When multiple realms are defined in /etc/krb5.conf sshd uses only the first default realm for kerberos password authentication. However gssapi access works with multiple default realms, at least for HEIMDAL. It should be fine if sshd uses all default realms or all realms defined in /etc/krb5.conf. For HEIMDAL I replaced the line "problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user, ccache, password, 1, NULL);" by a line "problem = krb5_verify_user_lrealm(authctxt->krb5_ctx, authctxt->krb5_user, ccache, password, 1, NULL);" in the file auth-krb5.c and the Kerberos password authentication takes into account all localy defined realms in /etc/krb5.conf file. I did not try to modify the file for mit-krb5 kerberos distribution. Reproducible: Always Steps to Reproduce: 1. 3. I use heimdal-0.6.5 and openssh-4.2_p1
can you please report this upstream ? you're clearly more knowledgeable about the issue so having me try to talk about kerberos would be a disaster :) http://www.openssh.com/report.html
better to track this upstream
