Home / server / Questions / 75362
Accepted
jldugger
Asked: 2009-10-17 12:55:12 +0800 CST

What is gssapi-with-mic?

  • 772

Debugging a Nagios warning on ssh, I've discovered that gssapi-with-mic is causing long lags in authentication. I've turned it off, but what exactly am I missing? I gather that GSSAPI is a tool for authentication, but what about the -with-mic part?

linux

3 Answers

  1. Best Answer

    Message Integrity Code.

    This is also called a Message Authentication Code, but that acronym gets used for other things, so MIC is less ambiguous. From that Wikipedia page:

    The term message integrity code (MIC) is frequently substituted for the term MAC, especially in communications, where the acronym MAC traditionally stands for Media Access Control.

    • 29

  2. The fix is simple: disable attempts to use GSS-API by adding the following to ~/.ssh/config:

    GSSAPIAuthentication no
    • 3

  3. GSSAPI Authentication is typically used with Kerberos. Kerberos must be configured on both the server and client. If you are not using Kerberos, then you probably do not need it. If you are just using password or SSH keys to log in to your server you likely do not need GSSAPI, and you can disable it in the sshd_config file.

    Set in the /etc/ssh/sshd_config

    GSSAPIAuthentication no

    As for the "with-mic" part, there are two authentication methods for GSSAPI; with-mic and -keyex. The MIC stands for message integrity code. And from what I gather from reading the RFC-4462 it is generated by the client using many of the agreed upon connection parameters and is hashed several times. Read more

    • 0