IPA pubkey auth and NFS KRB5

[Ronald Wimmer]

I am aware of two cases here. The first one is that I do already have a 
TGT that I can delegate to the target host and some magic fetches the 
right NFS ticket for me. The second one is that I connect to the target 
host and enter a password and SSSD fetches a TGT and NFS ticket for me.

Both cases allow me to access a kerberized NFS share. But what is when I 
use SSH pubkey auth (pubkey in IPA) to connect to the target host? 
Should I also get a TGT and NFS ticket to access a kerberized NFS share?

Cheers,
Ronald

[Sumit Bose]

Am Thu, Feb 13, 2025 at 02:24:58PM +0100 schrieb Ronald Wimmer via FreeIPA-users:
> I am aware of two cases here. The first one is that I do already have a TGT
> that I can delegate to the target host and some magic fetches the right NFS
> ticket for me. The second one is that I connect to the target host and enter
> a password and SSSD fetches a TGT and NFS ticket for me.
>
> Both cases allow me to access a kerberized NFS share. But what is when I use
> SSH pubkey auth (pubkey in IPA) to connect to the target host? Should I also
> get a TGT and NFS ticket to access a kerberized NFS share?

Hi,

no, pubkey authentication happens completely inside of sshd and no one
else has access to anything involved and hence cannot act upon it.

HTH

bye,
Sumit
> Cheers,
> Ronald
> -- 
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Kroon PC, Peter]

Hello list,

This is also something I looked at a while ago, and I effectively came to the same conclusion as Sumit, but with a but more nuance. Note that I never quite managed to implement a fix, but I'll share my thoughts here anyway.
SSH key authentication is done by sshd, and kerberos has no idea what an ssh key means. I thought of/found the following alternatives.
- If your home folder is on NFS, the home folder of the authenticating user is not available for authentication. This means the user's authorized_keys must live somewhere else, for example in freeipa.
- You can authenticate to kerberos using a certificate (see smartcard authentication), and it is possible to use the same certificate to authenticate to sshd, although that does require help from a freeipa wrapper (/usr/bin/sss_ssh_authorizedkeys). However, you need a modified version of ssh(d) (*not sure if it's only the sshd daemon or also the client) to be able to use the provided cert to get sshd to get you a kerberos ticket. This already exists, but I can't find it at the moment. Either way, sounds like a terrible idea to me.
- Have your ssh client authenticate to the kdc and get a ticket, and use that ticket to authenticate to sshd. This means that you have to expose your kdc to all your clients (i.e. the internet). Sounds like a terrible idea to me.
- Generate a kerberos service for sshd, and trust it for delegation (meaning, it's allowed to hand out tgts for other users, as I understand it), get a keytab, and then wrestle with PAM to generate tgts once sshd is happy with the provided ssh key. This sounds like a reasonable idea to me, but puts a lot of trust in sshd (even more than usual). Plus, you'd best make sure you never lose that keytab.
- Add pam_krb5 to the sshd authentication flow, so it asks for a password after ssh-key authentication to get a kerberos ticket. Probably safest, but breaks automatic authentication.

I hope this helps, and please let me know if you figure out something smarter ;)
Peter

________________________________________
From: Sumit Bose via FreeIPA-users 
Sent: Thursday, 13 February 2025 16:12
To: FreeIPA users list
Cc: Ronald Wimmer; Sumit Bose
Subject: [Freeipa-users] Re: IPA pubkey auth and NFS KRB5

Am Thu, Feb 13, 2025 at 02:24:58PM +0100 schrieb Ronald Wimmer via FreeIPA-users:
> I am aware of two cases here. The first one is that I do already have a TGT
> that I can delegate to the target host and some magic fetches the right NFS
> ticket for me. The second one is that I connect to the target host and enter
> a password and SSSD fetches a TGT and NFS ticket for me.
>
> Both cases allow me to access a kerberized NFS share. But what is when I use
> SSH pubkey auth (pubkey in IPA) to connect to the target host? Should I also
> get a TGT and NFS ticket to access a kerberized NFS share?

Hi,

no, pubkey authentication happens completely inside of sshd and no one
else has access to anything involved and hence cannot act upon it.

HTH

bye,
Sumit
> Cheers,
> Ronald
> --
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

--
_______________________________________________
FreeIPA-users mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Jochen Kellner]

"Kroon PC, Peter via FreeIPA-users"
 writes:
> I hope this helps, and please let me know if you figure out something smarter ;)
> Peter

I do call ssh with "-K", so it authenticates with Kerberos instead of
password/ssh-keys:

-K      Enables GSSAPI-based authentication and forwarding
      (delegation) of GSSAPI credentials to the server.

That way I have a useful ticket at the server and can access e.g. NFS
resources.

Jochen

[Ronald Wimmer]

On 14.02.25 18:42, Jochen Kellner via FreeIPA-users wrote:
> "Kroon PC, Peter via FreeIPA-users"
>  writes:
> > I hope this helps, and please let me know if you figure out something smarter ;)
> > Peter
>
> I do call ssh with "-K", so it authenticates with Kerberos instead of
> password/ssh-keys:
>   -K      Enables GSSAPI-based authentication and forwarding
>    (delegation) of GSSAPI credentials to the server.

As we do not have a ticket on the source server (no one has called kinit 
there) we cannot delegate one...

[Ronald Wimmer]

On 14.02.25 10:35, Kroon PC, Peter wrote:
> You can authenticate to kerberos using a certificate

If this is true I could use pubkey auth for SSH and an user cert for 
Kerberos, right? This idea does not sound too bad...

Cheers,
Ron

[Ronald Wimmer]

On 09.04.25 09:41, Ronald Wimmer via FreeIPA-users wrote:
> On 14.02.25 10:35, Kroon PC, Peter wrote:
> > You can authenticate to kerberos using a certificate
>
> If this is true I could use pubkey auth for SSH and an user cert for 
> Kerberos, right? This idea does not sound too bad...

So how to obtain a cert is here:
https://www.freeipa.org/page/V4/User_Certificates#using-freeipa-dogtag-pki-t...

But how would I use such a cert for Kerberos auth?

[Kroon PC, Peter]

Hi Ron,

On paper, and technically, I do think this would be the best solution. Like I wrote originally however, you need a modified ssh(d) to forward access to the certificate/smartcard to allow pkinit to get your kerberos ticket (as far as I understand it).
See also this kerberos mail thread: https://comp.protocols.kerberos.narkive.com/tktb96dW/using-a-ssh-key-for-krb...
This also seems intelligent: https://lists.mindrot.org/pipermail/openssh-unix-dev/2018-December/037433.ht... I don't have time to go through the full thread right now, but it seems to hold important puzzel pieces.

As for using a certificate for kerberos auth, see https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/man..., and your further google term will be pkinit.

Peter
________________________________________
> From: Ronald Wimmer via FreeIPA-users 
> Sent: Wednesday, 9 April 2025 09:53

To: [e-mail]
Cc: Ronald Wimmer
Subject: [Freeipa-users] Re: IPA pubkey auth and NFS KRB5

On 09.04.25 09:41, Ronald Wimmer via FreeIPA-users wrote:
> On 14.02.25 10:35, Kroon PC, Peter wrote:
> > You can authenticate to kerberos using a certificate
>
> If this is true I could use pubkey auth for SSH and an user cert for
> Kerberos, right? This idea does not sound too bad...

So how to obtain a cert is here:
https://www.freeipa.org/page/V4/User_Certificates#using-freeipa-dogtag-pki-t...

But how would I use such a cert for Kerberos auth?
--
_______________________________________________
FreeIPA-users mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Kroon PC, Peter]

You got me digging into this again :)
I found the alternative ssh implementation: pkixssh https://gitlab.com/secsh/pkixssh Not sure I'd be brave enough though.

Peter

________________________________________
From: Kroon PC, Peter via FreeIPA-users 
Sent: Wednesday, 9 April 2025 10:43
To: [e-mail]
Cc: Ronald Wimmer; Kroon PC, Peter
Subject: [Freeipa-users] Re: IPA pubkey auth and NFS KRB5

Hi Ron,

On paper, and technically, I do think this would be the best solution. Like I wrote originally however, you need a modified ssh(d) to forward access to the certificate/smartcard to allow pkinit to get your kerberos ticket (as far as I understand it).
See also this kerberos mail thread: https://comp.protocols.kerberos.narkive.com/tktb96dW/using-a-ssh-key-for-krb...
This also seems intelligent: https://lists.mindrot.org/pipermail/openssh-unix-dev/2018-December/037433.ht... I don't have time to go through the full thread right now, but it seems to hold important puzzel pieces.

As for using a certificate for kerberos auth, see https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/man..., and your further google term will be pkinit.

Peter
________________________________________
> From: Ronald Wimmer via FreeIPA-users 
> Sent: Wednesday, 9 April 2025 09:53

To: [e-mail]
Cc: Ronald Wimmer
Subject: [Freeipa-users] Re: IPA pubkey auth and NFS KRB5

On 09.04.25 09:41, Ronald Wimmer via FreeIPA-users wrote:
> On 14.02.25 10:35, Kroon PC, Peter wrote:
> > You can authenticate to kerberos using a certificate
>
> If this is true I could use pubkey auth for SSH and an user cert for
> Kerberos, right? This idea does not sound too bad...

So how to obtain a cert is here:
https://www.freeipa.org/page/V4/User_Certificates#using-freeipa-dogtag-pki-t...

But how would I use such a cert for Kerberos auth?
--
_______________________________________________
FreeIPA-users mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
--
_______________________________________________
FreeIPA-users mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue