[5220] in Kerberos
Re: DCE KDC server for K4 client
daemon@ATHENA.MIT.EDU (Doug Engert)
Tue May 23 09:07:56 1995
Date: Tue, 23 May 95 07:54:34 CDT
From: "Doug Engert" <DEEngert@anl.gov>
To: <ramus@nersc.gov>
Cc: <authtf@es.net>, <kerberos@MIT.EDU>
Joe Ramus ramus@nersc.gov writes:
>a. Is it true that the DCE KDC will not serve a Kerberos 4 client?
> The MIT version 5 KDC does support Kerberos 4.
> I assume this means listening on port 750 and returning a Version 4
> ticket when a Version 4 request is received.
>
Yes, I believe that is true.
>b. We want to use the DCE KDC to get Forwardable Version 5 tickets.
> Then we want to use krb524 (running on the DCE machine) to get
> a Version 4 ticket and aklog to get an AFS token.
> Is this procedure likely to work?
This can still be done.
1) use the DCE rgy_edit program to add a "afs" principal and account.
2) Use the DCE rgy_edit program with the "ktadd" command to create
a k5srvtab file. Use the -f option to place it in a separate file
and the -r and -pw options to set the password in the registry and
in the k5srvtab file. This file will then have a DES key and kvno
for "afs".
3) When starting the krb524d use the -k option to point to a keytab.
(This may require changes to krb524d to access the
K5/DCE formatted k5srvtab created
in step one.
4) Write a simple program to extract the DES key and kvno form the
k5srvtab and stuff it in the AFS /usr/afs/etc/KeyFile on the AFS servers.
This program could also be used to extract a K4 srvtab for use with
the krb524d as well.
With all of this in place, the sequence of getting an AFS token are:
Use DCE_LOGIN, K5 kinit or forwarded K5 credentials to get the K5 tgt.
into the cache.
Use modified aklog which uses the V5 protocols to get a K5
ticket for afs@cell.
The modified aklog sends this to the krb524d which then converts it
to a V4 ticket and returns it to aklog.
Aklog then uses the AFS routines to stuff it into the kernel.
Since the DCE Security server, the krb524d and AFS servers are all
using the same key for "afs" it should work.
Joe, I am counting on you to get this to work. I want to use it too.
Douglas E. Engert
Systems Programming
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(708) 252-5444
Internet: DEEngert@anl.gov
