Bugzilla Bug 115553

The ebuild of OpenSSH-4.2_p1 in the portage tree does'nt support 
GSSAPI/Kerberos key exchange properly. I've found a patch on this site: 
http://www.sxw.org.uk/computing/patches/openssh.html which fixes the problem.
Since it's not included in the ebuild i had to create an overlay ebuild to 
compile it in. After fixing some minor problems with the patch(there are line 
breaks which cause the compilation to fail due to syntax errors) i've 
successfuly compiled the overlay ebuild.

I'm posting this bug report to ask that the specified patch be included in the 
ebuild of OpenSSH in the portage tree.

Reproducible: Always
Steps to Reproduce:
1. emerge OpenSSH-4.2_p1 with USE flags: kerberos -pam
2. Setup GSSAPI/Kerberos authentication
3. On client, use kinit -f to get a forwardable ticket
4. Try to connect to server.

Actual Results:  
I've been asked for password.

Expected Results:  
The ticket should have been forwarded to sshd which then should have log me in 
without asking for password.

After compiling the ebuild with the patch and USE="kerberos", at least the 
following settings should be used in /etc/ssh/sshd_config to enable 
GSSAPI/Kerberos Key Exchange in sshd:
# Kerberos
KerberosAuthentication yes

# GSSAPI
GSSAPIAuthentication yes
GSSAPIKeyExchange yes

Created an attachment (id=74741) [details]
This is the FIXED version of the patch mentioned in the bug report.

This is the FIXED(with the problematic line breaks removed) version of the
patch file from the site:http://www.sxw.org.uk/computing/patches/openssh.html
site.

All that's left to do is to add this patch to the "files" folder of the ebuild
and add the line "use kerberos && <patch name>" to the OpenSSH .ebuild file in
the src_unpack() function.

Is there any progress regarding this bug report?

I ahve 0 experience with the GSSAPI/kerberos framework and I don't like
overpatching openssh, is there a reason why this is not included upstream?

CCing vapier since he might have more insight in this.

(sorry for the delay)

This patch appears to fail with USE="X509" (I was also using "smartcard", so
that could have been the source of my woes - could someone confirm?), but
otherwise functions as stated when applied after all current Gentoo patches.

Could we please get this out into the wild?  Debian's ssh-krb5 black magic has
been a forbidden fruit for us Kerberos nuts...

The reason why this isn't included upstream is because the OpenSSH folks seem
to have some kind of religious objection to adding application-specific code
into the body of OpenSSH.  I can't say I blame them.  It SHOULD be possible to
do all of this in PAM (I've gotten key delegation to work with a [relatively]
unpatched OpenSSH using PPK authentication - trying setting
"GSSAPIDelegateCredentials on" for the host entries you want in
/etc/ssh/ssh_config), but managing the KRB5CCNAME and other variables across
multiple PAGs on different machines is extremely tricky...

On a side note, "KerberosAuthentication yes" shouldn't be necessary.  IIRC,
that's for server-side Kerberos validation of passwords sent across the wire. 
If you already have credentials, it is ignored... Unless the reason for putting
it there was because of USE="-pam", which is also not necessary to get GSSAPI
credential delegation working.

It appears that a more recent version of this patch may be obtained from
http://www.sxw.org.uk/computing/patches/openssh.html .

A tip: make sure your .k5login files are correct!  This one cost me a lot of
time... Each file should contain a newline-separated list of principals (with
realms attached) that are authorized to log in as a given user.

Kerberos support in openssh was always "unsupported". As there was never a
dedicated developer of the kerberos code, some 2 two or three years ago the
kerberos code has been completely ripped out. Somewhere in the Changelog I
think was stated something like "unless fully tested and supported".

Simply, people make and release their own patches on the web. You should accept
it for us. Or make the epatch run only when kerberos flag is set. ;)



BTW, someone should pick up these patches:

   - djm@cvs.openbsd.org 2006/03/20 04:07:22
     [auth2-gss.c]
     GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
     reviewed by simon AT sxw.org.uk; deraadt@ ok
   - djm@cvs.openbsd.org 2006/03/20 04:07:49
     [gss-genr.c]
     more GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
     reviewed by simon AT sxw.org.uk; deraadt@ ok
   - djm@cvs.openbsd.org 2006/03/20 04:08:18
     [gss-serv.c]
     last lot of GSSAPI related leaks detected by Coverity via
     elad AT netbsd.org; reviewed by simon AT sxw.org.uk; deraadt@ ok



Regarding the proposed patch, the following snippet from the webpage is for me
personally the best marking:

"Acknowledgements

Fixes and suggestions have been provided by Jeffrey Altman, Jim Basney, Derrick
J Brashear, Chris Chiappa, Nalin Dahyabhai, Douglas E Engert, Bill Fithen, Sam
Hartman, John Hawkinson, Karsten Huneycutt, John Kilburg, Daniel Kouril, David
Leonard, Dan Russell, Vern Staats, Von Welch and Nicolas Williams."


See also bug #132243.

*** Bug 134973 has been marked as a duplicate of this bug. ***

Can we please get this patch integrated in the ebuild? We are using this
feature extensively in our infrastructure. Currently I've rolled my own
addition to the Gentoo ebuild to support this feature. It would be good to have
it officially in the distribution, even if it had to be enabled with a use
flag.

Apple has included this patch in their shipping versions of OS X, so I believe
that even though it's not yet integrated in to OpenSSH proper it is fairly
stable.

You can get the current version of the patch (for 4.7p1) here:
http://www.sxw.org.uk/computing/patches/openssh.html

Created an attachment (id=145176) [details]
Latest patch against openssh-4.7p1

Created an attachment (id=145178) [details]
Patch against openssh-4.7_p1-r4 ebuild

Here's a patch to the ebuild which will add in the key exchange patch. The
previous GSSAPI patch appears to be unnecessary as it is incorporated in to
this one.

added to openssh-4.7_p1-r5

We use GSSAPI KeyExchange in our sshd and it is annoying to have to tell gentoo
users who want to connect to our site that they have to downgrade before they
can do so. I know that there is no patch for 5.2 yet so I ported Simon's patch
to 5.2 and have it available here:
http://www.stacken.kth.se/~haba/openssh-5.2p1-gsskex-20090610.patch

Simon says there will be an official better patch later this week (2009-07-04
that would be). Please keep an eye on http://www.sxw.org.uk/computing/patches/
and if a new patch does not surface by the end of the week decide if you want
to nag Simon or verify my patch instead.

Thanks,
Harald.

As support for KeyExchange is _not_ in 5.2, I'd like to reopen this bug instead
of creating a new one.

then again, relying on custom patchsets doesnt seem like a terribly grand idea
either ...

considering you're the one interested in the patch, why dont you keep tabs on
it and let us know when it gets updated

Patch for 5.2p1 finaly available from the usual place:
http://www.sxw.org.uk/computing/patches/openssh.html