[27420] in Kerberos
Re: Problem with Kerberos Service
daemon@ATHENA.MIT.EDU (Christopher D. Clausen)
Thu Feb 8 16:59:11 2007
Message-ID: <050101c74bcc$50d90540$0100a8c0@CDCHOME>
From: "Christopher D. Clausen" <cclausen@acm.org>
To: "LukePet" <luke_pet@yahoo.it>, <kerberos@mit.edu>
Date: Thu, 8 Feb 2007 15:58:44 -0600
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
LukePet <luke_pet@yahoo.it> wrote:
> So,
>> What does klist -kte (as root) show?
>
> lukesky@lukesky:~$ sudo klist -kte
> 2 02/08/07 14:13:52 host/lukesky.epiluke.it@EPILUKE.IT (Triple DES
> cbc mode with HMAC/sha1)
> 2 02/08/07 14:13:52 host/lukesky.epiluke.it@EPILUKE.IT (DES cbc
> mode with CRC-32)
>
>> Can you kinit -kt host/lukesky.epiluke.it@EPILUKE.IT on this machine?
>
> lukesky@lukesky:~$ kinit -kt host/lukesky.epiluke.it@EPILUKE.IT
> kinit(v5): Client not found in Kerberos database while getting initial
> credentials
Hmm... that looks bad. rm /etc/krb5.keytab and re-extract the
host/lukesky.epiluke.it keytab into /etc/krb5.keytab from kadmin.
> and If I exec kinit and telnet I have:
>
> lukesky@lukesky:~$ kinit pippo
> Password for pippo@EPILUKE.IT:
> lukesky@lukesky:~$ telnet -a -l pippo lukesky.epiluke.it
> Trying 192.168.182.121...
> Connected to admin.epiluke.it (192.168.182.121).
> Escape character is '^]'.
> Password for pippo:
> Login incorrect
>
> why? what mean?
It means its not using Kerberos, likely b/c of the problem with the host
keytab. If you get a password prompt Kerberos ticket forwarding has
failed and I'd suggest simply Ctrl-C-ing out of telnet.
<<CDC
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
