[22080] in Kerberos
RE: Solaris pam-krb5 client and MIT krb5 KDC on Linux (Eliot Lebsack)
daemon@ATHENA.MIT.EDU (Eliot Lebsack)
Wed Jul 28 08:38:44 2004
From: "Eliot Lebsack" <elebsack@mitre.org>
To: "'Henry B. Hotz'" <hotz@jpl.nasa.gov>
Date: Wed, 28 Jul 2004 08:34:10 -0400
Message-ID: <000901c4749f$2ea14700$1b515381@MITRE.ORG>
MIME-Version: 1.0
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: 7bit
In-reply-to: <F7B4AB88-DFED-11D8-B460-000A95CA746C@jpl.nasa.gov>
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Henry,
Thanks for going through this with me. In response to your
questions:
>>1) Can the user (once logged in) do a kinit? (If not check krb5.conf
permissions, and contents.)
When I "su - <username>" from root, and do a kinit, the ticket
is granted by the KDC correctly.
>>2) Can the user (once kinit'ed) get a host service ticket? (Try
telnet'ing to yourself at the external network address. I think that
will do it. If not you need a second machine.)
After doing "su - <username>" from root, and a kinit as <username>,
I'm unable to telnet to my solaris 8 machine at the external address.
I then went to a Linux client on the same KDC/Realm, logged in as
<username>, kinit, then used the kerberized telnet to try to log
onto the solaris 8 machine, but was unsuccessful.
>>3) Does the local keytab work? (Try kinit -k as root. klist should
show you are kinit'ed as host/your.machine@YOUR.REALM.)
kinit -k shows nothing. My /etc/krb5/krb5.keytab file has the following
entries:
slot KVNO Principal
---- ---- -------------------------------------------
1 3 root/<fqdn of solaris 8 machine>@<REALM>
2 3 host/<fqdn of solaris 8 machine>@<REALM>
They were added at the KDC with the following arguments:
addprinc -randkey -e des-cbc-crc:normal {host,root}/<fqdn of solaris 8
machine>
and added to the keytab with the following arguments
ktadd -k /etc/sol8.krb5.keytab -e des-cbc-crc:normal {host,root}/<fqdn of
solaris 8 machine>
The file /etc/sol8.krb5.keytab was copied to /etc/krb5/krb5.keytab on the
solaris
8 machine, with permissions 0600.
I've enabled pam debugging as follows:
a) add "auth.debug /etc/pam_debug" to /etc/syslog.conf
b) touch /etc/pam_debug
c) /etc/init.d/syslog stop; /etc/init.d/syslog start
Regards,
Eliot
======================================================
Eliot Lebsack (781) 271-5830
Lead Communications Engineer elebsack@mitre.org
The MITRE Corporation Bedford, MA
2) Can the user (once kinit'ed) get a host service ticket? (Try
telnet'ing to yourself at the external network address. I think that
will do it. If not you need a second machine.)
3) Does the local keytab work? (Try kinit -k as root. klist should
show you are kinit'ed as host/your.machine@YOUR.REALM.)
4) Does the host service ticket agree with the one in the local
/etc/krb5/krb5.keytab? (Not sure exactly how to check this. The
Solaris ktutil doesn't show much info. Presumably if both 2 and 3 work
it should be OK, but they might be different kvno's.)
Don't know if Sol 8 is completely like Sol 9, but the pam modules need
the host principal to work for full functionality on 9.
Isn't there a debug option for the pam modules?
On Jul 27, 2004, at 6:29 AM, Eliot Lebsack wrote:
> Henry,
>
> I checked all of the permissions, and they check out.
> However, this does not fix the problem.
>
> Regards,
>
> Eliot
>
> ======================================================
> Eliot Lebsack (781) 271-5830
> Lead Communications Engineer elebsack@mitre.org
> The MITRE Corporation Bedford, MA
>
> -----Original Message-----
> From: Henry B. Hotz [mailto:hotz@jpl.nasa.gov]
> Sent: Monday, July 26, 2004 6:20 PM
> To: Eliot Lebsack
> Cc: kerberos@mit.edu
> Subject: Re: Solaris pam-krb5 client and MIT krb5 KDC on Linux (Eliot
> Lebsack)
>
>
> Right, that's the problem. You need to set -rw-r--r-- (644) for
> krb5.conf.
>
> Those permissions are correct for krb5.keytab.
>
> Both should be root owned.
>
> On Jul 26, 2004, at 1:05 PM, Eliot Lebsack wrote:
>
>> Henry,
>>
>> Just checked - the permissions are -rw------- (0600).
>> Still have the same problem. The /etc/krb5/krb5.keytab
>> file is also set with the same permissions.
>>
>> Regards,
>>
>> Eliot
>>
>> ======================================================
>> Eliot Lebsack (781) 271-5830
>> Lead Communications Engineer elebsack@mitre.org
>> The MITRE Corporation Bedford, MA
>>
>> -----Original Message-----
>> From: Henry B. Hotz [mailto:hotz@jpl.nasa.gov]
>> Sent: Monday, July 26, 2004 3:17 PM
>> To: kerberos@mit.edu
>> Cc: Eliot Lebsack
>> Subject: Re: Solaris pam-krb5 client and MIT krb5 KDC on Linux (Eliot
>> Lebsack)
>>
>>
>> If it works as root, but not as a user, then it sounds like a
>> permissions problem. Is /etc/krb5/krb5.conf world-readable?
>>
>> On Jul 26, 2004, at 9:00 AM, kerberos-request@mit.edu wrote:
>>
>>> Date: Mon, 26 Jul 2004 09:55:02 -0400
>>> From: "Eliot Lebsack" <elebsack@mitre.org>
>>> To: <kerberos@mit.edu>
>>> Subject: Solaris pam-krb5 client and MIT krb5 KDC on Linux
>>> Message-ID: <000901c47318$25c78aa0$1b515381@MITRE.ORG>
>>> Content-Type: text/plain;
>>> charset="us-ascii"
>>> MIME-Version: 1.0
>>> Content-Transfer-Encoding: 7bit
>>> Precedence: list
>>> Message: 1
>>>
>>> Good morning.
>>>
>>> I've set up a KDC on a RHEL 3 box with NIS as the
>>> name service. All of my Linux boxes have no problem
>>> authenticating against this configuration.
>>>
>>> When I attempted to migrate my Solaris 8 (2/02) Ultra 80
>>> to this authentication/name service combination, using
>>> the on-board (non-SEAM) kerberos authentication tools
>>> which are run when reconfiguring a system (running sys-unconfig,
>>> then rebooting), I entered the fields for Kerberos
>>> as those used by my Linux machines.
>>>
>>> I went ahead and synced up my /etc/krb5/krb5.conf file with
>>> that used by the Linux clients. I uncommented the pam.conf
>>> lines for the pam_krb5.so.1 module as directed by the documention
>>> I could find on the web. I've even generated a keytab for the
>>> host principle, and moved it into /etc/krb5/krb5.keytab.
>>>
>>> I've checked my DNS setup as well as NTP. Everything looks good.
>>>
>>> When I attempt to log onto the Solaris 8 machine as a regular
>>> user, forcing the machine to refer to NIS/Kerberos for more
>>> information,
>>> the pam_krb5 authentication module refuses to allow access.
>>>
>>> When I "su -" to the user from root, and do a kinit as the user,
>>> it successfully gets the Kerberos ticket.
>>>
>>> It appears that pam_krb5 is not entering the authentication
>>> process correctly, or that it is not negotiating with the KDC
>>> correctly.
>>>
>>> Has anyone else tried a similar configuration? I'm trying to
>>> do something real basic here; no kerberized NFS or anything like
>>> that.
>>>
>>> I also tried installing SEAM for Solaris 8, and still had the
>>> same problem.
>>>
>>> Regards,
>>>
>>> Eliot
>>>
>>> ======================================================
>>> Eliot Lebsack (781) 271-5830
>>> Lead Communications Engineer
>>> The MITRE Corporation Bedford, MA
>> ----------------------------------------------------------------------
>> -
>> -
>> ----
>> The opinions expressed in this message are mine,
>> not those of Caltech, JPL, NASA, or the US Government.
>> Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu
>>
>>
>>
> -----------------------------------------------------------------------
> -
> ----
> The opinions expressed in this message are mine,
> not those of Caltech, JPL, NASA, or the US Government.
> Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu
>
>
>
------------------------------------------------------------------------
----
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
