[27472] in Kerberos
Re: kadmin problem
daemon@ATHENA.MIT.EDU (scotty adams)
Tue Feb 20 03:31:57 2007
Date: Tue, 20 Feb 2007 00:31:32 -0800 (PST)
From: scotty adams <scotty.adams@yahoo.com>
To: Marcus Watts <mdw@umich.edu>
In-Reply-To: <200702170849.DAA18927@quince.ifs.umich.edu>
MIME-Version: 1.0
Message-ID: <41598.78348.qm@web55303.mail.re4.yahoo.com>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Hi Marcus,
When i use
<modprinc -requires_preauth>
Then try to kinit <user>
it prompts incorrect password
then i should change the password so that it works, but i guess upon changing the password
the princ is being modified again... thus i guess that the
-requires_preauth isnt set anymore...
Can you please advise me how to make this work since kdc.log is still showing Preauthentication failed
Thanks,
Scotty
Marcus Watts <mdw@umich.edu> wrote: scotty adams writes:
> Hi Marcus,
>
> it seems that i can't even kinit over scotty
>
> bash-2.05# kinit scotty
> Password for scotty@SCOTTIE.COMPANY.COM:
> kinit: Preauthentication failed while getting initial credentials
>
> same error as that of kadmin
>
> How can i turn off REQUIRES_PRE_AUTH on the principal?
>
> Thanks,
> Scotty
Good. Now you have a much simpler problem to solve.
Since you don't yet have kadmin working, you'll need
to use kadmin.local. When run (as root) on the kdc
(with the right configuration) it will access the database
directly and does not need any credentials. So,
(on the kdc):
kadmin.local
-- to set the bit,
modprinc +requires_preauth
-- to clear the bit,
modprinc -requires_preauth
-- to see the bit
getprinc
-- to see what else you can set
modprinc
-- to see what else you can do
lr
You should also have a large pile of kerberos 5 documentation
that explains this and much much more. If you haven't got
this, you really should dig it up. If you have got it, but
it doesn't explain things like this adequately, you should let
your vendor know where and how the documentation can be improved.
-Marcus Watts
---------------------------------
Want to start your own business? Learn how on Yahoo! Small Business.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
