paramiko doesn't understand kerberos tickets

[Alexander Kjäll]

If i get a kerberos ticket from my KDC and try to log in to an openssh server that have the GSSAPIAuthentication option set to "yes, paramiko still asks for my password and sends it to the server.

This have somewhat bad security consequenses. If the machine that i try to log into is compromized, my password will risk being stolen.

As far as i can see from my strace output it doesn't even try to access my kerberos keycache.

[Pedro Ferreira (pferreir)]

I'd vote for GSSAPI support in paramiko, as there are already kerberos libraries available for Python.

Is there any chance we will see this implemented in the near future?

[Erwin Richard (info-richardconsulting)]

I'm looking to use fabric as a foundation of a deployment system. Kerberos support is a key feature, as we'd like to track information on all systems with personalized kerberized accounts.

[Michael van der Kolff (mvanderkolff)]

FWIW, Paramiko does support SSH key-based authentication. Are you sure you can't use SSH keys to accomplish your goal, capitol? That wouldn't expose any password, as only the public key is on the server... As it stands, unless you have insanely long TGT expiry times, I can't see how Kerberos could be used in anything but an interactive setting, unless you kept a local password stash - I don't know if that's any better. Of course, the private key is the same thing, but you can restrict what services it opens, and a password stash might contain a password you use elsewhere.

[Alexander Kjäll (capitol)]

I could of course setup ssh keys, but that's more of a workaround than a solution.

Kerberos can use a keytab in order to use it outside of a interactive setting, you can read more about it here: http://kb.iu.edu/data/aumh.html but that's somewhat outside the scope of this feature request.

[Francois Chenais (francois-chenais)]

+1

I would like to use fabric but I can't without gssapi/kerberos support :|
Hope it will be implemented soon !

great job !

[Giulio Eulisse (eulisse)]

+1

[Jathan McCollum (jathan-gmail)]

+1: Having GSSAPI support would be invaluable for me. I have an entirely integrated Kerberos environment with which I would like to replace a cluster of legacy bash scripts with Paramiko. Please consider implementing this!

[Bryan Hughes (khan-l)]

+1: Using fabric in a clunky and reduced manner due to lack of GSSAPI support in paramiko, please implement.

[Nick Nikovich (nicknnn)]

+1 please implement

[Alex Wood (awood-j)]

+1

[Mikael Norgren (that1swede)]

Adding my name to the hat. I would love to see GSSAPI support.

[ChrisW (chris-simplistix)]

Another +1 from me.

[vincent garonne (vgaronne)]

+1

[Domingo Manubens (dmanubens)]

+1

[Simon (psillithid)]

+1; I'd also love to see GSSAPI support.

[Michael Komitee (mkomitee)]

+1

[efayol (eric.fayol)]

+1

[Leon Haverkotte (l-m-c-haverkotte)]

+1

[Jelmer Vernooij (jelmer)]

Please use the "Affects me too" link on the bug report rather than posting +1's; that way not everybody subscribed to this bug gets spammed. Thanks.

[Riskable (riskable)]

I suspect that the use of the regular ol' 'kerberos' module is all that is necessary for this to work. It can implement standard GSSAPI authentication. Someone needs to try it out (if I had time...).