Version: 1:5.5p1-6+squeeze1

Severity: normal

When sshing to this computer with forwarded tickets,  the filename is
changed from what is defined by $KRBCCNAME on the client to some kind of
default naming /tmp/krb5ccname_<uid>_xxxxx.   This means that the ticket is
there, but not under the expected name, so setting $KRB5CCNAME on the
server to the same value on the client means that the ticket is not seen.
 This worked correctly under lenny.

Liam Healy <lnp@healy.washington.dc.us> writes:

Why would you do that, rather than just let sshd set KRB5CCNAME to the
appropriate value, which it will do automatically?  KRB5CCNAME should
generally always point to a randomly-named ticket cache as long as files
in /tmp are used, since otherwise you raise the possibility of DoS attacks
and other annoyances due to known-file-name attacks in /tmp.

KRB5CCNAME is a system-local setting.  It doesn't make sense to forward it
from one system to another.  The remote system could be using something
completely different to store the ticket cache, like KCM or kernel keyring
caches.

Because I use two Kerberos realms simultaneously, and I need to distinguish
them somehow.  I rename them with the realm name as part of the file name.
 I was using "KRB5CCNAME" in my report as a proxy for the filename, what I
should have said is that ticket file name is being changed from what it is
on the ssh client.  In addition, it seems that only $KRB5CCNAME ticket is
forwarded; it would be nice to be able to forward more than one ticket.  If
there's a better way to keep track of tickets than renaming the file, I'll
do that.

Thanks,
Liam

Liam Healy <lnp@healy.washington.dc.us> writes:

Ah, yes, that's a tricky problem.

Basically, Kerberos on UNIX only understands one TGT at a time and will
only forward one, so you have to hack together something else to handle
multiple ticket forwarding and ticket renaming.  Unfortunately, there
isn't a good solution.  The *right* solution is multi-ticket ticket caches
with corresponding forwarding (although it's hard to forward a ticket from
a realm other than the server's realm securely), but this isn't really
there on UNIX.

I would add some code to your shell initialization files (.bashrc or the
like) to determine what realm of a ticket got forwarded with klist and
then rename it after login, setting KRB5CCNAME to follow.  That will be
reliable in the face of whatever sshd does.

Hello 668195
We appreciate you renewing your membership with us once again. Please
find attached a file named Bill9008243287 with details about your
renewal.