[23041] in Kerberos
Re: kerberos/imap trouble
daemon@ATHENA.MIT.EDU (Thomas A. La Porte)
Fri Dec 10 11:03:33 2004
Date: Fri, 10 Dec 2004 08:02:46 -0800 (PST)
From: "Thomas A. La Porte" <tlaporte@anim.dreamworks.com>
To: Mark Hannessen <mark@nperfection.com>
In-Reply-To: <200412101427.30340.mark@nperfection.com>
Message-ID: <Pine.LNX.4.44.0412100759380.29840-100000@sunset.anim.dreamworks.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Fri, 10 Dec 2004, Mark Hannessen wrote:
[...]
>
>I then try running the imtest program to test out if everything is ok.
>
>[...]
>when i run klist again it returns:
>
>Ticket cache: FILE:/tmp/krb5cc_0
>Default principal: mark@LINUXNET.NL
>
>Valid starting Expires Service principal
>12/10/04 11:17:50 12/11/04 11:17:50 krbtgt/LINUXNET.NL@LINUXNET.NL
>12/10/04 11:18:38 12/11/04 11:17:50 imap/xp2600c.linuxnet.nl@LINUXNET.NL
>Kerberos 4 ticket cache: /tmp/tkt0
>klist: You have no tickets cached
>
>so I DO see an addition principal in my list.
>
>as expected the cyrus admin tool doesn't work as well.
>
>cyradm xp2600c.linuxnet.nl -auth GSSAPI
>cyradm: cannot authenticate to server with GSSAPI as mark
>
>my system log file contains the following:
>
>Dec 10 11:33:48 xp2600c imap[1896]: badlogin: xp2600c.linuxnet.nl [10.4.8.27]
>GSSAPI [SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (No
>principal in keytab matches desired name)]
Here is the major hint in the output, that there is no principal
in your keytab that matches the *desired* name.
>But I don't understand this messege since I DID add imap/xp2600c.linuxnet.nl
>to the servers keytab.
>
>my imapd.conf looks like this:
>
>servername: nperfection.com
[...]
And this is almost certainly the line in imapd.conf that is
causing the problem. Your client is getting a ticket for
imap/xp2600c.linuxnet.nl, while your server is advertising itself
as imap/nperfection.com
You will likely either need to change the 'servername' parameter
in imapd.conf to xp2600c.linuxnet.nl, or you need to create a
service principal of imap/nperfection.com and put *that* key into
your keytab.
-- Tom
Thomas A. La Porte, DreamWorks SKG
<mailto:tlaporte@anim.dreamworks.com>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
