[28473] in Kerberos
Re: kpasswd responds with Server error: Failed decrypting request
daemon@ATHENA.MIT.EDU (drjlove@gmail.com)
Mon Sep 24 05:00:39 2007
From: drjlove@gmail.com
Date: Mon, 24 Sep 2007 01:50:27 -0700
Message-ID: <1190623827.844726.221740@r29g2000hsg.googlegroups.com>
Mime-Version: 1.0
X-Complaints-To: groups-abuse@google.com
In-Reply-To: <mailman.104.1190620112.2905.kerberos@mit.edu>
Complaints-To: groups-abuse@google.com
To: kerberos@mit.edu
Content-Type: multipart/mixed; boundary="===============0121319777=="
Errors-To: kerberos-bounces@mit.edu
--===============0121319777==
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Hello Michael
Thanks very very much for that reference. I removed the reference to
the IPv6 address from my hosts file and it worked perfectly.
Jamie
On Sep 24, 5:48 pm, Michael Calmer <m...@suse.de> wrote:
> Hi,
>
> Your problem may be IPv6. I saw the same.
>
> See alsohttp://krbdev.mit.edu/rt/Ticket/Display.html?id=3D5595
>
> Am Montag, 24. September 2007 schrieb drjl...@gmail.com:
>
>
>
>
>
> > Hi all,
>
> > I am unable to use kpasswd to change a kerberos principle's password.
>
> > For the first time I'm setting up a LDAP+Kerberos system. I have set
> > everything up on a single (linux/Fedora) machine with openldap and the
> > MIT (I believe) KRB5 packages.
>
> > I have set up the system hosting kerberos/ldap such that as a unix
> > user listed in /etc/passwd I can log into the machine, and be also
> > authenticated to kerberos, and such that 'ldapwhoami' also works.
> > Kerberos is doing the authentication (in my shadow password file I
> > have *K* in the password field, so I know I'm not getting in by the
> > standard unix access).
>
> > When I log in to the machine I can do the following:
>
> > $ ssh 10.0.1.102
> > ja...@10.0.1.102's password:
> > Last login: Mon Sep 24 15:30:53 2007 from 10.8.0.6
> > [jamiel@janeiro ~]$ klist
> > Ticket cache: FILE:/tmp/krb5cc_505_d6jBsX
> > Default principal: ja...@aviarc.com.au
>
> > Valid starting Expires Service principal
> > 09/24/07 16:07:17 09/25/07 02:07:17 krbtgt/example....@example.com
> > renew until 09/24/07 16:07:17
>
> > Kerberos 4 ticket cache: /tmp/tkt505
> > klist: You have no tickets cached
> > [jamie@janeiro ~]$ ldapwhoami -h janeiro
> > SASL/GSSAPI authentication started
> > SASL username: ja...@aviarc.com.au
> > SASL SSF: 56
> > SASL installing layers
> > dn:uid=3Djamie,ou=3Dpeople,dc=3Dexample,dc=3Dcom
> > Result: Success (0)
> > [jamie@janeiro ~]$
>
> > I can do a ldapsearch and see all the data in the ldap directory (as
> > an aside, ldap commands require the -h option for the host for some
> > reason but I assume that is an ldap, not a kerberos problem)
>
> > So I'm quite happy with this, but I want to change my password, so I
> > do:
>
> > [jamie@janeiro ~]$ kpasswd
> > Password for ja...@example.com
> > Enter new password:
> > Enter it again:
> > Server error: Failed decrypting request
> > [jamie@janeiro ~]$
>
> > This is my problem. I have no idea why this error occurs. The log
> > says:
>
> > Sep 24 16:11:07 janeiro.example.com krb5kdc[7796](info): AS_REQ (7
> > etypes {18 17 16 23 1 3 2}) 10.0.1.102: ISSUE: authtime 1190614267,
> > etypes {rep=3D16 tkt=3D16 ses=3D16}, ja...@example.com for kadmin/
> > chang...@example.com
> > Sep 24 16:11:07 janeiro.example.com krb5kdc[7796](info): AS_REQ (7
> > etypes {18 17 16 23 1 3 2}) 10.0.1.102: ISSUE: authtime 1190614267,
> > etypes {rep=3D16 tkt=3D16 ses=3D16}, ja...@example.com for kadmin/
> > chang...@example.com
>
> > (there are two lines in the log file).
>
> > My principles in kerberos are:
>
> > kadmin: listprincs
> > K...@example.com
> > jamie/ad...@example.com
> > ja...@example.com
> > kadmin/ad...@example.com
> > kadmin/chang...@example.com
> > kadmin/hist...@example.com
> > kadmin/janeiro.example....@example.com
> > krbtgt/example....@example.com
> > ldap/janeiro.example....@example.com
>
> > Using kadmin (or kadmin.local) I can change the password for
> > principles.
>
> > Does anyone have any ideas?
>
> > ________________________________________________
> > Kerberos mailing list Kerbe...@mit.edu
> >https://mailman.mit.edu/mailman/listinfo/kerberos
>
> --
> MFG
>
> Michael Calmer
>
> --------------------------------------------------------------------------
> Michael Calmer
> SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg
> T: +49 (0) 911 74053 0
> F: +49 (0) 911 74053575 - e-mail: Michael.Cal...@suse.com
> --------------------------------------------------------------------------
> SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG N=FCrnberg)- Hide=
quoted text -
>
> - Show quoted text -
--===============0121319777==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============0121319777==--
