OpenSSH 4.2p1 authenticat to AD in W2k3

[Donny Jekels]

Long time not been here:

have a new project to allow AD users to log into the Linux boxes with their AD accounts.

compiled ssh --with-kerberos
built kerberos
downloaded an installed css_adkadmin

added host principle host/host1.mydomain.com
added service princple for sshd/host1.mydomain.com
generated krb5.keytab file

even get tgt tickets on my linux session from the AD server.

allowed GSSAuthenticate = yes in sshd_config

downloaded and installed putty wiht gssapi support.

everything seems to look good.

until now.

with putty from css.

An error occurred while building GSSAPI security context (0x8009030c):
The logon attempt failed

and with my own putty compilation:

SSPI error: The specified target is unknown or unreachable


Any ideas would be more than welcome. I have wire taps of the actuall connection attemps, but nothing is stanidng out.

anyone know anything about caching credents on linux?

holy moly: 4 questions in one post???

[Donny Jekels]

SSPI error: No credentials are available in the security package

[Ivan Ferreira]

I'm just wondering if isn't easier if you use winbind?

[Donny Jekels]

winbind? never heard of it. what does it do?