Advanced Connection Options
From FarmShare
(Difference between revisions)
| Line 7: | Line 7: | ||
FarmShare systems do support password-less authentication using GSSAPI. The default configuration of OpenSSH uses GSSAPI for authentication if a valid Kerberos ticket is present but does not forward tickets to the remote system, which can cause problems with [[AFS]]. | FarmShare systems do support password-less authentication using GSSAPI. The default configuration of OpenSSH uses GSSAPI for authentication if a valid Kerberos ticket is present but does not forward tickets to the remote system, which can cause problems with [[AFS]]. | ||
| - | It is possible to enable forwarding by adding the ssh option '''GSSAPIDelegateCredentials''' to ~/.ssh/config, but you should do so only for trusted computers. Something like the following is | + | It is possible to enable forwarding by adding the ssh option '''GSSAPIDelegateCredentials''' to ~/.ssh/config, but you should do so only for trusted computers. Something like the following is recommended: |
<pre>Host cardinal cardinal? | <pre>Host cardinal cardinal? | ||
HostName %h.stanford.edu | HostName %h.stanford.edu | ||
Revision as of 14:17, 25 January 2012
Public Key Authentication
Public key authentication is not supported by FarmShare systems. However...
GSSAPI (Kerberos) Authentication
FarmShare systems do support password-less authentication using GSSAPI. The default configuration of OpenSSH uses GSSAPI for authentication if a valid Kerberos ticket is present but does not forward tickets to the remote system, which can cause problems with AFS.
It is possible to enable forwarding by adding the ssh option GSSAPIDelegateCredentials to ~/.ssh/config, but you should do so only for trusted computers. Something like the following is recommended:
Host cardinal cardinal?
HostName %h.stanford.edu
Host corn corn??
HostName %h.stanford.edu
Host cardinal cardinal? cardinal*.stanford.edu corn corn?? corn*.stanford.edu
GSSAPIKeyExchange yes
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
This configuration should work safely in all common cases for both cardinal and corn systems.
See the man page for ssh_config for more information on GSSAPI options.
