[23244] in Kerberos
AW: AW: AW: Example for kinit -S ... ?
daemon@ATHENA.MIT.EDU (Barbat, Calin)
Mon Jan 24 10:30:35 2005
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Date: Mon, 24 Jan 2005 16:29:49 +0100
Message-ID: <7A05A249A3DE11459B154221006BDE6F03384D53@exc-mch01.mch.osram.de>
From: "Barbat, Calin" <c.barbat@osram.de>
To: "Roland Dowdeswell" <elric@imrryr.org>
Content-Transfer-Encoding: 8bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Hello,
I try to put it better:
1.) what I use now is:
kinit -k -t /etc/krb5.keytab <princ1>@<REALM1>
and this gets a ticket, which is displayed by klist as "Service Ticket: krbtgt/..."
2.) the only command gettig me some result is
kinit -k -t /etc/krb5.keytab <princ1>@<REALM1> -S <princ1>@<REALM1>
which leads to the klist display "Service Ticket: <princ1>@<REALM1>"
3.) when I issue
kinit -k -t /etc/krb5.keytab <princ1>@<REALM1> -S <princ2>@<REALM2>
kinit is saying something about "Server not found in kerberos database" or "Client not found in kerberos database".
I suppose, if <princ1>@<REALM1> is to use the service <princ2>@<REALM2> then it has to get a ticket for it. And the other way around, too.
How is this done best?
Is there a solution employing some flags like proxiable, forwardable, etc., or is it done by "-S"? And do I have to store all needed service tickets in the keytab?
Calin.
-----Ursprüngliche Nachricht-----
Von: Roland Dowdeswell [mailto:elric@imrryr.org]
Gesendet: Montag, 24. Januar 2005 15:33
An: Barbat, Calin
Cc: Juan Manuel Sestelo; kerberos@mit.edu
Betreff: Re: AW: AW: Example for kinit -S ... ?
On 1106555889 seconds since the Beginning of the UNIX epoch
"Barbat, Calin" wrote:
>
>As wd1adm: kinit -S SAPServiceWD2/<domain>@<REALM>
>As wd2adm: kinit -S SAPServiceWD1/<domain>@<REALM>
>
>But then I'd need to provide passwords, if I understand it well. Which I want
>to avoid, in order to make it cron-able without writing passwords in the cront
>ab. Is it possible?
If you have the keys in a keytab, then:
$ kinit -S SAPServiceWD2/<domain>@<REALM> -kt <keytab>
will get the key from the file <keytab>.
--
Roland Dowdeswell http://www.Imrryr.ORG/~elric/
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
