Skip to content

fix: krb5 ticket forwarding #227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jaysa68 merged 8 commits into from
Apr 2, 2026
Merged

fix: krb5 ticket forwarding #227

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
3eb85b3
use openssh_gssapi for sshd on all hosts
jaysa68 Apr 1, 2026
7e0d373
GSSAPIKeyExchange = yes if host has a keytab
jaysa68 Apr 1, 2026
14c9798
test an option
jaysa68 Apr 1, 2026
d4cc9fe
ticket forwarding flag
jaysa68 Apr 2, 2026
ae44e81
undo unhelpful option
jaysa68 Apr 2, 2026
3d0c263
test without specifying openssh package
jaysa68 Apr 2, 2026
f13144d
implement oliver suggestions
jaysa68 Apr 2, 2026
562f456
Merge branch 'main' into fix-krb5-tix
24apricots Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions profiles/desktop.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,15 +116,19 @@ in
# More info: https://nix.dev/guides/faq#how-to-run-non-nix-executables
programs.nix-ld.enable = true;

# Enable ticket forwarding on desktops (no password when sshing to other ocf hosts from the desktops thru supernova!)
# disabled on everything else bc they dont need to jump through hosts like that...
# Add forward flag to tickets on desktops
security.krb5.settings.libdefaults.forwardable = true;

# Only forward Kerberos tickets to login servers (fluttershy and rainbowdash)
programs.ssh.extraConfig = lib.mkOverride 90 ''
CanonicalizeHostname yes
CanonicalDomains ocf.berkeley.edu
Host *.ocf.berkeley.edu *.ocf.io 169.229.226.* 2607:f140:8801::*
Host fluttershy.ocf.berkeley.edu rainbowdash.ocf.berkeley.edu
GSSAPIAuthentication yes
GSSAPIKeyExchange yes
GSSAPIDelegateCredentials yes
Host *.ocf.berkeley.edu *.ocf.io 169.229.226.* 2607:f140:8801::*
GSSAPIAuthentication yes
GSSAPIKeyExchange yes
'';
# TODO: only forward kerberos tickets to login servers (currently supernova and tsunami)!
}
Loading