[24638] in Kerberos
Re: Decrypt integrity check failed while changing password
daemon@ATHENA.MIT.EDU (Brian Davidson)
Wed Sep 14 13:33:02 2005
Date: Wed, 14 Sep 2005 13:32:35 -0400
From: Brian Davidson <bdavids1@gmu.edu>
In-reply-to: <200509141717.j8EHHmaI021712@ginger.cmf.nrl.navy.mil>
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>
Message-id: <6184fe7e97e1fdd2cff1f683a5ffc930@gmu.edu>
MIME-version: 1.0
Content-type: text/plain; charset=US-ASCII; format=flowed
Content-transfer-encoding: 7BIT
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Ken,
You, of course, are brilliant. Setting the history to 1, and then back
up to 10 seems to fix it. I realize that a side effect of this is that
users can reuse any of their recent password the next time they go to
change their password.
Thanks!
Brian
On Sep 14, 2005, at 1:17 PM, Ken Hornstein wrote:
>> I had to do a bunch of account cleanups (~35,000 deletions) yesterday.
>> Today, I'm getting the message 'change_password: Decrypt integrity
>> check failed while changing password for "principal@GMU.EDU"' when
>> trying to change a password. If I create a new principal, I am able
>> to
>> change it's password. I'm using kadmin.local -- we don't run kadmind.
>>
>> Anyone have an idea what I deleted that I shouldn't have?
>
> I suspect that since you deleted kadmin/history, you're getting this
> error
> from deep within the kadmin library when it's trying to access the
> password
> history. That's just a guess, though. You're getting this message
> from
> kadmin.local, right?
>
> How you recover from this ... well, I have no idea, actually. Did you
> happen to save the old kadmind keytab?
>
> --Ken
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
