[22341] in Kerberos
kpasswd failure due to time out
daemon@ATHENA.MIT.EDU (dkuhl)
Wed Sep 1 13:09:37 2004
Message-ID: <4134E86E.5030407@paritysys.net>
Date: Tue, 31 Aug 2004 16:06:54 -0500
From: dkuhl <dkuhl@paritysys.net>
MIME-Version: 1.0
To: kerberos@mit.edu
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Hi,
I have this problem with kpasswd. I can't seem to get it to function
properly. I always get the following dialog:
myuser@machine:~$ kpasswd
Password for myuser@OURREALM.COM:
Enter new password: :
Enter it again: :
kpasswd: Connection timed out changing password
I've googled all over the place but I can't seem to find anyone who has
had this issue before (which I find hard to believe). The environment I
have set up is comprised of all Debian machines, running the recent
(testing/sarge) krb5 packages:
krb5-admin-server - Mit Kerberos master server (kadmind)
krb5-kdc - Mit Kerberos key server (KDC)
I have a couple of servers running the kerberized ssh package and
everything at the moment seems to be functioning fine with the exception
that users cannot change their own passwords. Obviously this is a
problem.
Here are some details. Domain names, Realm names, and user names have
been changed to protect the innocent.
This is what shows up in the kdc log when I first run kpasswd:
Aug 31 12:00:06 kdc1.ourdomain.com krb5kdc[4654](info): AS_REQ
(7 etypes {18 17 16 23 1 3 2}) 192.168.2.101: NEEDED_PREAUTH:
myuser@OURREALM.COM for kadmin/changepw@OURREALM.COM, Additional
pre-authentication required
When I type in my password, I get a response asking for my new
password and the following entry appears in the kdc log:
Aug 31 12:00:09 kdc1.ourdomain.com krb5kdc[4654](info): AS_REQ
(7 etypes {18 17 16 23 1 3 2}) 192.168.2.101: ISSUE: authtime
1093971609, etypes {rep=16 tkt=16 ses=16}, myuser@OURREALM.COM for
kadmin/changepw@OURREALM.COM
That's all the ever appears in the log. I have the kadmin log
segregated and nothing ever shows up in that log during this
opperation. I thought the kadmind daemon was responsible for this but
it never gets involved from what I can tell.
Here's what the access control file (kadm5.acl) has:
*/admin *
*/admin@OURREALM.COM *
myuser@OURREALM.COM cli *
kadmin/admin@OURREALM.COM *
kadmin/changepw@OURREALM.COM * *
I put the "kadmin/changepw@OURREALM.COM" in there as an experiment -
doesn't seem to make a difference.
I could really use some help if anyone has experience with this sort of
problem. I can provide further details (kdc.conf, krb5.conf, etc) if
anyone wants them.
Thanks,
Dave
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
