[7891] in Kerberos
Re: kpropd rejects connection
daemon@ATHENA.MIT.EDU (Mark Eichin)
Sun Sep 1 19:15:42 1996
To: kerberos@MIT.EDU
Date: 01 Sep 1996 18:18:32 -0400
From: Mark Eichin <eichin@cygnus.com>
You got it from the syslog message: it said "unauthorized." That
means that the authentication worked but the decision about the access
failed.
krb5 uses a real acl file to determine what machines can send kprops,
instead of overloading the hostname (as MIT V4 did) or the admin
server line in krb.conf (as CNS V4 did.) It should be in the kpropd
docs, but basically $(prefix)/lib/krb5kdc/kpropd.acl needs to list the
principals (host/hostname@REALM) that can perform kprops...
