[5150] in Kerberos
What am I missing?
daemon@ATHENA.MIT.EDU (Arthur Yasinski)
Thu May 11 20:22:29 1995
To: kerberos@MIT.EDU
Date: Thu, 11 May 1995 22:37:58 GMT
From: Arthur Yasinski <ayasinski@nofc.forestry.ca>
Hi all,
I have been working with Kerberos 5 Beta 5 for the last day or so, on and
off, and have not quite mastered this...and was wondering if anyone could
straighten me out.
I am trying to set up the Kerberos authentication package on one of my Suns
so that I can use it for my DECserver 700 validation. I have been reading
every piece of info that I could snag on krb5, but most seem to reference
beta4, and not beta5.
Here's what I've done so far...and what my results are: (note: I am doing
everything on the machine I want to be the main server...machine1)
* I have compiled and installed the distribution; I had problems but was
able to [eventually] correct them
* I set up my krb5.conf file to resemble the following:
>[libdefaults]
> ticket_lifetime = 600
> default_realm = MY.DOMAIN
>
>[realms]
> MY.DOMAIN = {
> kdc = MACHINE1.MY.DOMAIN
> admin_server = MACHINE1.MY.DOMAIN
> default_domain = MY.DOMAIN
> }
>
>[domain_realm]
> .my.domain = MY.DOMAIN
* I added the following services to my NIS services map:
># Kerberos stuff...
>#
>kerberos 88/udp kdc # Kerberos
authentication--udp
>kerberos 88/tcp kdc # Kerberos
authentication--tcp
>kerberos-sec 750/udp # Kerberos
authentication--udp
>kerberos-sec 750/tcp # Kerberos
authentication--tcp
>kerberos_master 751/udp # Kerberos authentication
>kerberos_master 751/tcp # Kerberos authentication
>kerberos-adm 749/tcp # Kerberos 5 admin/changepw
>kerberos-adm 749/udp # Kerberos 5 admin/changepw
* I created the database (./admin/kdb5_create) and added some entries
(./admin/kdb5_edit)
* I started the kdc : ./sbin/krb5kdc
* I tested the setup with kinit and klist, and they seemed to work fine:
>/local/krb5> bin/kinit
>Password for me@MY.DOMAIN:
>/local/krb5> bin/klist
>Ticket cache: /tmp/krb5cc_1001
>Default principal: me@MY.DOMAIN
>
> Valid starting Expires Service principal
>11-May-95 16:21:54 12-May-95 00:21:51 krbtgt/MY.DOMAIN@MY.DOMAIN
* I tried to change my password, but encountered AN ERROR:
>/local/krb5/bin> kpasswd
>Old password for me@MY.DOMAIN:
>Cannot Connect to Socket
>
>
>Protocol Failure - Password NOT changed
* Okay, so I figure I have to be running the admin daemon. I set up my
krb5_adm.acl file to look like the following (I have any entry in the
db for me/admin):
>me/admin@MY.DOMAIN *
* When I try to start the admin daemon, I get another error:
>/local/krb5/bin> ./kadmind5
>kadmind5: cannot get service entry for changepw (Invalid argument).
>kadmind5: cannot initialize network.
As I mentioned before, I haven't been able to find any direction on what
I am screwing up, or missing. If anyone has any suggestions or comments,
I would be more than happy to hear them. Also, if anyone has any other
cautions I should be aware of with my DECserver 700's Kerberos authentication
I would be happy to hear them, too.
Thanks, bigtime, in advance,
Arthur
-------------------------------------------------------------------
| ARTHUR YASINSKI | Dept. Natural Resources Canada, CFS |
| Systems and Network Manager | 5320-122 St. Edmonton AB T6H 3S5 |
| Northwest Region | Ph: 403-435-7352 Fax: 403-435-7359 |
| (Unix-VMS-Pathworks-Oracle) | Email: ayasinski@nofc.forestry.ca |
|-------------------------------------------------------------------|
| My job is to come up with solutions...not excuses! |
-------------------------------------------------------------------
