On my Windows machines at both work and home, I like to run Cygwin
to get a UNIX-like environment on Windows:
I use SSH's public key authentication
pretty extensively to get password-less authentication to make it dead-easy
(and quick!) to SSH around to different machines.
On some of the non-UNIX machines at work, I couldn't get SSH public-key auth working, but those machines do support Kerberos auth (binding to Active Directory). Based on my Google searches, all I could find were articles talking about compiling OpenSSH from source to get a working Kerberos-enabled version of OpenSSH on Cygwin. So, that made it sound like it would be a pain to get this working. But, after doing some more playing around, I found this was actually easy to setup once you understand the various pieces. Since I couldn't find any helpful information online when I first tried to get this working, I figured I'd write up what worked for me in case that helps other people.
Step 1 - Install the “openssh” package
openssh package. This gets you the OpenSSH client tools, e.g.
Step 2 - Install the “heimdal” package
heimdal package, which supplies an implementation of the Kerberos
tools. This gets you things like
Step 3 - (Optional) Configure your “krb5.conf” file
You may want to configure your
/etc/krb5.conf file to list a default realm
so that you don't need to specify it when doing the
kinit later on:
Alternatively, rather than fiddling with
/etc/krb5.conf on my Cygwin
install, I opted to use the
KRB5_CONFIG environment variable (see the
kinit manpage) to point to a
~/.krb5.conf file instead to keep my
Kerberos config confined to my
$HOME directory (since I
keep my $HOME directory under version control).
Step 4 - Modify your “.ssh/config” file
~/.ssh/config file to enable GSSAPI authentication:
- Before you
sshto a remote machine where you want to use Kerberized credentials, simply run
kinitto acquire a new Kerberos ticket. (Pro tip: you can run
klistto list all your active Kerberos tickets and their expiration dates.)
- With the
GSSAPIAuthenticationdirective in your
.ssh/configfile, that should enable GSSAPI authentication for free. There's also a
-Kparam to the
sshcommand which talks about enabling GSSAPI auth and forwarding, which I'm not entirely sure what that controls, but my guess is that it's for opting into GSSAPI auth mode if you don't have that directive in your
I hope this helps someone else who's trying to get Kerberized SSH working on Cygwin. Happy SSH'ing!