[8126] in Kerberos
Creating keytab, error: "appears to be Version 4 while..."
daemon@ATHENA.MIT.EDU (Trever G. Furnish)
Wed Sep 25 22:55:24 1996
To: kerberos@MIT.EDU
Date: Wed, 25 Sep 1996 20:11:12 -0600
From: trever@ind.net (Trever G. Furnish)
I'm still trying to complete a beta 7 install (solaris 2.5.1 system), but
I get an error when I attempt to start kadmin, per the instructions in the
b7 documentation set's Kerberos V5 Installation Guide, section 4.1.1.5 "Create
a kadmind Keytab".
I believe I've followed the instructions up to that point correctly; however,
when I try to start kadmin, I get the following:
kadmin: Initial Ticket response appears to be Version 4 error while initializing
kadmin interface
Is kadmin trying to contact a kerberos server immediately upon startup? Didn't
the v4 kerberos kadmin only access the server when a password was needed?
Either way, I've set kerberos.ind.net to point to the correct machine in DNS,
but I've not got a server running yet on the box it points to -- since that's
what I'm trying to do in the first place. The instructions haven't said to
modify inetd.conf yet.
Does anyone know what this error might be or how to fix it? Did I do something
wrong or leave something out? It's going to make for a lengthy post, but I'll
put everything I've done so far at the end of this post.
Thanks for any help...
Sincerely,
trever
Trever Furnish,
INDnet Network Engineer
trever@ind.net, (317) 263-8999
--------------------------------------------
I compiled the software using the following steps:
1. configure --with-cc=gcc --with-ccopts=-i --with-krb4
2. make
3. make check (Passed all except dejagnu tests, which weren't run.)
4. make install
As near as I can tell, a list of the installed files is:
(edited output of "make install")
/usr/local/sbin
/usr/local/sbin/krb524d
/usr/local/sbin/krb5kdc
/usr/local/sbin/kadmin.local
/usr/local/sbin/kadmin
/usr/local/sbin/kdb5_util
/usr/local/sbin/ktutil
/usr/local/sbin/kadmind
/usr/local/sbin/kadmind4
/usr/local/sbin/v5passwdd
/usr/local/sbin/kprop
/usr/local/sbin/kpropd
/usr/local/sbin/sserver
/usr/local/sbin/sim_server
/usr/local/sbin/uuserver
/usr/local/sbin/kshd
/usr/local/sbin/klogind
/usr/local/sbin/login.krb5
/usr/local/sbin/gss-server
/usr/local/sbin/ftpd
/usr/local/sbin/telnetd
/usr/local/sbin/popper
/usr/local/man/man8
/usr/local/man/man8/krb5kdc.8
/usr/local/man/man8/kadmin.8
/usr/local/man/man8/kadmin.local.8
/usr/local/man/man8/kdb5_util.8
/usr/local/man/man8/ktutil.8
/usr/local/man/man8/kadmind.8
/usr/local/man/man8/kprop.8
/usr/local/man/man8/kpropd.8
/usr/local/man/man8/sserver.8
/usr/local/man/man8/kshd.8
/usr/local/man/man8/klogind.8
/usr/local/man/man8/login.krb5.8
/usr/local/man/man8/ftpd.8
/usr/local/man/man8/telnetd.8
/usr/local/man/man8/popper.8
/usr/local/man/man5
/usr/local/man/man5/kdc.conf.5
/usr/local/man/man5/krb5.conf.5
/usr/local/man/man5/.k5login.5
/usr/local/include
/usr/local/include/asn.1
/usr/local/include/gssapi
/usr/local/include/gssapi/gssapi.h
/usr/local/include/gssapi/gssapi_generic.h
/usr/local/include/gssapi/gssapi_krb5.h
/usr/local/include/com_err.h
/usr/local/include/mit-sipb-copyright.h
/usr/local/include/libpty.h
/usr/local/include/krb5.h
/usr/local/include/asn.1
/usr/local/include/gssapi
/usr/local/include/gssapi/gssapi.h
/usr/local/include/gssapi/gssapi_generic.h
/usr/local/include/gssapi/gssapi_krb5.h
I copied the krb5.conf and kdc.conf files from the krb5-beta7/src/config-files
directory and edited them to contain the following:
krb5.conf:
[libdefaults]
default_realm = IND.NET
default_tgs_enctypes = des-cbc-crc
default_tkt_enctypes = des-cbc-crc
krb4_config = /usr/local/krb5-beta7/krb4/lib/krb.conf
krb4_realms = /usr/local/krb5-beta7/krb4/lib/krb.realms
[realms]
IND.NET = {
kdc = KERBEROS.IND.NET
admin_server = KERBEROS.IND.NET
default_domain = IND.NET
}
[domain_realm]
.ind.net = IND.NET
ind.net = IND.NET
[kdc]
profile = /usr/local/lib/krb5kdc/kdc.conf
[logging]
kdc = FILE:/dev/console
admin_server = FILE:/dev/console
default = FILE:/dev/console
kdc.conf:
[kdcdefaults]
kdc_ports = 750,88
[realms]
IND.NET = {
profile = /etc/krb5.conf
database_name = /usr/local/lib/krb5kdc/principal
admin_database_name = /usr/local/lib/krb5kdc/kadm5_adb
admin_database_lockfile = /usr/local/lib/krb5kdc/kadm5_adb.lock
admin_keytab = FILE:/usr/local/lib/krb5kdc/kadm5.keytab
acl_file = /usr/local/lib/krb5kdc/kadm5.acl
key_stash_file = /usr/local/lib/krb5kdc/.k5stash
kdc_ports = 750,88
kadmind_port = 3761
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
master_key_type = des-cbc-crc
supported_enctypes = des-cbc-crc:normal des:normal des:v4 des:no
realm des:onlyrealm des:afs3
}
I placed the krb5.conf file in the /etc directory and the kdc.conf file in
the /usr/local/lib/krb5kdc directory.
I've also added the kerberos lines from
krb5-beta7/src/config-files/services.append to /etc/services.
Following the instructions in section 4.1.1.2 (p. 16) of the installation
guide, I "created the database" with the command: krb5_util create -r
IND.NET -s
Per section 4.1.1.3, I created the following /usr/local/lib/krb5kdc/kadm5.acl
file:
*/admin@IND.NET *
*/noc@IND.NET *
*/kerberos@IND.NET *
*/tfurnish@IND.NET *
Per section 4.1.1.4, I "added administrators to the database" with the
following:
bash# kadmin.local
kadmin.local: addprinc admin/admin@IND.NET
Enter password for principal "admin/admin@IND.NET":
Re-enter password for principal "admin/admin@IND.NET":
Principal "admin/admin@IND.NET" created.
kadmin.local: addprinc admin/noc@IND.NET
Enter password for principal "admin/noc@IND.NET":
Re-enter password for principal "admin/noc@IND.NET":
Principal "admin/noc@IND.NET" created.
kadmin.local: quit
(I added admin/noc@IND.NET because I wasn't certain whether the instance
had to belong to a local user -- we don't have an admin user, and the
install guide didn't say whether the name "admin" was arbitrarily chosen.)
Next comes section 4.1.1.5, which is where the problem starts. When I run
kadmin, it gives an error message and dies:
kadmin: Initial Ticket response appears to be Version 4 error while initializing
kadmin interface
Can anyone tell me what's wrong, or where to look for additional clues to
the problem?
