[28483] in Kerberos
RE: Problems with kadmind, kpasswd and cross-realm authentication
daemon@ATHENA.MIT.EDU (Anthony Brock)
Mon Sep 24 18:35:49 2007
From: "Anthony Brock" <brocka@sterlingcgi.com>
To: "Markus Moeller" <huaraz@moeller.plus.com>, <kerberos@mit.edu>
Date: Mon, 24 Sep 2007 15:27:49 -0700
Message-ID: <LEEIJGBJEEABAGOFFGAHGEANEAAA.brocka@sterlingcgi.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0000_01C7FEBF.77093810"
In-Reply-To: <13fg82nh7b5t51c@corp.supernews.com>
Errors-To: kerberos-bounces@mit.edu
This is a multi-part message in MIME format.
------=_NextPart_000_0000_01C7FEBF.77093810
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Unfortunately I'm not necessarily familiar enough to know if I'm seeing the
"correct" tickets. I am seeing 6 packets with the first 4 are directed
to/from port 88 and the last 2 directed to/from 464:
PKT 1: Client Name (Principal): brocka, Realm: STERLINGCGI.COM, Server Name
(Principal): kadmin/changepw, KRB5 AS-REQ
PKT 2: Client Name (Principal): brocka, Realm: STERLINGCGI.COM, Server Name
(Principal): kadmin/changepw, KRB5 KRB Error: KRB5KDC_ERR_PREAUTH_REQUIRED
PKT 3: Client Name (Principal): brocka, Realm: STERLINGCGI.COM, Server Name
(Principal): kadmin/changepw, KRB5 AS-REQ
PKT 4: Client Name (Principal): brocka, Realm: STERLINGCGI.COM, Server Name
(Principal): kadmin/changepw, KRB5 AS-REP
Then I see:
PKT 5: Tkt-vno: 5, Realm: STERLINGCGI.COM, Server Name (Principal):
kadmin/changepw, KPASSWD Reply
PKT 6: KPASSWD Reply[Malformed Packet]
It's interesting to note that I can see in the "text" field of wireshark for
the "[Malformed Packet: Kpasswd]" the words "SCGROUP.ORG", "kadmin",
"changepw" and "Failed reading application request". However, obviously,
wireshark didn't seem to understand the contents of the packet. Other than
this anomaly, the REALM looks good to me.
I'm also attaching a "text" export of the packet capture from wireshark.
Tony
> -----Original Message-----
> From: kerberos-bounces@mit.edu [mailto:kerberos-bounces@mit.edu]On
> Behalf Of Markus Moeller
> Sent: Monday, September 24, 2007 1:39 PM
> To: kerberos@mit.edu
> Subject: Re: Problems with kadmind, kpasswd and cross-realm
> authentication
>
>
> What do you see when you capture the traffic with wireshark on
> port 88 and
> 464 ? Do you see the correct kadmin/changepw@REALM tickets ?
>
> Markus
>
> "Anthony Brock" <brocka@sterlingcgi.com> wrote in message
> news:mailman.110.1190648781.2905.kerberos@mit.edu...
> >> -----Original Message-----
> >> Any ideas?
> >>
> >> The man page states that kadmind should be able to change
> >> passwords for any
> >> realms that have an associated kadmin/changepw@<REALM> and
> >> kadmin/admin@<REALM> principal. Is this still true? Or has
> >> support for this
> >> functionality been dropped? If not, what debugging can be performed to
> >> identify the cause of the issue?
> >>
> >> Ideas?
> >>
> >> Tony
> >
> > Given that it's been 3 weeks and nobody has any suggestions for further
> > troubleshooting or identifying the issue, should this be submitted as a
> > bug
> > in kadmind? If so, how do I submit it? Is there a documented process for
> > this?
> >
> > Also, are there any suggested workarounds? I've seen references
> from 2004
> > to
> > people running a separate kadmind daemon for each realm using different
> > port
> > numbers. Is this safe against a single db? If not, how do you migrate a
> > realm out of the default db into a separate db files?
> >
> > Thanks!
> >
> > Tony
> >
>
>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
------=_NextPart_000_0000_01C7FEBF.77093810
Content-Type: text/plain;
name="brocka_STERLINGCGI_COM.txt"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
filename="brocka_STERLINGCGI_COM.txt"
No. Time Source Destination Protocol =
Info=0A=
1 0.000000 10.0.1.8 10.0.1.7 KRB5 =
AS-REQ=0A=
=0A=
Frame 1 (215 bytes on wire, 215 bytes captured)=0A=
Arrival Time: Sep 24, 2007 14:58:14.130291000=0A=
[Time delta from previous captured frame: 0.000000000 seconds]=0A=
[Time delta from previous displayed frame: 0.000000000 seconds]=0A=
[Time since reference or first frame: 0.000000000 seconds]=0A=
Frame Number: 1=0A=
Frame Length: 215 bytes=0A=
Capture Length: 215 bytes=0A=
[Frame is marked: False]=0A=
[Protocols in frame: eth:ip:udp:kerberos]=0A=
[Coloring Rule Name: UDP]=0A=
[Coloring Rule String: udp]=0A=
Ethernet II, Src: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08), Dst: =
fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
Destination: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
Address: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
.... ...0 .... .... .... .... =3D IG bit: Individual address =
(unicast)=0A=
.... ..1. .... .... .... .... =3D LG bit: Locally administered =
address (this is NOT the factory default)=0A=
Source: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
Address: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
.... ...0 .... .... .... .... =3D IG bit: Individual address =
(unicast)=0A=
.... ..1. .... .... .... .... =3D LG bit: Locally administered =
address (this is NOT the factory default)=0A=
Type: IP (0x0800)=0A=
Internet Protocol, Src: 10.0.1.8 (10.0.1.8), Dst: 10.0.1.7 (10.0.1.7)=0A=
Version: 4=0A=
Header length: 20 bytes=0A=
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)=0A=
0000 00.. =3D Differentiated Services Codepoint: Default (0x00)=0A=
.... ..0. =3D ECN-Capable Transport (ECT): 0=0A=
.... ...0 =3D ECN-CE: 0=0A=
Total Length: 201=0A=
Identification: 0x8a2b (35371)=0A=
Flags: 0x04 (Don't Fragment)=0A=
0... =3D Reserved bit: Not set=0A=
.1.. =3D Don't fragment: Set=0A=
..0. =3D More fragments: Not set=0A=
Fragment offset: 0=0A=
Time to live: 64=0A=
Protocol: UDP (0x11)=0A=
Header checksum: 0x99ea [correct]=0A=
[Good: True]=0A=
[Bad : False]=0A=
Source: 10.0.1.8 (10.0.1.8)=0A=
Destination: 10.0.1.7 (10.0.1.7)=0A=
User Datagram Protocol, Src Port: 2107 (2107), Dst Port: kerberos (88)=0A=
Source port: 2107 (2107)=0A=
Destination port: kerberos (88)=0A=
Length: 181=0A=
Checksum: 0x80a4 [correct]=0A=
[Good Checksum: True]=0A=
[Bad Checksum: False]=0A=
Kerberos AS-REQ=0A=
Pvno: 5=0A=
MSG Type: AS-REQ (10)=0A=
KDC_REQ_BODY=0A=
Padding: 0=0A=
KDCOptions: 00000010 (Renewable OK)=0A=
.0.. .... .... .... .... .... .... .... =3D Forwardable: Do =
NOT use forwardable tickets=0A=
..0. .... .... .... .... .... .... .... =3D Forwarded: This =
is NOT a forwarded ticket=0A=
...0 .... .... .... .... .... .... .... =3D Proxyable: Do =
NOT use proxiable tickets=0A=
.... 0... .... .... .... .... .... .... =3D Proxy: This =
ticket has NOT been proxied=0A=
.... .0.. .... .... .... .... .... .... =3D Allow Postdate: =
We do NOT allow the ticket to be postdated=0A=
.... ..0. .... .... .... .... .... .... =3D Postdated: This =
ticket is NOT postdated=0A=
.... .... 0... .... .... .... .... .... =3D Renewable: This =
ticket is NOT renewable=0A=
.... .... ...0 .... .... .... .... .... =3D Opt HW Auth: =
False=0A=
.... .... .... ..0. .... .... .... .... =3D Constrained =
Delegation: This is a normal request (no constrained delegation)=0A=
.... .... .... ...0 .... .... .... .... =3D Canonicalize: =
This is NOT a canonicalized ticket request=0A=
.... .... .... .... .... .... ..0. .... =3D Disable =
Transited Check: Transited checking is NOT disabled=0A=
.... .... .... .... .... .... ...1 .... =3D Renewable OK: We =
accept RENEWED tickets=0A=
.... .... .... .... .... .... .... 0... =3D Enc-Tkt-in-Skey: =
Do NOT encrypt the tkt inside the skey=0A=
.... .... .... .... .... .... .... ..0. =3D Renew: This is =
NOT a request to renew a ticket=0A=
.... .... .... .... .... .... .... ...0 =3D Validate: This =
is NOT a request to validate a postdated ticket=0A=
Client Name (Principal): brocka=0A=
Name-type: Principal (1)=0A=
Name: brocka=0A=
Realm: STERLINGCGI.COM=0A=
Server Name (Principal): kadmin/changepw=0A=
Name-type: Principal (1)=0A=
Name: kadmin=0A=
Name: changepw=0A=
from: 2007-09-24 21:58:14 (Z)=0A=
till: 2007-09-24 22:03:14 (Z)=0A=
Nonce: 1190671094=0A=
Encryption Types: aes256-cts-hmac-sha1-96 =
aes128-cts-hmac-sha1-96 des3-cbc-sha1 rc4-hmac des-cbc-crc des-cbc-md5 =
des-cbc-md4=0A=
Encryption type: aes256-cts-hmac-sha1-96 (18)=0A=
Encryption type: aes128-cts-hmac-sha1-96 (17)=0A=
Encryption type: des3-cbc-sha1 (16)=0A=
Encryption type: rc4-hmac (23)=0A=
Encryption type: des-cbc-crc (1)=0A=
Encryption type: des-cbc-md5 (3)=0A=
Encryption type: des-cbc-md4 (2)=0A=
=0A=
No. Time Source Destination Protocol =
Info=0A=
2 0.011316 10.0.1.7 10.0.1.8 KRB5 =
KRB Error: KRB5KDC_ERR_PREAUTH_REQUIRED=0A=
=0A=
Frame 2 (369 bytes on wire, 369 bytes captured)=0A=
Arrival Time: Sep 24, 2007 14:58:14.141607000=0A=
[Time delta from previous captured frame: 0.011316000 seconds]=0A=
[Time delta from previous displayed frame: 0.011316000 seconds]=0A=
[Time since reference or first frame: 0.011316000 seconds]=0A=
Frame Number: 2=0A=
Frame Length: 369 bytes=0A=
Capture Length: 369 bytes=0A=
[Frame is marked: False]=0A=
[Protocols in frame: eth:ip:udp:kerberos]=0A=
[Coloring Rule Name: UDP]=0A=
[Coloring Rule String: udp]=0A=
Ethernet II, Src: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07), Dst: =
fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
Destination: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
Address: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
.... ...0 .... .... .... .... =3D IG bit: Individual address =
(unicast)=0A=
.... ..1. .... .... .... .... =3D LG bit: Locally administered =
address (this is NOT the factory default)=0A=
Source: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
Address: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
.... ...0 .... .... .... .... =3D IG bit: Individual address =
(unicast)=0A=
.... ..1. .... .... .... .... =3D LG bit: Locally administered =
address (this is NOT the factory default)=0A=
Type: IP (0x0800)=0A=
Internet Protocol, Src: 10.0.1.7 (10.0.1.7), Dst: 10.0.1.8 (10.0.1.8)=0A=
Version: 4=0A=
Header length: 20 bytes=0A=
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)=0A=
0000 00.. =3D Differentiated Services Codepoint: Default (0x00)=0A=
.... ..0. =3D ECN-Capable Transport (ECT): 0=0A=
.... ...0 =3D ECN-CE: 0=0A=
Total Length: 355=0A=
Identification: 0x0000 (0)=0A=
Flags: 0x04 (Don't Fragment)=0A=
0... =3D Reserved bit: Not set=0A=
.1.. =3D Don't fragment: Set=0A=
..0. =3D More fragments: Not set=0A=
Fragment offset: 0=0A=
Time to live: 64=0A=
Protocol: UDP (0x11)=0A=
Header checksum: 0x237c [correct]=0A=
[Good: True]=0A=
[Bad : False]=0A=
Source: 10.0.1.7 (10.0.1.7)=0A=
Destination: 10.0.1.8 (10.0.1.8)=0A=
User Datagram Protocol, Src Port: kerberos (88), Dst Port: 2107 (2107)=0A=
Source port: kerberos (88)=0A=
Destination port: 2107 (2107)=0A=
Length: 335=0A=
Checksum: 0xfc36 [correct]=0A=
[Good Checksum: True]=0A=
[Bad Checksum: False]=0A=
Kerberos KRB-ERROR=0A=
Pvno: 5=0A=
MSG Type: KRB-ERROR (30)=0A=
ctime: 2007-09-24 21:58:14 (Z)=0A=
stime: 2007-09-24 21:58:14 (Z)=0A=
susec: 141235=0A=
error_code: KRB5KDC_ERR_PREAUTH_REQUIRED (25)=0A=
Client Realm: STERLINGCGI.COM=0A=
Client Name (Principal): brocka=0A=
Name-type: Principal (1)=0A=
Name: brocka=0A=
Realm: STERLINGCGI.COM=0A=
Server Name (Principal): kadmin/changepw=0A=
Name-type: Principal (1)=0A=
Name: kadmin=0A=
Name: changepw=0A=
e-text: NEEDED_PREAUTH=0A=
e-data=0A=
padata: PA-ENC-TIMESTAMP PA-ENCTYPE-INFO2 PA-SAM-RESPONSE=0A=
Type: PA-ENC-TIMESTAMP (2)=0A=
Value: <MISSING>=0A=
Type: PA-ENCTYPE-INFO2 (19)=0A=
Value: =
306A3005A0030201103005A0030201013005A00302010330... des3-cbc-sha1 =
des-cbc-crc des-cbc-md5 des-cbc-md5 des-cbc-md5 des-cbc-md5 des-cbc-md5=0A=
Encryption type: des3-cbc-sha1 (16)=0A=
Encryption type: des-cbc-crc (1)=0A=
Encryption type: des-cbc-md5 (3)=0A=
Encryption type: des-cbc-md5 (3)=0A=
Salt: <MISSING>=0A=
Encryption type: des-cbc-md5 (3)=0A=
Salt: 62726F636B61=0A=
Encryption type: des-cbc-md5 (3)=0A=
Salt: 535445524C494E474347492E434F4D=0A=
Encryption type: des-cbc-md5 (3)=0A=
Salt: 535445524C494E474347492E434F4D=0A=
Salt: 01=0A=
Type: PA-SAM-RESPONSE (13)=0A=
Value: <MISSING>=0A=
=0A=
No. Time Source Destination Protocol =
Info=0A=
3 3.832869 10.0.1.8 10.0.1.7 KRB5 =
AS-REQ=0A=
=0A=
Frame 3 (302 bytes on wire, 302 bytes captured)=0A=
Arrival Time: Sep 24, 2007 14:58:17.963160000=0A=
[Time delta from previous captured frame: 3.821553000 seconds]=0A=
[Time delta from previous displayed frame: 3.821553000 seconds]=0A=
[Time since reference or first frame: 3.832869000 seconds]=0A=
Frame Number: 3=0A=
Frame Length: 302 bytes=0A=
Capture Length: 302 bytes=0A=
[Frame is marked: False]=0A=
[Protocols in frame: eth:ip:udp:kerberos]=0A=
[Coloring Rule Name: UDP]=0A=
[Coloring Rule String: udp]=0A=
Ethernet II, Src: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08), Dst: =
fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
Destination: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
Address: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
.... ...0 .... .... .... .... =3D IG bit: Individual address =
(unicast)=0A=
.... ..1. .... .... .... .... =3D LG bit: Locally administered =
address (this is NOT the factory default)=0A=
Source: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
Address: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
.... ...0 .... .... .... .... =3D IG bit: Individual address =
(unicast)=0A=
.... ..1. .... .... .... .... =3D LG bit: Locally administered =
address (this is NOT the factory default)=0A=
Type: IP (0x0800)=0A=
Internet Protocol, Src: 10.0.1.8 (10.0.1.8), Dst: 10.0.1.7 (10.0.1.7)=0A=
Version: 4=0A=
Header length: 20 bytes=0A=
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)=0A=
0000 00.. =3D Differentiated Services Codepoint: Default (0x00)=0A=
.... ..0. =3D ECN-Capable Transport (ECT): 0=0A=
.... ...0 =3D ECN-CE: 0=0A=
Total Length: 288=0A=
Identification: 0x8bac (35756)=0A=
Flags: 0x04 (Don't Fragment)=0A=
0... =3D Reserved bit: Not set=0A=
.1.. =3D Don't fragment: Set=0A=
..0. =3D More fragments: Not set=0A=
Fragment offset: 0=0A=
Time to live: 64=0A=
Protocol: UDP (0x11)=0A=
Header checksum: 0x9812 [correct]=0A=
[Good: True]=0A=
[Bad : False]=0A=
Source: 10.0.1.8 (10.0.1.8)=0A=
Destination: 10.0.1.7 (10.0.1.7)=0A=
User Datagram Protocol, Src Port: 2107 (2107), Dst Port: kerberos (88)=0A=
Source port: 2107 (2107)=0A=
Destination port: kerberos (88)=0A=
Length: 268=0A=
Checksum: 0x1c3e [correct]=0A=
[Good Checksum: True]=0A=
[Bad Checksum: False]=0A=
Kerberos AS-REQ=0A=
Pvno: 5=0A=
MSG Type: AS-REQ (10)=0A=
padata: PA-ENC-TIMESTAMP=0A=
Type: PA-ENC-TIMESTAMP (2)=0A=
Value: 3045A003020110A23E043C4BAFBF1CE24B22DE02D0122BB6... =
des3-cbc-sha1=0A=
Encryption type: des3-cbc-sha1 (16)=0A=
enc PA_ENC_TIMESTAMP: =
4BAFBF1CE24B22DE02D0122BB6D0121DAF5C4F92A4172EC3...=0A=
KDC_REQ_BODY=0A=
Padding: 0=0A=
KDCOptions: 00000010 (Renewable OK)=0A=
.0.. .... .... .... .... .... .... .... =3D Forwardable: Do =
NOT use forwardable tickets=0A=
..0. .... .... .... .... .... .... .... =3D Forwarded: This =
is NOT a forwarded ticket=0A=
...0 .... .... .... .... .... .... .... =3D Proxyable: Do =
NOT use proxiable tickets=0A=
.... 0... .... .... .... .... .... .... =3D Proxy: This =
ticket has NOT been proxied=0A=
.... .0.. .... .... .... .... .... .... =3D Allow Postdate: =
We do NOT allow the ticket to be postdated=0A=
.... ..0. .... .... .... .... .... .... =3D Postdated: This =
ticket is NOT postdated=0A=
.... .... 0... .... .... .... .... .... =3D Renewable: This =
ticket is NOT renewable=0A=
.... .... ...0 .... .... .... .... .... =3D Opt HW Auth: =
False=0A=
.... .... .... ..0. .... .... .... .... =3D Constrained =
Delegation: This is a normal request (no constrained delegation)=0A=
.... .... .... ...0 .... .... .... .... =3D Canonicalize: =
This is NOT a canonicalized ticket request=0A=
.... .... .... .... .... .... ..0. .... =3D Disable =
Transited Check: Transited checking is NOT disabled=0A=
.... .... .... .... .... .... ...1 .... =3D Renewable OK: We =
accept RENEWED tickets=0A=
.... .... .... .... .... .... .... 0... =3D Enc-Tkt-in-Skey: =
Do NOT encrypt the tkt inside the skey=0A=
.... .... .... .... .... .... .... ..0. =3D Renew: This is =
NOT a request to renew a ticket=0A=
.... .... .... .... .... .... .... ...0 =3D Validate: This =
is NOT a request to validate a postdated ticket=0A=
Client Name (Principal): brocka=0A=
Name-type: Principal (1)=0A=
Name: brocka=0A=
Realm: STERLINGCGI.COM=0A=
Server Name (Principal): kadmin/changepw=0A=
Name-type: Principal (1)=0A=
Name: kadmin=0A=
Name: changepw=0A=
from: 2007-09-24 21:58:14 (Z)=0A=
till: 2007-09-24 22:03:14 (Z)=0A=
Nonce: 1190671094=0A=
Encryption Types: aes256-cts-hmac-sha1-96 =
aes128-cts-hmac-sha1-96 des3-cbc-sha1 rc4-hmac des-cbc-crc des-cbc-md5 =
des-cbc-md4=0A=
Encryption type: aes256-cts-hmac-sha1-96 (18)=0A=
Encryption type: aes128-cts-hmac-sha1-96 (17)=0A=
Encryption type: des3-cbc-sha1 (16)=0A=
Encryption type: rc4-hmac (23)=0A=
Encryption type: des-cbc-crc (1)=0A=
Encryption type: des-cbc-md5 (3)=0A=
Encryption type: des-cbc-md4 (2)=0A=
=0A=
No. Time Source Destination Protocol =
Info=0A=
4 3.837799 10.0.1.7 10.0.1.8 KRB5 =
AS-REP=0A=
=0A=
Frame 4 (611 bytes on wire, 611 bytes captured)=0A=
Arrival Time: Sep 24, 2007 14:58:17.968090000=0A=
[Time delta from previous captured frame: 0.004930000 seconds]=0A=
[Time delta from previous displayed frame: 0.004930000 seconds]=0A=
[Time since reference or first frame: 3.837799000 seconds]=0A=
Frame Number: 4=0A=
Frame Length: 611 bytes=0A=
Capture Length: 611 bytes=0A=
[Frame is marked: False]=0A=
[Protocols in frame: eth:ip:udp:kerberos]=0A=
[Coloring Rule Name: UDP]=0A=
[Coloring Rule String: udp]=0A=
Ethernet II, Src: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07), Dst: =
fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
Destination: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
Address: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
.... ...0 .... .... .... .... =3D IG bit: Individual address =
(unicast)=0A=
.... ..1. .... .... .... .... =3D LG bit: Locally administered =
address (this is NOT the factory default)=0A=
Source: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
Address: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
.... ...0 .... .... .... .... =3D IG bit: Individual address =
(unicast)=0A=
.... ..1. .... .... .... .... =3D LG bit: Locally administered =
address (this is NOT the factory default)=0A=
Type: IP (0x0800)=0A=
Internet Protocol, Src: 10.0.1.7 (10.0.1.7), Dst: 10.0.1.8 (10.0.1.8)=0A=
Version: 4=0A=
Header length: 20 bytes=0A=
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)=0A=
0000 00.. =3D Differentiated Services Codepoint: Default (0x00)=0A=
.... ..0. =3D ECN-Capable Transport (ECT): 0=0A=
.... ...0 =3D ECN-CE: 0=0A=
Total Length: 597=0A=
Identification: 0x0000 (0)=0A=
Flags: 0x04 (Don't Fragment)=0A=
0... =3D Reserved bit: Not set=0A=
.1.. =3D Don't fragment: Set=0A=
..0. =3D More fragments: Not set=0A=
Fragment offset: 0=0A=
Time to live: 64=0A=
Protocol: UDP (0x11)=0A=
Header checksum: 0x228a [correct]=0A=
[Good: True]=0A=
[Bad : False]=0A=
Source: 10.0.1.7 (10.0.1.7)=0A=
Destination: 10.0.1.8 (10.0.1.8)=0A=
User Datagram Protocol, Src Port: kerberos (88), Dst Port: 2107 (2107)=0A=
Source port: kerberos (88)=0A=
Destination port: 2107 (2107)=0A=
Length: 577=0A=
Checksum: 0x2d61 [correct]=0A=
[Good Checksum: True]=0A=
[Bad Checksum: False]=0A=
Kerberos AS-REP=0A=
Pvno: 5=0A=
MSG Type: AS-REP (11)=0A=
padata: PA-ENCTYPE-INFO2=0A=
Type: PA-ENCTYPE-INFO2 (19)=0A=
Value: 30073005A003020110 des3-cbc-sha1=0A=
Encryption type: des3-cbc-sha1 (16)=0A=
Client Realm: STERLINGCGI.COM=0A=
Client Name (Principal): brocka=0A=
Name-type: Principal (1)=0A=
Name: brocka=0A=
Ticket=0A=
Tkt-vno: 5=0A=
Realm: STERLINGCGI.COM=0A=
Server Name (Principal): kadmin/changepw=0A=
Name-type: Principal (1)=0A=
Name: kadmin=0A=
Name: changepw=0A=
enc-part des3-cbc-sha1=0A=
Encryption type: des3-cbc-sha1 (16)=0A=
Kvno: 3=0A=
enc-part: 8C7CDA0A07D024123A08EEA1ED5B6100FE109DD3BFC60F01...=0A=
enc-part des3-cbc-sha1=0A=
Encryption type: des3-cbc-sha1 (16)=0A=
enc-part: 440AAF09E6C7C8F9DA0D97C515AC128D43BBCBCE344D4ADE...=0A=
=0A=
No. Time Source Destination Protocol =
Info=0A=
5 9.164700 10.0.1.8 10.0.1.7 KPASSWD =
Reply=0A=
=0A=
Frame 5 (585 bytes on wire, 585 bytes captured)=0A=
Arrival Time: Sep 24, 2007 14:58:23.294991000=0A=
[Time delta from previous captured frame: 5.326901000 seconds]=0A=
[Time delta from previous displayed frame: 5.326901000 seconds]=0A=
[Time since reference or first frame: 9.164700000 seconds]=0A=
Frame Number: 5=0A=
Frame Length: 585 bytes=0A=
Capture Length: 585 bytes=0A=
[Frame is marked: False]=0A=
[Protocols in frame: eth:ip:udp:kpasswd]=0A=
[Coloring Rule Name: UDP]=0A=
[Coloring Rule String: udp]=0A=
Ethernet II, Src: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08), Dst: =
fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
Destination: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
Address: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
.... ...0 .... .... .... .... =3D IG bit: Individual address =
(unicast)=0A=
.... ..1. .... .... .... .... =3D LG bit: Locally administered =
address (this is NOT the factory default)=0A=
Source: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
Address: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
.... ...0 .... .... .... .... =3D IG bit: Individual address =
(unicast)=0A=
.... ..1. .... .... .... .... =3D LG bit: Locally administered =
address (this is NOT the factory default)=0A=
Type: IP (0x0800)=0A=
Internet Protocol, Src: 10.0.1.8 (10.0.1.8), Dst: 10.0.1.7 (10.0.1.7)=0A=
Version: 4=0A=
Header length: 20 bytes=0A=
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)=0A=
0000 00.. =3D Differentiated Services Codepoint: Default (0x00)=0A=
.... ..0. =3D ECN-Capable Transport (ECT): 0=0A=
.... ...0 =3D ECN-CE: 0=0A=
Total Length: 571=0A=
Identification: 0x8dc3 (36291)=0A=
Flags: 0x04 (Don't Fragment)=0A=
0... =3D Reserved bit: Not set=0A=
.1.. =3D Don't fragment: Set=0A=
..0. =3D More fragments: Not set=0A=
Fragment offset: 0=0A=
Time to live: 64=0A=
Protocol: UDP (0x11)=0A=
Header checksum: 0x94e0 [correct]=0A=
[Good: True]=0A=
[Bad : False]=0A=
Source: 10.0.1.8 (10.0.1.8)=0A=
Destination: 10.0.1.7 (10.0.1.7)=0A=
User Datagram Protocol, Src Port: 2107 (2107), Dst Port: kpasswd (464)=0A=
Source port: 2107 (2107)=0A=
Destination port: kpasswd (464)=0A=
Length: 551=0A=
Checksum: 0xcec9 [correct]=0A=
[Good Checksum: True]=0A=
[Bad Checksum: False]=0A=
MS Kpasswd=0A=
Message Length: 543=0A=
Version: Reply (0x0001)=0A=
AP_REQ Length: 442=0A=
AP_REQ=0A=
Kerberos AP-REQ=0A=
Pvno: 5=0A=
MSG Type: AP-REQ (14)=0A=
Padding: 0=0A=
APOptions: 00000000=0A=
.0.. .... .... .... .... .... .... .... =3D Use Session =
Key: Do NOT use the session key to encrypt the ticket=0A=
..0. .... .... .... .... .... .... .... =3D Mutual =
required: Mutual authentication is NOT required=0A=
Ticket=0A=
Tkt-vno: 5=0A=
Realm: STERLINGCGI.COM=0A=
Server Name (Principal): kadmin/changepw=0A=
Name-type: Principal (1)=0A=
Name: kadmin=0A=
Name: changepw=0A=
enc-part des3-cbc-sha1=0A=
Encryption type: des3-cbc-sha1 (16)=0A=
Kvno: 3=0A=
enc-part: =
8C7CDA0A07D024123A08EEA1ED5B6100FE109DD3BFC60F01...=0A=
Authenticator des3-cbc-sha1=0A=
Encryption type: des3-cbc-sha1 (16)=0A=
Authenticator data: =
3CFD985919A44CB563EAC1C7842F070DF36FC95A58DA2188...=0A=
KRB-PRIV=0A=
Kerberos=0A=
PRIV_BODY KRB-PRIV=0A=
Pvno: 5=0A=
MSG Type: KRB-PRIV (21)=0A=
enc PRIV: =
A003020110A2460444B7F93E83DF9874269A1D151E6BB5CF... des3-cbc-sha1=0A=
Encryption type: des3-cbc-sha1 (16)=0A=
Encrypted PRIV=0A=
=0A=
No. Time Source Destination Protocol =
Info=0A=
6 9.168368 10.0.1.7 10.0.1.8 KPASSWD =
Reply[Malformed Packet]=0A=
=0A=
Frame 6 (177 bytes on wire, 177 bytes captured)=0A=
Arrival Time: Sep 24, 2007 14:58:23.298659000=0A=
[Time delta from previous captured frame: 0.003668000 seconds]=0A=
[Time delta from previous displayed frame: 0.003668000 seconds]=0A=
[Time since reference or first frame: 9.168368000 seconds]=0A=
Frame Number: 6=0A=
Frame Length: 177 bytes=0A=
Capture Length: 177 bytes=0A=
[Frame is marked: False]=0A=
[Protocols in frame: eth:ip:udp:kpasswd]=0A=
[Coloring Rule Name: UDP]=0A=
[Coloring Rule String: udp]=0A=
Ethernet II, Src: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07), Dst: =
fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
Destination: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
Address: fe:fd:0a:00:01:08 (fe:fd:0a:00:01:08)=0A=
.... ...0 .... .... .... .... =3D IG bit: Individual address =
(unicast)=0A=
.... ..1. .... .... .... .... =3D LG bit: Locally administered =
address (this is NOT the factory default)=0A=
Source: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
Address: fe:fd:0a:00:01:07 (fe:fd:0a:00:01:07)=0A=
.... ...0 .... .... .... .... =3D IG bit: Individual address =
(unicast)=0A=
.... ..1. .... .... .... .... =3D LG bit: Locally administered =
address (this is NOT the factory default)=0A=
Type: IP (0x0800)=0A=
Internet Protocol, Src: 10.0.1.7 (10.0.1.7), Dst: 10.0.1.8 (10.0.1.8)=0A=
Version: 4=0A=
Header length: 20 bytes=0A=
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)=0A=
0000 00.. =3D Differentiated Services Codepoint: Default (0x00)=0A=
.... ..0. =3D ECN-Capable Transport (ECT): 0=0A=
.... ...0 =3D ECN-CE: 0=0A=
Total Length: 163=0A=
Identification: 0x0000 (0)=0A=
Flags: 0x04 (Don't Fragment)=0A=
0... =3D Reserved bit: Not set=0A=
.1.. =3D Don't fragment: Set=0A=
..0. =3D More fragments: Not set=0A=
Fragment offset: 0=0A=
Time to live: 64=0A=
Protocol: UDP (0x11)=0A=
Header checksum: 0x243c [correct]=0A=
[Good: True]=0A=
[Bad : False]=0A=
Source: 10.0.1.7 (10.0.1.7)=0A=
Destination: 10.0.1.8 (10.0.1.8)=0A=
User Datagram Protocol, Src Port: kpasswd (464), Dst Port: 2107 (2107)=0A=
Source port: kpasswd (464)=0A=
Destination port: 2107 (2107)=0A=
Length: 143=0A=
Checksum: 0xa9ad [correct]=0A=
[Good Checksum: True]=0A=
[Bad Checksum: False]=0A=
MS Kpasswd=0A=
Message Length: 135=0A=
Version: Reply (0x0001)=0A=
AP_REQ Length: 0=0A=
[Malformed Packet: Kpasswd]=0A=
------=_NextPart_000_0000_01C7FEBF.77093810
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
------=_NextPart_000_0000_01C7FEBF.77093810--
