Bug#668195: openssh-server: Forwarded Kerberos ticket has the wrong filename

[Liam Healy <lnp@healy.washington.dc.us>]

Package: openssh-server                                                                                                    

Version: 1:5.5p1-6+squeeze1                                                                                                

Severity: normal

When sshing to this computer with forwarded tickets,  the filename is changed from what is defined by $KRBCCNAME on the client to some kind of default naming /tmp/krb5ccname_<uid>_xxxxx.   This means that the ticket is there, but not under the expected name, so setting $KRB5CCNAME on the server to the same value on the client means that the ticket is not seen.  This worked correctly under lenny.

-- System Information:

Debian Release: 6.0.4

  APT prefers stable

  APT policy: (500, 'stable')

Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-5-amd64 (SMP w/8 CPU cores)

Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Shell: /bin/sh linked to /bin/dash

Versions of packages openssh-server depends on:

ii  adduser             3.112+nmu2           add and remove users and groups

ii  debconf [debconf-2. 1.5.36.1             Debian configuration management sy

ii  dpkg                1.15.8.12            Debian package management system

ii  libc6               2.11.3-2             Embedded GNU C Library: Shared lib

ii  libcomerr2          1.41.12-4stable1     common error description library

ii  libgssapi-krb5-2    1.8.3+dfsg-4squeeze5 MIT Kerberos runtime libraries - k

ii  libkrb5-3           1.8.3+dfsg-4squeeze5 MIT Kerberos runtime libraries

ii  libpam-modules      1.1.1-6.1+squeeze1   Pluggable Authentication Modules f

ii  libpam-runtime      1.1.1-6.1+squeeze1   Runtime support for the PAM librar

ii  libpam0g            1.1.1-6.1+squeeze1   Pluggable Authentication Modules l

ii  libselinux1         2.0.96-1             SELinux runtime shared libraries

ii  libssl0.9.8         0.9.8o-4squeeze7     SSL shared libraries

ii  libwrap0            7.6.q-19             Wietse Venema's TCP wrappers libra

ii  lsb-base            3.2-23.2squeeze1     Linux Standard Base 3.2 init scrip

ii  openssh-blacklist   0.4.1                list of default blacklisted OpenSS

ii  openssh-client      1:5.5p1-6+squeeze1   secure shell (SSH) client, for sec

ii  procps              1:3.2.8-9            /proc file system utilities

ii  zlib1g              1:1.2.3.4.dfsg-3     compression library - runtime

Versions of packages openssh-server recommends:

ii  openssh-blacklist-extra       0.4.1      list of non-default blacklisted Op

ii  xauth                         1:1.0.4-1  X authentication utility

Versions of packages openssh-server suggests:

pn  molly-guard                   <none>     (no description available)

pn  rssh                          <none>     (no description available)

pn  ssh-askpass                   <none>     (no description available)

pn  ufw                           <none>     (no description available)

-- debconf information:

  ssh/vulnerable_host_keys:

  ssh/new_config: true

* ssh/use_old_init_script: true

  ssh/encrypted_host_key_but_no_keygen:

  ssh/disable_cr_auth: false