[22353] in Kerberos
1.3.4: kadmin tries to open log file R/W
daemon@ATHENA.MIT.EDU (Mike Friedman)
Thu Sep 2 22:13:37 2004
Date: Thu, 2 Sep 2004 19:10:59 -0700 (PDT)
From: Mike Friedman <mikef@ack.berkeley.edu>
To: kerberos@mit.edu
Message-ID: <Pine.GSO.4.58.0409021859550.7680@ack.Berkeley.EDU>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Errors-To: kerberos-bounces@mit.edu
I just installed (on my test KDC) krb5-1.3.4 along with the two recent
patches (MITKRB5-SA-2004-002 and MITKRB5-SA-2004-003). One thing I notice
is that when I use kadmin from a non-privileged user, I get this message:
Couldn't open log file /var/log/kerberos/kerberos.log: Permission denied
However, I am able to log in as administrator and my transactions do get
logged on the KDC. It is the *client* kadmin that's trying to open the
log file R/W, for some reason. The KDC, of course, which is the machine
I'm doing this on, has the KDC log file configured in its krb5.conf(*).
This is a definite change from 1.2.7, which I was running before. In
fact, if I use the kadmin from 1.2.7 against this same 1.3.4 KDC, I have
no problem and don't get the above message.
Running 'truss' (this is Solaris 8), I see that kadmin is trying to open
the log file R/W. Anyone know why this is, or should be?
(*) My krb5.conf on the KDC host has these entries, which are the same
ones I used with 1.2.7:
[logging]
kdc = FILE:/var/log/kerberos/kerberos.log
admin_server = FILE:/var/log/kerberos/kerberos.log
default = FILE:/var/log/kerberos/kerberos.log
I even tried changing the 'default' entry to a file in /tmp, in case
kadmin was using that entry for some kind of local logging. But truss
shows that kadmin is still trying to open /var/log/kerberos/kerberos.log
R/W.
Any ideas?
Thanks.
Mike
------------------------------------------------------------------------------
Mike Friedman System and Network Security
mikef@ack.Berkeley.EDU 2484 Shattuck Avenue
1-510-642-1410 University of California at Berkeley
http://ack.Berkeley.EDU/~mikef http://security.berkeley.edu
------------------------------------------------------------------------------
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
