[23549] in Kerberos
Pam kerberos vs. Kinit
daemon@ATHENA.MIT.EDU (Ethan Bearman)
Thu Mar 17 14:44:33 2005
Date: Thu, 17 Mar 2005 11:43:35 -0800
From: Ethan Bearman <ebearman@usc.edu>
In-reply-to: <42399EEF.6090608@anl.gov>
To: kerberos@mit.edu
Message-id: <6.2.1.2.2.20050317113354.02075188@email.usc.edu>
MIME-version: 1.0
Content-type: text/plain; charset=us-ascii; format=flowed
Content-transfer-encoding: 7BIT
Errors-To: kerberos-bounces@mit.edu
At 07:14 AM 3/17/2005, you wrote:
>Ethan Bearman wrote:
>>I'm getting kerberos error 52 when I try to kinit from hp-ux (11.0
>>running on 9000 series system) to our Windows 2003 AD domain. It works
>>for certain admin accounts that have few group memberships, but not for
>>regular users.
>>I understand this to be due to the large PAC headers Windows is using for
>>authorization data, which causes Windows to use TCP rather than
>>UDP. Apparently versions of MIT kerberos earlier than 1.3.1 do not
>>support TCP.
I've just run another test and discovered that I can successfully log into
the host initially (via PAM kerberos library and SSH), and I don't get
error 52. I've got a ticket in my cache and everything. Kerb error 52
only occurs if I'm using kinit from the shell.
How could this be? I believe the PAM kerberos library that HP supplies is
based on Krb1.1, which I thought would not be able to communicate via TCP
to our W2k3 KDC's. Does anyone know why this is working through PAM, and
not at the shell?
Our users are not going to need to do kinit at the shell, but I just wonder
if ignorance is bliss, or if I'm going to encounter problems anyway with
this configuration.
Thanks.
Ethan Bearman
Systems Analyst
USCard Operations
University of Southern California
213.821.2287
213.740.7253 Fax
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
