[1766] in Kerberos-V5-bugs
Re: KRB5b4.3 & Dec 31
daemon@ATHENA.MIT.EDU (Jon Roma)
Mon Jan 1 23:20:58 1996
Cc: John Hawkinson <jhawk@MIT.EDU>
To: krb5-bugs@MIT.EDU
Date: Mon, 01 Jan 1996 22:20:44 -0600
From: Jon Roma <roma@uiuc.edu>
John Hawkinson <jhawk@mit.edu> wrote:
>Craig Leres of LBL points out the attached.
>In case anyone else is running beta 4 and getting:
> k5init: KDC reply did not match expectations
> while getting initial credentials
>The problem is in krb5/os/gmt_mktime.c (context diff between my copies
>of beta 4 and beta 5 appended). Unfortunately, you must relink at least
>krb5kdc and k5init.
Alas, we found that it's a wee bit more complex than that. After applying the
patch, rebuilding libkrb5.a, and relinking the krb5kdc and [V5] kinit
executables, we were able to successfully get ticket granting tickets from
kinit.
However, the kclients (like ktelnet) subsequently yielded the following error:
[ Kerberos V5 refuses authentication because Read req failed: Clock skew too great ]
We found it necessary to install relinked versions of the kclients and their
respective servers for V5 authentication to work properly.
Sites running a slave server will also find it necessary to relink kprop
and kpropd on the master and slave hosts, respectively.
