Compiling OpenSSH with Kerberos support

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
I am trying to compile OpenSSH 3.7.1 for kerberos support on Solaris (8 & 9)

I am getting th efollowing error while running "make" on the openssh

PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\" -D_PATH_SFTP_SER
VER=\"/usr/local/libexec/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/local/lib
exec/ssh-keysign\" -D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DI
R=\"/.empty\" -DSSH_RAND_HELPER=\"/usr/local/libexec/ssh-rand-helper\" -DHAV
E_CONFIG_H -c sshconnect1.c
"auth.h", line 42: cannot find include file: <krb5.h>
"auth.h", line 64: syntax error before or at: krb5_context
"auth.h", line 64: cannot recover from previous errors
cc: acomp failed for sshconnect1.c
*** Error code 2
make: Fatal error: Command failed for target `sshconnect1.o'

Can somebody please help me.

Thanks and regards,


Re: Compiling OpenSSH with Kerberos support

Quoted text here. Click to load it

Well, first, you're using OpenSSH 3.7.1. If possible, you should be using
the "p1" versions of OpenSSH that have the portability patches, and you
should be using the latest version, so that would be 4.2p1.

Second, it's clear you've left out some of the "make" results, because I
don't see your compiler in there. gcc, for example, will look in
/usr/local/lib and /usr/local/include, and might find your krb5.h include
file if you have it there. Sun's commercial compilers traditionally do *NOT*
look in /usr/local/lib or /usr/local/include, you'd need ot set up your
configuration appropriately to find those.

Re: Compiling OpenSSH with Kerberos support

[Vishal sent me private email; following up here.]

On Mon, 28 Nov 2005, Gupta, Vishal wrote:

Quoted text here. Click to load it

This is correct.  The MIT Kerberos API is not a standard, and Sun does
not consider it stable enough to support.  The only way you can use
Kerberos with Sun's software is via GSSAPI.  This is the rationale I
got from Sun support when I ran into this same issue.

As a result, we had to compile & install MIT Kerberos alongside Sun's
version, even though the overlap.  We use Sun's where possible, and MIT
when we have to.  I pray it doesn't cause us some obscure problem

- Richard

Re: Compiling OpenSSH with Kerberos support

Quoted text here. Click to load it

We have had reports of a problem with sshd segfaulting when compiled
with both --with-pam and --with-kerberos5=[mitkrb5].  It segfaults deep
inside the Solaris pam_krb5 module.  Omit either PAM or krb5 support
and it will work fine.

The bug record is here:

Darren Tucker (dtucker at
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

Site Timeline