[24938] in Kerberos
Re: kerberos service (httpd using mod_auth_kerb) in DMZ
daemon@ATHENA.MIT.EDU (FM)
Mon Nov 14 14:44:41 2005
Message-ID: <4378E8FC.1010105@lexum.umontreal.ca>
Date: Mon, 14 Nov 2005 14:43:56 -0500
From: FM <dist-list@lexum.umontreal.ca>
MIME-Version: 1.0
To: Achim Grolms <kerberosml@grolmsnet.de>,
Mailing List Kerberos <kerberos@mit.edu>
In-Reply-To: <200511142016.54906.kerberosml@grolmsnet.de>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Thanks for the reply,
We're using Linux
browser is Firefox
KDC : MIT Kerberos 1.3
you can use http if you add tu http conf : KrbServiceName "http"
thank you for the ML Link !
Achim Grolms wrote:
>On Monday 14 November 2005 18:48, FM wrote:
>
>
>
>>I'm trying to use mod_auth_kerb to authenticate users with kerberos.
>>
>>
>
>Have you read <http://www.grolmsnet.de/kerbtut/>?
>
>
>
>>But when I try to authenticat myself http error_log show :
>>[error] [client 192.168.4.171] krb5_verify_init_creds() failed: Key
>>table entry not found
>>
>>
>
>Use kerbtray.exe / kvno + klist -e / kgetcred + klist -v
>
>To verify if keytype, kvno and principalname match
>each other on clientside and in keytabfile.
>
>
>
>>Kerberos is in my LAN : kerberos.lan.pri
>>http server is in the DMZ : nagios.dmz.pri
>>
>>
>
>Browsersoftware?
>KDC-Software?
>
>
>
>>In Kerberos I created : http/nagios.dmz.lexum.pri and exported to a keytab.
>>
>>
>
>The principalname is
>HTTP/nagios.dmz.lexum.pri@KERBEROS.DOMAIN
>(uppercase 'HTTP'!)
>
>
>
>>krb5.conf :
>>[realms]
>> KERBEROS.DOMAIN = {
>> kdc = kerberos.lan.pri:88
>> admin_server = kerberos.lan.pri:749
>> default_domain = kerberos.domain
>> }
>>
>>[domain_realm]
>>.lan.pri = KERBEROS.DOMAIN
>> lan.pri = KERBEROS.DOMAIN
>> .dmz.pri = KERBEROS.DOMAIN
>> dmz.pri = KERBEROS.DOMAIN
>>
>>
>
>I'm missing
>.dmz.lexum.pri KERBEROS.DOMAIN
>here.
>
>modauthkerb-help@lists.sourceforge.net is a more mod_auth_kerb specific
>Mailinglist.
>
>Achim
>
>
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
