
  File "/t/venv/lib/python3.7/site-packages/docker/api/client.py", line 166, in __init__
    base_url, timeout, pool_connections=num_pools
  File "/t/venv/lib/python3.7/site-packages/docker/transport/sshconn.py", line 111, in __init__
    self._connect()
  File "/t/venv/lib/python3.7/site-packages/docker/transport/sshconn.py", line 119, in _connect
    self.ssh_client.connect(**self.ssh_params)
  File "/t/venv/lib/python3.7/site-packages/paramiko/client.py", line 446, in connect
    passphrase,
  File "/t/venv/lib/python3.7/site-packages/paramiko/client.py", line 765, in _auth
    raise SSHException("No authentication methods available")
paramiko.ssh_exception.SSHException: No authentication methods available

The crux of the issue (I think) is that parmiko isn't including gssapi as an authentication method whereas the host's SSL library is. To get this to work from python we'd need to pass gss_auth=True to the paramiko client object. And also include some gssapi libraries as per the instructions here: http://www.paramiko.org/installing.html#gssapi

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in docker/transport/sshconn.py, where the Paramiko SSH client is connected, and compare its connection options with Paramiko's GSSAPI installation guidance. Verify the resulting behavior with the issue's kinit, DOCKER_HOST, and docker.from_env example; done means a GSSAPI-authenticated SSH connection can run docker ps.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, networking
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.