[28046] in Kerberos
Re: Passwordless access to kadmin?
daemon@ATHENA.MIT.EDU (Bryan K. Wright)
Tue Jul 17 13:20:26 2007
From: "Bryan K. Wright" <bryan@ayesha.phys.virginia.edu>
Date: Tue, 17 Jul 2007 17:09:27 +0000 (UTC)
Message-ID: <f7it47$l4$1@murdoch.acc.Virginia.EDU>
X-Complaints-To: abuse@Virginia.EDU
To: kerberos@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Hi again,
Here's what I tried:
kadmin -p root/admin
ktadd -k /etc/web.keytab root/admin
I can then invoke kadmin via:
kadmin -p root/admin -k -t /etc/web.keytab
and I get in without a password.
But as a side-effect of this, I can then no longer
get into kadmin by typing "kadmin -p root/admin" and supplying
a password. If I try, kadmin tells me the password is bad.
If I use "change_password" to reset the password for the
root/admin principal, I can then again do "kadmin -p root/admin"
(it accepts my password), but then "kadmin -p root/admin -k -t
/etc/web.keytab" fails.
What do I need to do to make both of these work?
Thanks,
Bryan
Russ Allbery <rra@stanford.edu> wrote:
> "Bryan K. Wright" <bryan@ayesha.phys.virginia.edu> writes:
>> Thanks for your help, but I'm afraid I'm still clueless. Several people
>> have pointed out that I can store an appropriate key in a keytab file,
>> but can anyone give me some step-by-step instructions on how to do this?
>> By the way, this is MIT Kerberos version 1.6.1.
> kadmin
> # authenticate as a user listed in kadm5.acl on your KDC
> ktadd -k /path/to/keytab name-of-principal@EXAMPLE.COM
> --
> Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
--
========================================================================
Bryan Wright |"If you take cranberries and stew them like
Physics Department | applesauce, they taste much more like prunes
University of Virginia | than rhubarb does." -- Groucho
Charlottesville, VA 22901|
(434) 924-7218 | bryan@virginia.edu
========================================================================
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
