[22721] in Kerberos
Re: Problem with auth via keytab w/ w2k3 KDC, works fine with w2k
daemon@ATHENA.MIT.EDU (Markus Moeller)
Thu Oct 21 19:53:25 2004
To: kerberos@mit.edu
From: Markus Moeller <huaraz@moeller.plus.com>
Date: Fri, 22 Oct 2004 00:52:12 +0100
Message-ID: <41784BAC.2090902@moeller.plus.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Complaints-To: usenet@sea.gmane.org
In-Reply-To: <20040407184001.GA25740@umr.edu>
Errors-To: kerberos-bounces@mit.edu
Nathan Neulinger wrote:
> (Reposted from krbdev@mit.edu)
>
> I've got a problem with keytabs related to an upgrade from W2K to W2K3 when authenticating
> from a unix client w/ mit krb5.
>
> Principal: host/afsimap1.cc.umr.edu@UMR.EDU
> Password: (example) fred
>
> A) W2K DC
> create princ via ssl-ldap on w2k domain controller, set pw to fred
>
> kinit host/afsimap1.cc.umr.edu (against w2k dc), give password => works fine
> kinit host/afsimap1.cc.umr.edu (against w2k3 dc), give password => works fine
>
> ktutil, create keytab with that password, des-cbc-crc, kvno 1
> ktutil, create keytab with that password, des-cbc-crc, kvno 3
> (in our environment, it always winds up with kvno 3 on the w2k3 dc cause we delete princ first)
>
> kinit -k -t ... host/afsimap1.cc.umr.edu (against either dc) => works fine
>
> B) W2K3 DC
> create princ via ssl-ldap on w2k3 domain controller, set pw to fred
>
> kinit host/afsimap1.cc.umr.edu (against w2k dc), give password => works fine
> kinit host/afsimap1.cc.umr.edu (against w2k3 dc), give password => works fine
>
> ktutil, create keytab with that password, des-cbc-crc, kvno 1 and 3
>
> kinit -k -t ... host/afsimap1.cc.umr.edu (against either dc) => preauth fails
>
> when attempting to use the keytab - i.e. via telnetd or sshd w/ simon's patches - I get decrypt
> integ check failed errors (or ssh protocol error w/ pkt 34)
>
>
> The _ONLY_ change that I am making between functional and non-functional is which LDAPS server
> I point at for creating the princ and setting the password for it.
>
> I have the client-etypes hotfix applied, but not sure it's relevant to this problem since I _am_ able
> to authenticate, just not with a keytab.
>
> -- Nathan
>
> ------------------------------------------------------------
> Nathan Neulinger EMail: nneul@umr.edu
> University of Missouri - Rolla Phone: (573) 341-6679
> UMR Information Technology Fax: (573) 341-4216
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
Nathan,
did you solve your issue ? I have seen now similar problems, where
everything works fine with a 2000 kdc (I use an old MIT 1.2.4 release)
but with a 2003 kdc I get decrypt integrety errors.
Thanks
Markus
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
