To establish an SSH connection using Kerberos authentication, the SSH
client user enters the kinit command to obtain a ticket-granting
ticket (TGT).
Forwarding Credentials |
 |
Kerberos allows SSH to forward Kerberos credentials from client host
to server host, obviating the need for users to re-enter their Kerberos password
each time they use a Kerberized application. For example, with credentials
forwarding, a user on HOSTA issues a kinit command, connects
to SSH from HOSTA to HOSTB, and, once logged into HOSTB, connects to HOSTC,
without ever issuing a kinit command on HOSTB. After entering
the kinit command on HOSTA, the credentials follow the
user to the session on HOSTB and then to the session on HOSTC.
To forward Kerberos credentials, include the -f option
on the kinit command. This option indicates that a forwardable
TGT is to be produced.
In addition to the presence of a forwardable TGT, the Kerberized application
being used must support credentials forwarding. You can forward credentials
when you are using the kerberos-tgt-2 and gssapi-with-mic authentication
methods. The kerberos-2 authentication method does not
support forwarding of the user's Kerberos credentials to the process on the
SSH server host.
Managing Kerberos Credential Forwarding |
|
Credentials are only forwarded from the client to the server if the GssapiDelegateCredentials client
configuration parameter is set to yes. If the parameter
is set to yes, the SSH client delegates credentials to
the server. If it is set to no, the client does not delegate
credentials. The default is no. For more information about
client configuration parameters, see Appendix
B.
