From owner-freebsd-questions@FreeBSD.ORG Sat Mar 19 19:54:44 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3148916A4CE for ; Sat, 19 Mar 2005 19:54:44 +0000 (GMT) Received: from kanga.honeypot.net (kanga.honeypot.net [208.162.254.122]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9A0AF43D3F for ; Sat, 19 Mar 2005 19:54:43 +0000 (GMT) (envelope-from kirk@strauser.com) Received: from localhost (localhost [127.0.0.1]) by kanga.honeypot.net (Postfix) with ESMTP id A5EAE21C901 for ; Sat, 19 Mar 2005 13:54:42 -0600 (CST) Received: from kanga.honeypot.net ([127.0.0.1]) by localhost (kanga.honeypot.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 08464-05 for ; Sat, 19 Mar 2005 13:54:40 -0600 (CST) Received: from kanga.honeypot.net (unknown [IPv6:2001:470:1f01:224:1::2]) (using TLSv1 with cipher RC4-MD5 (128/128 bits)) (No client certificate requested) by kanga.honeypot.net (Postfix) with ESMTP id 1D56821C8BC for ; Sat, 19 Mar 2005 13:54:40 -0600 (CST) From: Kirk Strauser To: freebsd-questions@freebsd.org Date: Sat, 19 Mar 2005 13:53:58 -0600 User-Agent: KMail/1.7.2 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart5854584.Nr0Z8ZzaPd"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200503191354.38712.kirk@strauser.com> X-Virus-Scanned: amavisd-new at honeypot.net Subject: ksu doesn't use my ticket X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 19 Mar 2005 19:54:44 -0000 --nextPart5854584.Nr0Z8ZzaPd Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline I have a working kdc on my LAN and use OpenSSH's "gssapi-with-mic"=20 authentication to connect to other machines. However, I can't=20 use /usr/bin/ksu to su to root without entering root's password, even if I= =20 have a current, valid ticket and am listed in root's .k5login; $ sudo cat /root/.k5login # $FreeBSD: src/etc/root/dot.k5login,v 1.1 2003/04/30 20:58:49 markm Exp $ # # user1/root@YOUR.REALM.WHEREVER # user2/root@YOUR.REALM.WHEREVER kirk@HONEYPOT.NET $ klist Credentials cache: FILE:/tmp/krb5cc_1000 Principal: kirk@HONEYPOT.NET Issued Expires Principal Mar 19 13:41:03 Mar 19 23:41:03 krbtgt/HONEYPOT.NET@HONEYPOT.NET $ ksu root's password: Sorry! Shouldn't that be sufficient to allow me to become root without entering an= y=20 passwords, or am I missing something? This is somewhat exacerbated by the= =20 fact that I can't seem to find ksu's man page or other documentation on my= =20 system. =2D-=20 Kirk Strauser --nextPart5854584.Nr0Z8ZzaPd Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQBCPIN+5sRg+Y0CpvERAtpiAJ9RiLYoB+w2kdB3eekBf8GhJdlm7gCgjVkc /j6xXpRc4CCuLJOnR/j5/VU= =Xnys -----END PGP SIGNATURE----- --nextPart5854584.Nr0Z8ZzaPd--