2

I haven't really have had much experience with Kerberos but I am trying to set up SSH authentication with AD on one of my servers using sssd. I have followed the instructions on the sssd documentation here and got it working but I am struggling to understand why I need a keytab file to set this up?

I've been doing a bit of reading about Kerberos lately and it appears you only need to create a keytab file on the server when the server needs to authenticate to AD without user interaction or when you need to implement SSO (when a user requests a ticket for that service).

I simply want my users to enter their username / password when logging in via SSH and have sssd authenticate this user against AD and create a TGT ticket for them. The funny thing is - even when I don't setup sssd and only set up the kerberos side I can run kinit and I get a ticket!

So my question is this: Can I set up SSH authentication using sssd without generating a keytab file on the server? if not then why not?

T-Heron
  • 5,385
  • 7
  • 26
  • 52
Simon D
  • 5,730
  • 2
  • 17
  • 31
  • 1
    _"even when I don't setup sssd and only set up the kerberos side I can run kinit"_ -- well, of course! `kinit` has nothing to do with SSSD *service*, it is part of the Kerberos *client* that you can use to authenticate against a remote kerberized service, such as SSH / Hadoop / HTTP / whatever. On RedHat & friends you get it with `yum install krb5-workstation` – Samson Scharfrichter Mar 30 '17 at 21:10
  • _"create a keytab file on the server "_ -- are you refering to `/etc/krb5.keytab` that is used by the SSSD service to authenticate against AD, as "host/***@***" service, so that it can request password validation for users? – Samson Scharfrichter Mar 30 '17 at 21:20

1 Answers1

2

Your question in the Subject line "What is the reason for a Kerberos keytab file when setting up SSH authentication on a server?" boils down to a one-line answer: it allows for Kerberos single sign-on authentication to the Directory server by de-crypting the inbound Kerberos service ticket to "tell" who the user is. As far as your other question, "Can I set up SSH authentication using sssd without generating a keytab file on the server?", the answer is yes, you can. But you will be prompted for a username or password whenever you connect to the SSH service, unless you choose to cache the password in whatever SSH utility you might be using to connect. Caching the password though, in such a method, is not considered to be "single sign-on".

For additional reference, you can read more about my article on Kerberos keytabs on Microsoft Technet: Kerberos Keytabs – Explained. I frequently go back and edit it based on questions I see here in this forum.

T-Heron
  • 5,385
  • 7
  • 26
  • 52