08-31-2013
GSSAPI is an interface tool. It allows C code or java code to access disparate authentication systems using an identical methodology. It often runs against Kerberos.
I do not know definitely if there is a way to "turn off" something like this, but I do not believe you can. The cause is an underlying security setting for system #2. Are you using LDAP or Active Directory? Consider getting your AD folks to look at what the user account settings are with regard to the HPUX box. The authentication in your example did NOT fail, BTW.
This User Gave Thanks to jim mcnamara For This Post:
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Is there any ftp CLIENT(either freeware or sharware) can support passive mode else ncftp?
Thanks! (2 Replies)
Discussion started by: coolmans
2 Replies
2. UNIX for Dummies Questions & Answers
How do i disable anonymous ftp on a unix system?????? Please help!!!!!!!1 (2 Replies)
Discussion started by: rrivas
2 Replies
3. UNIX for Advanced & Expert Users
Hi there, how can i disable the possibility of accessing hp-ux with ftp in the web browser?
is there any way to do this?
thanks (2 Replies)
Discussion started by: vascobrito
2 Replies
4. UNIX for Dummies Questions & Answers
These are the warning messages I am getting but the FTP works fine.How do I get rid of these?
220 FTP server (SunOS 5.8) ready.
500 'AUTH GSSAPI': command not understood.
500 'AUTH KERBEROS_V4': command not understood.
KERBEROS_V4 rejected as an authentication type (0 Replies)
Discussion started by: csviking
0 Replies
5. AIX
Hello,
I have AIX machine communication to mainframe machine. From AIX machine, i have to use always SSH communication. For this, i have created SSH tunnel in AIX machine and using FTP with SSH.
Now both connections are working:
1) only FTP to mainframe machine
2) create SSH and do FTP... (3 Replies)
Discussion started by: balareddy
3 Replies
6. Solaris
HI all,
I am using Solaris 10 and would like to know if it possible to disable ftp use for a single entry in my /etc/hosts file.
Thanks (5 Replies)
Discussion started by: pxy2d1
5 Replies
7. Solaris
Configure ldap client:
I have configured my ldapclient with the AuthenticationMethod=simple and with the credentialLevel=proxy. However, as soon as i want to set the AuthenticationMethod=sasl/GSSAPI, and credentiallevel=self, then it fails to configure. Kerberos is already setup successfully. The... (0 Replies)
Discussion started by: Henk Trumpie
0 Replies
8. HP-UX
hi everybody,
I can easily enable /disable the FTP service from SAM, how can I do this via command line? using inetd? how?
cheers,
messi (1 Reply)
Discussion started by: messi777
1 Replies
9. Red Hat
Hi Experts,
While trying ftp from newly setup Linux box it is giving following error.
GSSAPI error major:Unspecified GSS failure.Minor code may provide more information
GSSAPI error minor:Unknown code krb5 195
GSSAPI error:initializing context
GSSAPI authntication failed
504 AUTH... (1 Reply)
Discussion started by: sai_2507
1 Replies
10. Solaris
Running Solaris 10. For FTP users or groups, I want to prevent them from creating new subdirectories, but I still want to allow them to create, upload, download files from the subdirs.
I understand how to set the general file/directory permissions -- read, write, execute. So for a directory,... (0 Replies)
Discussion started by: themonman
0 Replies
LEARN ABOUT SUSE
authen::sasl::perl::gssapi
Authen::SASL::Perl::GSSAPI(3) User Contributed Perl Documentation Authen::SASL::Perl::GSSAPI(3)
NAME
Authen::SASL::Perl::GSSAPI - GSSAPI (Kerberosv5) Authentication class
SYNOPSIS
use Authen::SASL qw(Perl);
$sasl = Authen::SASL->new( mechanism => 'GSSAPI' );
$sasl = Authen::SASL->new( mechanism => 'GSSAPI',
callback => { pass => $mycred });
$sasl->client_start( $service, $host );
DESCRIPTION
This method implements the client part of the GSSAPI SASL algorithm, as described in RFC 2222 section 7.2.1 resp.
draft-ietf-sasl-gssapi-XX.txt.
With a valid Kerberos 5 credentials cache (aka TGT) it allows to connect to service@host given as the first two parameters to
Authen::SASL's client_start() method. Alternatively, a GSSAPI::Cred object can be passed in via the Authen::SASL callback hash using the
`pass' key.
Please note that this module does not currently implement a SASL security layer following authentication. Unless the connection is
protected by other means, such as TLS, it will be vulnerable to man-in-the-middle attacks. If security layers are required, then the
Authen::SASL::XS GSSAPI module should be used instead.
CALLBACK
The callbacks used are:
authname
The authorization identity to be used in SASL exchange
gssmech
The GSS mechanism to be used in the connection
pass
The GSS credentials to be used in the connection (optional)
EXAMPLE
#! /usr/bin/perl -w
use strict;
use Net::LDAP 0.33;
use Authen::SASL 2.10;
# -------- Adjust to your environment --------
my $adhost = 'theserver.bla.net';
my $ldap_base = 'dc=bla,dc=net';
my $ldap_filter = '(&(sAMAccountName=BLAAGROL))';
my $sasl = Authen::SASL->new(mechanism => 'GSSAPI');
my $ldap;
eval {
$ldap = Net::LDAP->new($adhost,
onerror => 'die')
or die "Cannot connect to LDAP host '$adhost': '$@'";
$ldap->bind(sasl => $sasl);
};
if ($@) {
chomp $@;
die "
Bind error : $@",
"
Detailed SASL error: ", $sasl->error,
"
Terminated";
}
print "
LDAP bind() succeeded, working in authenticated state";
my $mesg = $ldap->search(base => $ldap_base,
filter => $ldap_filter);
# -------- evaluate $mesg
PROPERTIES
The properties used are:
maxbuf
The maximum buffer size for receiving cipher text
minssf
The minimum SSF value that should be provided by the SASL security layer. The default is 0
maxssf
The maximum SSF value that should be provided by the SASL security layer. The default is 2**31
externalssf
The SSF value provided by an underlying external security layer. The default is 0
ssf The actual SSF value provided by the SASL security layer after the SASL authentication phase has been completed. This value is read-
only and set by the implementation after the SASL authentication phase has been completed.
maxout
The maximum plaintext buffer size for sending data to the peer. This value is set by the implementation after the SASL authentication
phase has been completed and a SASL security layer is in effect.
SEE ALSO
Authen::SASL, Authen::SASL::Perl
AUTHORS
Written by Simon Wilkinson, with patches and extensions by Achim Grolms and Peter Marschall.
Please report any bugs, or post any suggestions, to the perl-ldap mailing list <perl-ldap@perl.org>
COPYRIGHT
Copyright (c) 2006 Simon Wilkinson, Achim Grolms and Peter Marschall. All rights reserved. This program is free software; you can
redistribute it and/or modify it under the same terms as Perl itself.
perl v5.12.1 2010-03-11 Authen::SASL::Perl::GSSAPI(3)