[24986] in Kerberos
Re: Errors when running ktpass on windows 2003
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Tue Nov 22 10:11:23 2005
Message-ID: <438334E5.7050406@anl.gov>
Date: Tue, 22 Nov 2005 09:10:29 -0600
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Celia Clark <celia.clark@gmail.com>
In-Reply-To: <894422f60511220409q55a8df60o4ee07a0821159fb9@mail.gmail.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Celia Clark wrote:
> Hi,
>
> I am trying to generate a keytab file, but am encountering problems when
> running the ktpass command:
>
> ktpass -princ host.doman@DOMAIN -pass password -mapuser host -out
> c:/host_HTTP.keytab -mapOp set -ptype KRB5_NT_PRINCIPAL -crypto DES-CBC-CRC
Normally the principal is <service>/<FQDN>@<REALM>
It looks like you want a principal for a web server, so the
principal should be HTTP/host.domain@DOAMIN
(HTTP is uppercase.)
>
> Targeting domain controller: DOMAINCONTROLLER.domain
> Failed to set property "servicePrincipalName" to "domain" on Dn=...... 0x13
> WARNING: Unable to set SPN mapping data.
> If host already has an SPN mapping installed for host.domain, this is no
> cause of concern
Is it already defined? Use the AD tools to look at the account for host.
i.e. you have to have a AD acount which will then have a SPN asigned to it
which is the principal.
I believe the account can also have a UPN as well.
> Key created
> Output keytab c:/host_HTTP.keytab
> Keytab version 0x502
> keysize 76 host.domain@DOMAIN ptype 1 (KRB5_NT_PRINCIPAL) vno 3 etype 0x1
> (DES-CBC-CRC) keylength 8 (0x3e80d910fed62fe5)
>
> Does anyone have any ideas what the problem might be?
>
> Many thanks,
>
> Celia
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
