[8131] in Kerberos
Re: Creating keytab, error: "appears to be Version 4 while..."
daemon@ATHENA.MIT.EDU (Barry Jaspan)
Thu Sep 26 13:23:35 1996
Date: Thu, 26 Sep 1996 13:12:59 -0400
From: "Barry Jaspan" <bjaspan@MIT.EDU>
To: trever@ind.net (Trever G. Furnish)
Cc: kerberos@MIT.EDU
In-Reply-To: [8126]
Trever,
Well, you certainly sent a very thorough problem report. Thanks! :-)
Is kadmin trying to contact a kerberos server immediately upon startup?
Yes. The kadmin program tries to make a connection to kadmind
*immediatey* when you run. It will also try to acquire a ticket from
the Kerberos server if you do not specify the -c (ccache) option; this
is described in the first couple paragraphs of the man page.
(I added admin/noc@IND.NET because I wasn't certain whether the instance
had to belong to a local user -- we don't have an admin user, and the
install guide didn't say whether the name "admin" was arbitrarily chosen.)
There is no inherent relationship between Kerberos principal names and
Unix username. The login.krb5 program and krlogin &c do make some
assumptions here (because those programs exist explicitly to authorize
Kerberos principals to access Unix accounts), but kadm5 does not do so
at all. So, yes, the "admin" name is arbitrarily choosen, as is the
instance. The names in kadmind's acl file do not need to correspond
in any way to any Unix account name, and if they do it is irrelevant.
Next comes section 4.1.1.5, which is where the problem starts. When I run
kadmin, it gives an error message and dies:
kadmin: Initial Ticket response appears to be Version 4 error while initializing
kadmin interface
There are two problems here. First, there is a bug in the
documentation: section 4.1.1.5 Create a kadmind Keytab shoud say to
use kadmin.local, not kadmin, to create the keytab. Since kadmin
always tries to connect to kadmind and there is no kadmind running
yet, you need to use kadmin.local instead. Again, read the kadmin man
page for an explanation of the difference. This will be fixed.
There must be another problem at your site, though, because this
would not cause the error message you are seeing. You must have a V4
KDC running on kerberos.ind.net that is responding to kadmin's request
for an initial ticket.
Barry
