Hack the Route Start free Open app Services and tunnels
gss-client
MIT's GSSAPI sample client and server: log in to a service with a Kerberos ticket, the way SSH or HTTP do underneath.
GSSAPI is the standard interface programs use to authenticate with Kerberos (SSH's
GSSAPIAuthentication, Kerberos on the web as SPNEGO). gss-client takes a host, a port and the service's
principal (host@server.lab), gets a service ticket for it from the ticket cache (via the KDC), and sets up an
authenticated context; it prints the context ("alice@REALM" to "host/server.lab@REALM") and Signature verified. on success. gss-server is the matching service, opening each ticket with its keytab. Here they stand in
for an application, since this image's SSH client is built without GSSAPI.
gss-client command usage
gss-client [-port PORT] HOST SERVICE@HOST MESSAGE gss-server [-port PORT] -keytab FILE SERVICE@HOST
Options
-
-port PORT - the TCP port of the service
-
SERVICE@HOST - the service principal to get a ticket for (host@server.lab)
-
-keytab FILE - gss-server: the keytab holding the service's key
-
-q - gss-client: quiet, without the token dumps
gss-client examples
-
gss-client -port 4444 shellServer.lab host@shellserver.lab hi - Logs in to the service with a Kerberos ticket and prints the context it set up.
Pitfalls
- No ticket in the cache means no login: run kinit first (GSSAPI never asks for a password).
- Asking for a service by IP address makes a principal the KDC does not know; use the name in the realm.