Estou tentando conectar a um servidor ssh chamado "test21.my-domain.com". Preciso de um tíquete kerberos para conectar a esse host, então fiz esta configuração:
Host *
HostName %h.my-domain.com
User my_username
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
Include config.d/ssh_config
Onde o ssh_config adicional inclui hosts onde não levar o tíquete do Kerberos, como este:
Host ai-buildingblocks ai-buildingblocks.my-domain.com ai-buildingblocks.my-domain.com
User root
GSSAPIDelegateCredentials no
Host ai-marketplace-3 ai-marketplace-3.my-domain.com ai-marketplace-3.my-domain.com
User root
GSSAPIDelegateCredentials no
...
Se eu quiser exibir meus tíquetes Kerberos na minha máquina local, obtenho meu(s) tíquete(s):
> klist -f
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: [email protected]
Valid starting Expires Service principal
01/13/2025 11:20:19 01/13/2025 21:20:19 krbtgt/[email protected]
renew until 01/14/2025 11:20:19, Flags: RIA
01/13/2025 11:20:20 01/13/2025 21:20:19 host/adminssh.my-domain.com@
renew until 01/14/2025 11:20:19, Flags: RAT
Ticket server: host/[email protected]
01/13/2025 11:41:22 01/13/2025 21:20:19 host/test21.my-domain.com@
renew until 01/14/2025 11:20:19, Flags: RAT
Ticket server: host/[email protected]
Mas quando eu conecto ao host e executo o klist, ele apenas diz que não encontrou nenhuma credencial, resultando em um monte de erros. No entanto, estou conectado ao host, a conexão é inútil, pois preciso de um tíquete kerberos para obter meu diretório home. Aqui estão alguns logs:
> ssh test21 -K -v
OpenSSH_9.9p1, OpenSSL 3.4.0 22 Oct 2024
debug1: Reading configuration data /home/my_username/.ssh/config
debug1: /home/my_username/.ssh/config line 7: Applying options for *
debug1: Reading configuration data /home/my_username/.ssh/config.d/ssh_config
debug1: /home/my_username/.ssh/config.d/ssh_config line 3: include ~/.ssh/ansible_ssh_config matched no files
debug1: /home/my_username/.ssh/config.d/ssh_config line 453: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Reading configuration data /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
debug1: Connecting to test21.my-domain.com [aaaa:111:111:aaaa::11] port 22.
debug1: connect to address aaaa:111:111:aaaa::11 port 22: Connection refused
debug1: Connecting to test21.my-domain.com [111.111.111.11] port 22.
debug1: Connection established.
debug1: identity file /home/my_username/.ssh/id_rsa type -1
debug1: identity file /home/my_username/.ssh/id_rsa-cert type -1
debug1: identity file /home/my_username/.ssh/id_ecdsa type -1
debug1: identity file /home/my_username/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/my_username/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/my_username/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/my_username/.ssh/id_ed25519 type -1
debug1: identity file /home/my_username/.ssh/id_ed25519-cert type -1
debug1: identity file /home/my_username/.ssh/id_ed25519_sk type -1
debug1: identity file /home/my_username/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/my_username/.ssh/id_xmss type -1
debug1: identity file /home/my_username/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.2p1 Debian-2+deb12u4
debug1: compat_banner: match: OpenSSH_9.2p1 Debian-2+deb12u4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to test21.my-domain.com:22 as 'my_username'
debug1: load_hostkeys: fopen /home/my_username/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: sntrup761x25519-sha512
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:abcde
debug1: load_hostkeys: fopen /home/my_username/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host 'test21.my-domain.com' is known and matches the ED25519 host key.
debug1: Found key in /home/my_username/.ssh/known_hosts:6
debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: ssh_packet_read_poll2: resetting read seqnr 3
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-ed25519,[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],ssh-dss,ssh-rsa,rsa-sha2-256,rsa-sha2-512>
debug1: kex_ext_info_check_ver: [email protected]=<0>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug1: Delegating credentials
debug1: Delegating credentials
Authenticated to test21.my-domain.com ([111.111.111.11]:11) using "gssapi-with-mic".
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: pledge: filesystem
debug1: client_input_global_request: rtype [email protected] want_reply 0
debug1: client_input_hostkeys: searching /home/my_username/.ssh/known_hosts for test21.my-domain.com / (none)
debug1: client_input_hostkeys: searching /home/my_username/.ssh/known_hosts2 for test21.my-domain.com / (none)
debug1: client_input_hostkeys: hostkeys file /home/my_username/.ssh/known_hosts2 does not exist
debug1: client_input_hostkeys: no new or deprecated keys from server
debug1: Requesting authentication agent forwarding.
debug1: Sending environment.
debug1: channel 0: setting env LANG = "en_US.UTF-8"
debug1: pledge: agent
Note que alterei alguns dados como meu nome de usuário ou ips, pois considero esses dados sensíveis. Observe também que a configuração do servidor não é algo que eu possa alterar e está funcionando para muitos outros, então deve ser um problema do meu lado. Também estou usando uma vpn para conectar ao host, caso contrário, eu poderia usar um proxy de salto ("adminssh"), que também não funciona.
Então por que isso não funciona? Por que não tenho um tíquete kerberos no host ssh? Atualmente, estou usando arch, e o servidor ssh roda em debian. Se precisar de mais informações, posso sempre fornecê-las, desde que não as considere sensíveis.