[23131] in Kerberos
Re: More Kerberos Issues
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Fri Jan 7 16:06:49 2005
Message-ID: <41DEF90B.3000507@anl.gov>
Date: Fri, 07 Jan 2005 15:03:07 -0600
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Markus Moeller <huaraz@moeller.plus.com>
In-Reply-To: <41ded697$0$44542$ed2619ec@ptn-nntp-reader02.plus.net>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Markus Moeller wrote:
> Tyson,
>
> you might need to add -desonly to your ktpass line.
>
> Regards
> Markus
>
>
> "Tyson Oswald" <oswaldt@ameritech.net> wrote in message
> news:20050107180150.27233.qmail@web81502.mail.yahoo.com...
>
>>I created a keytab with ktpass on Win 2003 for my SEAM client. I importd it
>>into the /etc/krb5/krb5.conf
That the wrong file. the krb5.conf is the configure file. The keyfile
would be /etc/krb5/krb5.keytab I believe. Beter check the Sun docs.
and when I try and authentication through SSH
>>I get the following error in my messages
>>
>>PAM-KRB5 (auth): end: Authentication failed
>>PAM-KRB5 (auth): pam_sm_authenticate flags=1
>>PAM-KRB5 (auth): attempt_krb5_auth: start: user='cbrown'
>>PAM-KRB5 (auth): attempt_krb5_auth: krb5_get_init_creds_password returns:
>>SUCCESS
>>PAM-KRB5 (auth): krb5_verify_init_creds failed: Key table entry not found
>>PAM-KRB5 (auth): clearing initcreds in pam_authenticate()
>>PAM-KRB5 (auth): attempt_krb5_auth returning 9
>>
>>my ktpass line looks similar to this
>>
>>ktpass -princ host/snoopy@peanuts.com@PEANUTS.COM -mapuser AD\SNOOPY -pass
The principal looks wrong. It should be host/snoopy.peanuts.com@PEANUTS.COM
its host/<FQDN>@<REALM> I assume thithe the FQDN of the host is snoopy.peanuts.com
Not sure if the AD\SNOOPY is correct there must be an account for this in
in the peanuts.com AD domain.
And as Marcus says add -desonly until SEAM can support RC4.
>>"password" -crypto des-cbc-MD5 -out snoopy.keytab
>>
>>Does anyone know what I am doing wrong?
>>
>>thanks,
>>Tyson
>>________________________________________________
>>Kerberos mailing list Kerberos@mit.edu
>>https://mailman.mit.edu/mailman/listinfo/kerberos
>>
>
>
>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
