[5113] in Kerberos
Kerb 5 BETA5 srvtab problem
daemon@ATHENA.MIT.EDU (Tomasz Krupa)
Mon May 8 22:22:13 1995
To: kerberos@MIT.EDU
Date: 9 May 1995 01:37:58 GMT
From: s139091@dss.MIT.EDU (Tomasz Krupa)
I have installed Kerberos 5 BETA 5 on Solaris 2.3 and Linux in Kerberos 4
backward compatibility mode but a serious problem appeared.
V4 srvtab generated by kdb5_edit cannot be decoded propely (eg. rcmd entry)
so Kerberos 4 applications (secure telnet) cannot decode authenticator.
I tried it with 'rcmd/<machine>' setting known password so that I can kinit
on rcmd/machine - it means that principal password in KDC database is correct.
The same problem appeared with root/<machine> when i tried to obtain ticket
using Solaris 2.3 ksrvtgt command - the message was "Password incorrect".
I think that it is a srvtab problem because /etc/srvtab generated by
Kerberos 4 ext_srvtab works fine with Kerberos 5 KDC and V4 applications.
Any suggestions how to solve this problem ?
kdb5_edit does not do V4/V5 realm name conversion in xst4 command, so
it is almost impossible to generate V4 srvtab without creating temporary
principals with short host names (without domain) eg. rcmd.<host>
is not converted from host/<host>.<domain>.
I wrote a small patch which fixes this problem.
Tomek
--- kdb5_edit.c Tue May 9 03:06:16 1995
+++ kdb5_edit.c.my Tue May 9 02:22:59 1995
@@ -723,6 +723,7 @@
krb5_principal princ;
krb5_db_entry dbentry;
char *pname;
+ char *v5pname; /* TJK */
register int i;
int nentries;
krb5_boolean more;
@@ -730,7 +731,9 @@
if (argc < 3) {
com_err(argv[0], 0, "Too few arguments");
- com_err(argv[0], 0, "Usage: %s instance name [name ...]", argv[0]);
+/* com_err(argv[0], 0, "Usage: %s instance name [name ...]", argv[0]); */
+ com_err(argv[0], 0, "Usage: %s v4instance v4name [v4name ...]",
+ argv[0]); /* TJK */
exit_status++;
return;
}
@@ -771,6 +774,8 @@
continue;
}
+*/
+
+/* TJK begins here */
+/* Use v4 to v5 name conversion to fill srvtab propely */
+ strcpy(pname, argv[i]);
+ strcat(pname, ".");
+ strcat(pname, argv[1]);
+ if (!strchr(argv[1], REALM_SEP)) {
+ strcat(pname, REALM_SEP_STR);
+ strcat(pname, cur_realm);
+ }
+
+ if (retval = krb5_425_conv_principal(edit_context, argv[i], argv[1],
+ cur_realm, &princ)) {
+ com_err(argv[0], retval, "while converting V4 %s to V5 name",
+ pname);
+ exit_status++;
+ free(pname);
+ continue;
+ }
+
+ if (retval = krb5_unparse_name(edit_context, princ, &v5pname)) {
+ com_err(argv[0], retval, "while unparsing");
+ exit_status++;
+ free(pname);
+ continue;
+ }
+/* TJK ends here */
nentries = 1;
if (retval = krb5_db_get_principal(edit_context, princ, &dbentry, &nentries,
@@ -823,12 +856,15 @@
fwrite(cur_realm, strlen(cur_realm) + 1, 1, fout); /* p.realm */
fwrite((char *)&dbentry.kvno, sizeof(dbentry.kvno), 1, fout);
fwrite((char *)key.contents, 8, 1, fout);
- printf("'%s' added to V4 srvtab '%s'\n", pname, ktname);
+/* printf("'%s' added to V4 srvtab '%s'\n", pname, ktname); */
+ printf("'%s' added as '%s' to V4 srvtab '%s'\n", v5pname,
+ pname, ktname); /* TJK */
memset((char *)key.contents, 0, key.length);
krb5_xfree(key.contents);
cleanall:
krb5_db_free_principal(edit_context, &dbentry, nentries);
cleanmost:
+ free(v5pname); /* TJK */
free(pname);
krb5_free_principal(edit_context, princ);
}
/--------------------------------------------------------------------------\
/ Tomasz Krupa URL: http://www.riviera.pw.edu.pl/~tomek \
Home: T.Krupa@riviera.pw.edu.pl -> Riviera Network Administrator
Work: T.Krupa@elka.pw.edu.pl D.S. Riviera
School: T.Krupa@ia.pw.edu.pl Warynskiego 12/618
\ Phone:(48-2) 660-9344 00-631 Warsaw, POLAND /
\--------------------------------------------------------------------------/
