[22548] in Kerberos
Auth problem while interop with win2k3
daemon@ATHENA.MIT.EDU (Song Du)
Wed Sep 22 22:29:43 2004
Message-ID: <49ba280804092219272b9c008a@mail.gmail.com>
Date: Thu, 23 Sep 2004 10:27:53 +0800
From: Song Du <freewizard@gmail.com>
To: kerberos@mit.edu
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Reply-To: Song Du <freewizard@gmail.com>
Errors-To: kerberos-bounces@mit.edu
In short, I want to use foreign realm in windows domain login.
kdc on RH9/krb5-server-1.2.7-14
Active Directory Domain Controller on Win2k3
Client PC is WinXP Sp2
I followed the steps in
http://www.microsoft.com/windows2000/techinfo/planning/security/kerbsteps.asp#heading5
but when i try to logon as user bone on WinXP into domain
REALM.GEEK.STUDENT.XXX, I got:
Sep 23 09:48:20 SERVER krb5kdc[11586](info): AS_REQ (7 etypes {23 -133
-128 3 1 24 -135}) 10.30.15.16(12920): ISSUE: authtime 1095904100,
etypes {rep=3 tkt=16 ses=1}, bone@REALM.GEEK.STUDENT.XXX for
krbtgt/REALM.GEEK.STUDENT.XXX@REALM.GEEK.STUDENT.XXX
Even with wrong password used, i still got the same msg above in
/var/log/krb5kdc.log
my conf files on RH9:
# cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
ticket_lifetime = 24000
default_realm = REALM.GEEK.STUDENT.XXX
dns_lookup_realm = false
dns_lookup_kdc = false
[realms]
REALM.GEEK.STUDENT.XXX = {
kdc = kdc.realm.geek.student.XXX:88
admin_server = kdc.realm.geek.student.XXX:749
default_domain = realm.geek.student.XXX
}
[domain_realm]
.realm.geek.student.xxx = REALM.GEEK.STUDENT.XXX
realm.geek.student.xxx = REALM.GEEK.STUDENT.XXX
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
# cat /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
v4_mode = nopreauth
[realms]
REALM.GEEK.STUDENT.XXX = {
master_key_type = des-cbc-crc
supported_enctypes = des3-cbc-sha1:normal des3-cbc-sha1:norealm
des3-cbc-sha1:onlyrealm des-cbc-crc:v4 des-cbc-crc:afs3
des-cbc-crc:normal des-cbc-crc:norealm des-cbc-crc:onlyrealm
des-cbc-md4:v4 des-cbc-md4:afs3 des-cbc-md4:normal des-cbc-md4:norealm
des-cbc-md4:onlyrealm des-cbc-md5:v4 des-cbc-md5:afs3
des-cbc-md5:normal des-cbc-md5:norealm des-cbc-md5:onlyrealm
des-cbc-sha1:v4 des-cbc-sha1:afs3 des-cbc-sha1:normal
des-cbc-sha1:norealm des-cbc-sha1:onlyrealm
}
# /usr/kerberos/sbin/kadmin.local
Authenticating as principal root/admin@REALM.GEEK.STUDENT.XXX with password.
kadmin.local: listprincs
K/M@REALM.GEEK.STUDENT.XXX
admin/admin@REALM.GEEK.STUDENT.XXX
bone@REALM.GEEK.STUDENT.XXX
kadmin/admin@REALM.GEEK.STUDENT.XXX
kadmin/changepw@REALM.GEEK.STUDENT.XXX
kadmin/history@REALM.GEEK.STUDENT.XXX
krbtgt/GEEK.STUDENT.XXX@REALM.GEEK.STUDENT.XXX
krbtgt/REALM.GEEK.STUDENT.XXX@GEEK.STUDENT.XXX
krbtgt/REALM.GEEK.STUDENT.XXX@REALM.GEEK.STUDENT.XXX
my conf on W2k3:
C:\>ksetup
default domain = geek.student.xxx (NT Domain)
REALM.GEEK.STUDENT.XXX:
kdc = kdc.realm.geek.student.xxx
Realm Flags = 0x0 none
No user mappings defined.
trust added: 2-way trust, non-trans
Name Mapping also set
--
freewizard (at) gmail.com
http://blog.tsing.org/freewizard/
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
