ssh or kerberos library searching for default realm (but why?)
Harald Barth <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.heimdal.general |
|---|---|
| Message-ID | <20120109.140212.862190775759413192.haba@habanero> |
Scanario (heimdal 1.5.1 and ssh 5.7p1 with Simon's patches): $ ./kinit [email protected] ... Password: xxxx $ ./ssh -v -v -o GSSAPIKeyExchange=yes [email protected] (...) unable to find realm of host habadrom (...) => exit habadrom is my local machine. It does not need to be in any realm for kerberos to be useful. I have a perfectly working ticket in the ticket cache. Is it ssh or the heimdal libraries that think that they need the local realm of the local computer? If I supply a fake realm $ cat > FAKE << EOF [libdefaults] default_realm=FAKE EOF $ KRB5_CONFIG=FAKE ./ssh -v -v -o GSSAPIKeyExchange=yes [email protected] then it works, which proves that the knowledge of a real realm of the local hostname is completely unneccessary. Do I now need to ship a fake krb5.conf to cygwin users (whose computers typically are not in some default realm at all)? Harald.