[7887] in Kerberos
kpropd rejects connection
daemon@ATHENA.MIT.EDU (Lonnie R. Maynard)
Fri Aug 30 16:48:27 1996
To: kerberos@MIT.EDU
Date: Fri, 30 Aug 1996 13:33:40 -0600
From: "Lonnie R. Maynard" <maynard@fsl.noaa.gov>
I apologize in advance for a probably very stupid question, but I am
having quite a lot of trouble making V5B6 do slave database propagation.
I have always used only one kerberos server in the past, so I've quite
probably configured something wrong with kpropd. It is however, not
intuitively obvious to me just what I have done here. If something
strikes anyone, I would greatly appreciate any pointers.
I have a master server named obiwan and a slave server named keymaster,
both on Solaris 2.5, with kpropd called from inetd on the slave server
with the following configuration;
inetd.conf;
krb5_prop stream tcp nowait root /usr/local/sbin/kpropd kpropd -f
/usr/local/sbin/slave_datatrans -p /usr/local/sbin/kdb5_edit
My /etc/krb5.conf file on both server show both kdc's;
/etc/krb5.conf
[libdefaults]
ticket_lifetime = 600
default_realm = FSL.NOAA.GOV
[realms]
FSL.NOAA.GOV = {
kdc = keymaster.fsl.noaa.gov
kdc = obiwan.fsl.noaa.gov
admin_server = obiwan.fsl.noaa.gov
default_domain = FSL.NOAA.GOV
}
[domain_realm]
.fsl.noaa.gov = FSL.NOAA.GOV
I have extracted keytabs for both hosts and placed them in the
/etc/v5srvtab files. I then use the following kprop command to
attempt to transfer the slave database to keymaster;
/usr/local/sbin/kprop -r FSL.NOAA.GOV -f /usr/local/sbin/slave_datatrans
-d keymaster.fsl.noaa.gov
The transfer does not succeed, and the following message is logged on
the slave server;
Aug 30 18:57:31 keymaster.fsl.noaa.gov kpropd[2103]: Rejected connection
from unauthorized principal host/obiwan.fsl.noaa.gov@FSL.NOAA.GOV
I believe that this must be an issue with my keytab files, but am not
sure. I am extracting the keytab file within kdb5_edit with the
following command;
kdb5_edit: xst obiwan.fsl.noaa.gov host
which gives me a file named such as the following;
obiwan.fsl.noaa.gov-new-srvtab
I then move this to the /etc/v5srvtab file. Obviously there is something
I'm not getting here. Any help would be appreciated.
From the faq it appears that each server must have its OWN keytab
entry in its file. I've tried it with only the hosts entry in its
keytab, and also with both in the same keytab. I do not know if it
is permissible to append keytab files to each other, but I have
tried it this way. THKS Lonnie
_________________________________________________________________________
_________________________________________________________________________
Lonnie R. Maynard Network Manager, Forecast Systems
Laboratory
NOAA/ERL/FSL/FD National Oceanic & Atmospheric
Administration
R/E/FS2 Phone: 303-497-6342
325 Broadway E-mail: maynard@fsl.noaa.gov
Boulder, CO 80303 Fax: 303-497-7259
_________________________________________________________________________
_________________________________________________________________________
