[23014] in Kerberos
Solaris using Kerberos
daemon@ATHENA.MIT.EDU (David A Flores)
Tue Dec 7 17:43:24 2004
From: "David A Flores" <David.A.Flores@uth.tmc.edu>
To: <kerberos@mit.edu>
Date: Tue, 7 Dec 2004 16:26:39 -0600
MIME-Version: 1.0
Message-ID: <I8DIIZ03.8ZR@oac40.hsc.uth.tmc.edu>
Content-Type: multipart/mixed; boundary="===============1587938320182456=="
Errors-To: kerberos-bounces@mit.edu
This is a multi-part message in MIME format.
--===============1587938320182456==
Content-Type: multipart/signed;
protocol="application/x-pkcs7-signature";
micalg=SHA1;
boundary="----=_NextPart_000_00D5_01C4DC79.86D92DB0"
This is a multi-part message in MIME format.
------=_NextPart_000_00D5_01C4DC79.86D92DB0
Content-Type: multipart/mixed;
boundary="----=_NextPart_001_00D6_01C4DC79.86D92DB0"
------=_NextPart_001_00D6_01C4DC79.86D92DB0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Help anyone,
We are using a Windows domain controller as a KDC and we are trying to
authenticate a Solaris 9.0 OS box using Kerberos. The following is the
command we use to create the keytab file:
ktpass -princ host/dean19.uthsch.edu@UTHSCU.EDU -mapuser dean19 -pass * -out
c:\dean19.keytab
Once we create the keytab file we send it to the sever via ssh. Attached
are the pam.conf file and the krb5.conf that we configured. One the
computer called dean19 we ran the ktutil
rkt /etc/krb5/dean.keytab
wkt /etc/krb5/krb5.keytab
After the rkt and the wkt commands we do a list and it shows a "slot KVNO
Principal"
We then validate the server's ability to communicate with the MS Kerberos
Domain Controller by requesting a Ticket Granting Ticket using kinit.
We then use klist to verify that a TGT has been issued.
But when we try to login to the box we get the following error.
Dec 7 16:27:38 dean19 login: [ID 537602 auth.error] PAM-KRB5 (auth):
krb5_verify_init_creds failed: Key table entry not found
We tried it on 2 solaris machines and we are getting the same error. Does
anyone know why this might be happening?
David Flores
Medical School Information Technology
System Analyst II
713-500-5211
------=_NextPart_001_00D6_01C4DC79.86D92DB0
Content-Type: text/plain;
name="pam.conf.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="pam.conf.txt"
#
#ident "@(#)pam.conf 1.20 02/01/23 SMI"
#
# Copyright 1996-2002 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#
# PAM configuration
#
# Unless explicitly defined, all services use the modules
# defined in the "other" section.
#
# Modules are defined with relative pathnames, i.e., they are
# relative to /usr/lib/security/$ISA. Absolute path names, as
# present in this file in previous releases are still acceptable.
#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login auth sufficient pam_krb5.so.1 try_first_pass
login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth required pam_unix_auth.so.1
login auth required pam_dial_auth.so.1
#
# rlogin service (explicit because of pam_rhost_auth)
#
rlogin auth sufficient pam_rhosts_auth.so.1
rlogin auth requisite pam_authtok_get.so.1
rlogin auth required pam_dhkeys.so.1
rlogin auth required pam_unix_auth.so.1
#
# rsh service (explicit because of pam_rhost_auth,
# and pam_unix_auth for meaningful pam_setcred)
#
rsh auth sufficient pam_rhosts_auth.so.1
rsh auth required pam_unix_auth.so.1
#
# PPP service (explicit because of pam_dial_auth)
#
ppp auth requisite pam_authtok_get.so.1
ppp auth required pam_dhkeys.so.1
ppp auth required pam_unix_auth.so.1
ppp auth required pam_dial_auth.so.1
#
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authenctication
#
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth sufficient pam_unix_auth.so.1
#
# passwd command (explicit because of a different authentication module)
#
passwd auth required pam_passwd_auth.so.1
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cron account required pam_projects.so.1
cron account required pam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other account requisite pam_roles.so.1
other account required pam_projects.so.1
other account required pam_unix_account.so.1
#
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
other session required pam_unix_session.so.1
#
# Default definition for Password management
# Used when service name is not explicitly mentioned for password management
#
other password required pam_dhkeys.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1
other password required pam_authtok_store.so.1
#
# Support for Kerberos V5 authentication (uncomment to use Kerberos)
#
#rlogin auth optional pam_krb5.so.1 try_first_pass
#login auth optional pam_krb5.so.1 try_first_pass
#other auth optional pam_krb5.so.1 try_first_pass
#cron account optional pam_krb5.so.1
#other account optional pam_krb5.so.1
#other session optional pam_krb5.so.1
#other password optional pam_krb5.so.1 try_first_pass
------=_NextPart_001_00D6_01C4DC79.86D92DB0
Content-Type: text/plain;
name="krb5.conf.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="krb5.conf.txt"
[libdefaults]
default_realm = UTHSCH.EDU
default_keytab_name = FILE:/etc/krb5/krb5.keytab
default_tkt_enctypes = des-cbc-md5 des-cbc-crc
default_tgs_enctypes = des-cbc-md5 des-cbc-crc
[realms]
UTHSCH.EDU = {
kdc = msdc1.uthsch.edu
admin_server = msdc1.uthsch.edu
}
[domain_realm]
.uthsch.edu = UTHSCH.EDU
uthsch.edu = UTHSCH.EDU
[logging]
default = FILE:/var/krb5/kdc.log
kdc = FILE:/var/krb5/kdc.log
[appdefaults]
gkadmin = {
help_url = http://docs.sun.com:80/ab2/coll.384.1/SEAM/@AB2PageView/1195
}
------=_NextPart_001_00D6_01C4DC79.86D92DB0--
------=_NextPart_000_00D5_01C4DC79.86D92DB0
Content-Type: application/x-pkcs7-signature;
name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="smime.p7s"
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILwDCCAwMw
ggJsAhEAuS9gzIifoXpGCbhbcGyKrzANBgkqhkiG9w0BAQUFADCBwTELMAkGA1UEBhMCVVMxFzAV
BgNVBAoTDlZlcmlTaWduLCBJbmMuMTwwOgYDVQQLEzNDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENl
cnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIxOjA4BgNVBAsTMShjKSAxOTk4IFZlcmlTaWduLCBJ
bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l
dHdvcmswHhcNOTgwNTE4MDAwMDAwWhcNMjgwODAxMjM1OTU5WjCBwTELMAkGA1UEBhMCVVMxFzAV
BgNVBAoTDlZlcmlTaWduLCBJbmMuMTwwOgYDVQQLEzNDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENl
cnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIxOjA4BgNVBAsTMShjKSAxOTk4IFZlcmlTaWduLCBJ
bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l
dHdvcmswgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKeIASF0LOcaA/CY4Zc8DyEI8Zzbl+ma
/MIEBhO+X1LIzB4sElYsuAFpLMyZH62wlq55BPITOcF7mLoILOjChBMsqmnpCfTHqQKkQsIjT0rY
8A6i+zFsyeZvmScH9eb0THiebetGhvq5hslU8rLEr9RGHFrJFTD/DWz1LQ5tzn93AgMBAAEwDQYJ
KoZIhvcNAQEFBQADgYEAci75f9HxcfvEnvbFXlGKQJi4aPibHIPY4p29/+2h5mbqLwn0ytfqpSuV
9iRghk1ELoOlxC2g0654aW9y2myuCPBjkjfmu8QwF613zEk1qs/Yj9G+txiWR3NqVCI0ZC22FptZ
W7RRWTqzCxT0Et9noPStMmResUZyJ4wSe8VEtK4wggPwMIIDWaADAgECAhABw8xJYFzoc17tYstm
SkmTMA0GCSqGSIb3DQEBBAUAMIHBMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIElu
Yy4xPDA6BgNVBAsTM0NsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp
dHkgLSBHMjE6MDgGA1UECxMxKGMpIDE5OTggVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXpl
ZCB1c2Ugb25seTEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazAeFw05OTAzMzEwMDAw
MDBaFw0wNzAxMTQyMzU5NTlaMIIBATEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMg
U3lzdGVtMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBv
ZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYyk5OTEyMDAGA1UECxMpQ2xh
c3MgMiBDQSAtIE9uU2l0ZSBJbmRpdmlkdWFsIFN1YnNjcmliZXIxRDBCBgNVBAMTO1RoZSBVbml2
ZXJzaXR5IG9mIFRleGFzIEhlYWx0aCBTY2llbmNlIENlbnRlciBhdCBIb3VzdG9uIENBMIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDGGbuzQ+NJC1mzr2LkD2/DxZLamIUyF4bFAuvjkZ0iwSQY
xmzPZIde7Gplp3IsTSE8IJF/537r2OjMP4xCBo7PtEzWHcWK3CQXNtxS6zEYF0p4LYmAGIFSOHup
KqPLDB1fd1m6YG/3V2EvWSnp44Ab/SmxiCwO/uRlzckvvo+06wIDAQABo4GlMIGiMCkGA1UdEQQi
MCCkHjAcMRowGAYDVQQDExFQcml2YXRlTGFiZWwxLTE0MjARBglghkgBhvhCAQEEBAMCAQYwRAYD
VR0gBD0wOzA5BgtghkgBhvhFAQcBATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2ln
bi5jb20vUlBBMA8GA1UdEwQIMAYBAf8CAQAwCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBBAUAA4GB
AKTdefW0r6bxNLuPSGBjPMWcLkCi3o5MjCcHAl0jWuJ48GrCeGoRXVw4fIsXnJqQuvqfowjf9OfN
hSPsacYH3lPNESeHxUG1w5fNo/ZX08M382ILPZMc9kyQJQaa78krD1l9LhyEARSBQfj/qo20B2/n
3G94dVPEq+F8P338vx+tMIIEwTCCBCqgAwIBAgIQN2An97N525igYCcKq68KZjANBgkqhkiG9w0B
AQQFADCCAQExJzAlBgNVBAoTHlRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIFN5c3RlbTEfMB0GA1UE
CxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBz
Oi8vd3d3LnZlcmlzaWduLmNvbS9ycGEgKGMpOTkxMjAwBgNVBAsTKUNsYXNzIDIgQ0EgLSBPblNp
dGUgSW5kaXZpZHVhbCBTdWJzY3JpYmVyMUQwQgYDVQQDEztUaGUgVW5pdmVyc2l0eSBvZiBUZXhh
cyBIZWFsdGggU2NpZW5jZSBDZW50ZXIgYXQgSG91c3RvbiBDQTAeFw0wNDExMTYwMDAwMDBaFw0w
NTExMTYyMzU5NTlaMIHhMScwJQYDVQQKFB5UaGUgVW5pdmVyc2l0eSBvZiBUZXhhcyBTeXN0ZW0x
LDAqBgNVBAsUI0hlYWx0aCBTY2llbmNlIENlbnRlciBhdCBIb3VzdG9uIENBMUYwRAYDVQQLEz13
d3cudmVyaXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTIEluY29ycC4gYnkgUmVmLixMSUFCLkxURChj
KTk5MRUwEwYDVQQDEwxEYXZpZCBGbG9yZXMxKTAnBgkqhkiG9w0BCQEWGmRhdmlkLmEuZmxvcmVz
QHV0aC50bWMuZWR1MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDN1TTFB7DRjjmQEP45Kcka
Gv2OxWnFkl9L5RHrePBEaOnTx8IMQrq5UNEdL7prH6d1bcWvIGzNi97p6k+QKgGjg5X1hXC6I35E
bxbFBgDJNBytF/E42QE7v2K6GxurzojW0mie7fqT1hV5HXJTOjNLOMNtabKHxaQUZ+xHk031fwID
AQABo4IBVTCCAVEwCQYDVR0TBAIwADCBrAYDVR0gBIGkMIGhMIGeBgtghkgBhvhFAQcBATCBjjAo
BggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL0NQUzBiBggrBgEFBQcCAjBWMBUW
DlZlcmlTaWduLCBJbmMuMAMCAQEaPVZlcmlTaWduJ3MgQ1BTIGluY29ycC4gYnkgcmVmZXJlbmNl
IGxpYWIuIGx0ZC4gKGMpOTcgVmVyaVNpZ24wCwYDVR0PBAQDAgWgMBEGCWCGSAGG+EIBAQQEAwIH
gDB1BgNVHR8EbjBsMGqgaKBmhmRodHRwOi8vb25zaXRlY3JsLnZlcmlzaWduLmNvbS9UaGVVbml2
ZXJzaXR5b2ZUZXhhc1N5c3RlbUhlYWx0aFNjaWVuY2VDZW50ZXJhdEhvdXN0b25DQS9MYXRlc3RD
UkwuY3JsMA0GCSqGSIb3DQEBBAUAA4GBAC2cM6N5+WmUbLawfAhPGu6NBaoiKxHljbvVJVpyapvo
hl2nZsKI6MSeIhc7ksoz0ZDrcukYihaRB2FRRq6K3nyP8Eu4gzcohV06JyE3PPZcDH706JeGa3vk
G19pXBkqzBgDIgZzFHrurb47z1xfJwgyH8jQoTwz/+DeUOCDn8PPMYIE5zCCBOMCAQEwggEXMIIB
ATEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMgU3lzdGVtMR8wHQYDVQQLExZWZXJp
U2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cu
dmVyaXNpZ24uY29tL3JwYSAoYyk5OTEyMDAGA1UECxMpQ2xhc3MgMiBDQSAtIE9uU2l0ZSBJbmRp
dmlkdWFsIFN1YnNjcmliZXIxRDBCBgNVBAMTO1RoZSBVbml2ZXJzaXR5IG9mIFRleGFzIEhlYWx0
aCBTY2llbmNlIENlbnRlciBhdCBIb3VzdG9uIENBAhA3YCf3s3nbmKBgJwqrrwpmMAkGBSsOAwIa
BQCgggMkMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA0MTIwNzIy
MjYzOFowIwYJKoZIhvcNAQkEMRYEFD1W7+P5wUqVzFEx9wKuw4ejxs+ZMGcGCSqGSIb3DQEJDzFa
MFgwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0G
CCqGSIb3DQMCAgEoMAcGBSsOAwIaMAoGCCqGSIb3DQIFMIIBKgYJKwYBBAGCNxAEMYIBGzCCARcw
ggEBMScwJQYDVQQKEx5UaGUgVW5pdmVyc2l0eSBvZiBUZXhhcyBTeXN0ZW0xHzAdBgNVBAsTFlZl
cmlTaWduIFRydXN0IE5ldHdvcmsxOzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3
dy52ZXJpc2lnbi5jb20vcnBhIChjKTk5MTIwMAYDVQQLEylDbGFzcyAyIENBIC0gT25TaXRlIElu
ZGl2aWR1YWwgU3Vic2NyaWJlcjFEMEIGA1UEAxM7VGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMgSGVh
bHRoIFNjaWVuY2UgQ2VudGVyIGF0IEhvdXN0b24gQ0ECEDdgJ/ezeduYoGAnCquvCmYwggEsBgsq
hkiG9w0BCRACCzGCARugggEXMIIBATEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMg
U3lzdGVtMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBv
ZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYyk5OTEyMDAGA1UECxMpQ2xh
c3MgMiBDQSAtIE9uU2l0ZSBJbmRpdmlkdWFsIFN1YnNjcmliZXIxRDBCBgNVBAMTO1RoZSBVbml2
ZXJzaXR5IG9mIFRleGFzIEhlYWx0aCBTY2llbmNlIENlbnRlciBhdCBIb3VzdG9uIENBAhA3YCf3
s3nbmKBgJwqrrwpmMA0GCSqGSIb3DQEBAQUABIGAt3xMjXfurbHnZ2NuZr3s0RIGPs5E5ddDBy5J
6GStMBR7BbFu2/JEInN6KdgBkuBnPSr7cM7QcrqjggfishreEJqdds3JUc3oKg8AlsSUdyo4rR/j
TEpxkK0cvia/j7kMoqRXguOWCOjCN34O6yJuAEWUHusflSuE8o7LKhKKvvEAAAAAAAA=
------=_NextPart_000_00D5_01C4DC79.86D92DB0--
--===============1587938320182456==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============1587938320182456==--
