Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just upgraded my Mac OS to 10.7 Lion. It has worked well before. But, only kinit working normally now, I can't ssh to my server.

After reinstalling the "Mac OS X Kerberos Extras", it didn't get better.

My command:

ssh root@10.3.18.211 -v

......

debug1: Authentications that can continue: gssapi-with-mic,password
debug1: Next authentication method: gssapi-with-mic
debug1:  Miscellaneous failure (see text)
UNKNOWN_SERVER while looking up 'host/10.3.18.211@3.18.211' (cached result, timeout in 1200 sec)

debug1:  An invalid name was supplied
unknown mech-code 0 for mech 1 2 752 43 14 2

debug1:  Miscellaneous failure (see text)
unknown mech-code 0 for mech 1 3 6 1 5 5 14

debug1: Authentications that can continue: gssapi-with-mic,password
debug1:  An unsupported mechanism was requested
unknown mech-code 0 for mech 1 3 5 1 5 2 7

debug1:  Miscellaneous failure (see text)
unknown mech-code 0 for mech 1 3 6 1 5 2 5

debug1: Next authentication method: password
root@10.3.18.211's password:
share|improve this question

migrated from stackoverflow.com Jul 26 '11 at 8:41

This question came from our site for professional and enthusiast programmers.

    
its asking for the password at the end, is it failing if you use it, any output after that? –  cwoebker Jul 26 '11 at 7:12
    
no output after that, it seems kerberos auth failed or timeout ... –  deemstone Jul 26 '11 at 7:16

2 Answers 2

Do you have the following two lines in your ~/.ssh/config file, or in your /etc/ssh_config?:

GSSAPIAuthentication yes
GSSAPITrustDNS yes

The first is required to enable GSSAPI (Kerberos) authentication, the second one is required to get ssh to canonicalize the hostname via DNS and use the canonical name to obtain a host service ticket. Without the second one, ssh will use the exact hostname or IP address entered on the command line to try and obtain a host service ticket, and in this case it fails:

UNKNOWN_SERVER while looking up 'host/10.3.18.211@3.18.211'

The actual name of the principal is normally 'host/hostname.domain@REALM' rather than an IP address. Of course, you need a correct reverse DNS setup for this to work.

It also seems like OS X can't detect the correct realm name to use and is trying to use an IP address instead (the '@3.18.211' part). Do you have correct DNS TXT and SRV records set up for your realm and KDC? If not you'll need to enter the default realm and KDC address manually in /etc/krb5.conf.

share|improve this answer
    
Thanks a lot !!! Just add this line: GSSAPITrustDNS yes Everything work well now. –  user91785 Jul 26 '11 at 15:30
    
If something worked for you you should mark the answer as accepted using the checkmark below the score. I guess you will also have to link your accounts so that the question here belongs to you again. –  slhck Jul 26 '11 at 15:59
    
This makes no change for me right now sigh –  Heiko Rupp Feb 18 '13 at 9:40

I had these errors connecting to Centos, but not to fedora. Solved by changing my User to a full userPrincipalName instead of my short name on OS X.

~/.ssh/config:

Host svn saturnus.lan
User user@EXAMPLE.COM

SSH unknown mech-code errors:

debug1: Next authentication method: gssapi-with-mic
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Delegating credentials
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1:  An invalid name was supplied
unknown mech-code 0 for mech 1 2 752 43 14 2

debug1:  Miscellaneous failure (see text)
unknown mech-code 0 for mech 1 3 6 1 5 5 14

debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1:  An unsupported mechanism was requested
unknown mech-code 0 for mech 1 3 5 1 5 2 7

debug1:  Miscellaneous failure (see text)
unknown mech-code 0 for mech 1 3 6 1 5 2 5

debug2: we did not send a packet, disable method
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.