[33513] in Kerberos
Re: remote kadmin fails
daemon@ATHENA.MIT.EDU (Vivien Mura)
Fri Jun 24 08:44:27 2011
MIME-Version: 1.0
In-Reply-To: <4E03E2FB.7010908@optimation.com.au>
From: Vivien Mura <vivien.mura@gmail.com>
Date: Fri, 24 Jun 2011 11:35:28 +0200
Message-ID: <BANLkTinRYjWwf0rjCw7uW7Ofr9xvGZ19Ng@mail.gmail.com>
To: Jeremy Hunt <jeremyh@optimation.com.au>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Hi Jeremy,
Thank you for your answer.
>From your point 4 ('If the entry for admin/fqdn2 is not in the keytab
admin.fqdn1, then copy the keytab admin.fqdn2 to your local system'), I
deduce that we can do cross realm authentication with kadmin. Is it right?
2011/6/24 Jeremy Hunt <jeremyh@optimation.com.au>
>
> Hi Matt or Vivien,
>
> There is not enough information here, however I did notice:
>
> 1. REALM2 would have to be defined with its servers in your configuration
> files on the machine you are running kadmin on. This is so the kadmin
> program knows which remote system the kadmin daemon is running on and so can
> attempt a connection.
> 2. If the configuration files are correct then the kadmin logs on the
> remote system may have some useful information. Your local machine would not
> be expected to log errors from a remote machine.
> 3. I am assuming admin/fqdn1 is the administration principal in REALM1. On
> the remote system I would expect the administration principal for REALM2 to
> be admin/fqdn2.
> 4. If the entry for admin/fqdn2 is not in the keytab admin.fqdn1, then copy
> the keytab admin.fqdn2 to your local system.
> 5. If there is a authentication failure, you might find an error in the kdc
> logs rather than the kadmin logs.
>
> So:
> 1. Check your configuration files are set up properly, you have to define
> both realms in them.
> 2. Check the kdc logs and the kadmin logs on your local and your remote
> masters.
> 3. Make sure you have the correct keytab files and entries.
> 4. Try this command after your configuration files and keytabs are correct:
>
> kadmin -kt /etc/keytabs/admin.fqdn2.**keytab -p admin/fqdn2 -r REALM2
>
> Good Luck,
>
> Jeremy
>
> Vivien Mura wrote:
>
>> Hello,
>>
>> we are running kerberos v1.8.1 and trying to run kadmin from REALM1 to
>> REALM2 by:
>>
>> *kadmin -kt /etc/keytabs/admin.fqdn1.**keytab -p admin/fqdn1 -r REALM2*
>>
>> but it doesn't work. The message in the console is:
>> *
>> kadmin: GSS-API (or Kerberos) error while initializing kadmin interface*
>>
>> and there is no error in the kdc/kadmin log.
>> If we change "-r REALM2" by "-r REALM1", it works and we can administrate
>> local kdc.
>>
>> Can you help us please?
>>
>> Thank you,
>>
>> Matt
>> ______________________________**__________________
>> Kerberos mailing list Kerberos@mit.edu
>> https://mailman.mit.edu/**mailman/listinfo/kerberos<https://mailman.mit.edu/mailman/listinfo/kerberos>
>>
>>
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
