[OpenAFS] Kerberos 5, AFS, and no krb524d

Nicholas Henke henken@seas.upenn.edu
05 Jun 2003 16:20:13 -0400


On Thu, 2003-06-05 at 15:32, Douglas E. Engert wrote:
> If you Kerberos admins will not run the krb524d (and I don't know
> why not) there are some other options:
> 
>  o An aklog that just used the k5 ticket would be good, but is there one
>    yet? This would in efect be a klog, using k5, and the K5 realm must
>    match the AFS cell. The AFS servers need to be 1.2.9 

Why must the K5 realm match the AFS cell ? I think this would not work,
as we have a static K5 realm of UPENN.EDU and are looking to migrate
each of our linux clusters to it's own AFS cell.

> 
>  o Run krb524d -k on a seperate machine, but the client need to know where
>    it is, as well as the lib. We do this for the W2K KDC, The krb5.conf 
>    [realms] entry has a krb524d = <host> where the krb524d runs on UNIX.

Ok -- here are the steps that I did to try to get this to work...where
did I go wrong ?
kadmin:  addprinc -e des-cbc-crc:v4 afs/roughneck.liniac.upenn.edu
NOTICE: no policy specified for
afs/roughneck.liniac.upenn.edu@UPENN.EDU; assigning "default"
Enter password for principal "afs/roughneck.liniac.upenn.edu@UPENN.EDU":

kadmin:  addprinc -e des-cbc-crc:v4 afsadmin/roughneck.liniac.upenn.edu
NOTICE: no policy specified for
afsadmin/roughneck.liniac.upenn.edu@UPENN.EDU; assigning "default"
Enter password for principal
"afsadmin/roughneck.liniac.upenn.edu@UPENN.EDU":

kadmin:  getprinc afs/roughneck.liniac.upenn.edu
Principal: afs/roughneck.liniac.upenn.edu@UPENN.EDU
Expiration date: [never]
Last password change: Thu Jun 05 15:40:55 EDT 2003
Password expiration date: [none]
Maximum ticket life: 0 days 10:00:00
Maximum renewable life: 7 days 00:00:00
Last modified: Thu Jun 05 15:40:55 EDT 2003
(henken/kadmin-liniac.upenn.edu@UPENN.EDU)
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 1
Key: vno 1, DES cbc mode with CRC-32, Version 4
Attributes: REQUIRES_PRE_AUTH DISALLOW_SVR
Policy: default

kadmin:  getprinc afsadmin/roughneck.liniac.upenn.edu
Principal: afsadmin/roughneck.liniac.upenn.edu@UPENN.EDU
Expiration date: [never]
Last password change: Thu Jun 05 15:41:16 EDT 2003
Password expiration date: [none]
Maximum ticket life: 0 days 10:00:00
Maximum renewable life: 7 days 00:00:00
Last modified: Thu Jun 05 15:41:16 EDT 2003
(henken/kadmin-liniac.upenn.edu@UPENN.EDU)
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 1
Key: vno 1, DES cbc mode with CRC-32, Version 4
Attributes: REQUIRES_PRE_AUTH DISALLOW_SVR
Policy: default

kadmin:  modprinc -kvno 0 afs/roughneck.liniac.upenn.edu
Principal "afs/roughneck.liniac.upenn.edu@UPENN.EDU" modified.

kadmin:  getprinc afs/roughneck.liniac.upenn.edu
Principal: afs/roughneck.liniac.upenn.edu@UPENN.EDU
Expiration date: [never]
Last password change: Thu Jun 05 15:40:55 EDT 2003
Password expiration date: [none]
Maximum ticket life: 0 days 10:00:00
Maximum renewable life: 7 days 00:00:00
Last modified: Thu Jun 05 16:03:37 EDT 2003
(henken/kadmin-liniac.upenn.edu@UPENN.EDU)
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 1
Key: vno 0, DES cbc mode with CRC-32, Version 4
Attributes: REQUIRES_PRE_AUTH DISALLOW_SVR
Policy: default

kadmin:  ktadd -e des-cbc-crc:v4 afs/roughneck.liniac.upenn.edu
Entry for principal afs/roughneck.liniac.upenn.edu with kvno 1,
encryption type DES cbc mode with CRC-32 added to keytab
WRFILE:/etc/krb5.keytab.

kadmin:  ktadd -e des-cbc-crc:v4 afsadmin/roughneck.liniac.upenn.edu
Entry for principal afsadmin/roughneck.liniac.upenn.edu with kvno 2,
encryption type DES cbc mode with CRC-32 added to keytab
WRFILE:/etc/krb5.keytab.


[root@roughneck root]# klist -k -e -t -K
Keytab name: FILE:/etc/krb5.keytab
KVNO Timestamp         Principal
---- -----------------
--------------------------------------------------------
   1 06/05/03 16:04:26 afs/roughneck.liniac.upenn.edu@UPENN.EDU (DES cbc
mode with CRC-32)  (0x588fe6078915e58c)
   2 06/05/03 16:04:38 afsadmin/roughneck.liniac.upenn.edu@UPENN.EDU
(DES cbc mode with CRC-32)  (0xcb193ef19d31f1ea)

[root@roughneck root]# krb524d -k -nofork

edit /etc/krb5.conf to add roughneck.liniac.upenn.edu as a kdc and
krb524_server

[root@roughneck root]# asetkey add 1 /etc/krb5.keytab
afs/roughneck.liniac.upenn.edu

[root@roughneck root]# asetkey list
kvno    1: key is: 588fe6078915e58c
All done.

[root@roughneck root]# klist
klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)


Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached

[root@roughneck root]# kinit -p afsadmin/roughneck.liniac.upenn.edu
Password for afsadmin/roughneck.liniac.upenn.edu@UPENN.EDU:
kinit(v5): Preauthentication failed while getting initial credentials

I know I typed in the passwd correctly -- but I do not get
authenticated. Now I change the password for afsadmin:

kadmin : cpw -e des-cbc-crc:v4 afsadmin/roughneck.liniac.upenn.edu
Enter password for principal "afsadmin/roughneck.liniac.upenn.edu":

kadmin:  getprinc afsadmin/roughneck.liniac.upenn.edu@UPENN.EDU
Principal: afsadmin/roughneck.liniac.upenn.edu@UPENN.EDU
Expiration date: [never]
Last password change: Thu Jun 05 16:12:50 EDT 2003
Password expiration date: [none]
Maximum ticket life: 0 days 10:00:00
Maximum renewable life: 7 days 00:00:00
Last modified: Thu Jun 05 16:12:50 EDT 2003
(henken/kadmin-liniac.upenn.edu@UPENN.EDU)
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 1
Key: vno 3, DES cbc mode with CRC-32, Version 4
Attributes: REQUIRES_PRE_AUTH DISALLOW_SVR
Policy: default

Ok -- the kvno has changed, so I need the new key in the keytab:

kadmin:  ktadd -e des-cbc-crc:v4 afsadmin/roughneck.liniac.upenn.edu
Entry for principal afsadmin/roughneck.liniac.upenn.edu with kvno 4,
encryption type DES cbc mode with CRC-32 added to keytab
WRFILE:/etc/krb5.keytab.

Now -- If I try kinit'ing before the ktadd, it works, but after I get
Preauthentication failed... Is ktadd changing the password ? What other
information can I send to debug this ?

> 
>  o Use gssklog, where the gssklogd deamons run on the AFS database servers.
>    The clients run on Unix or Windows. The realm of the KDC does not have to
>    match the AFS cell name, as the gssklogd does a mapping from the GSS 
>    client_name to the AFS uid name, and returns an AFS token.
>    It needs the GSSAPI and on Windows I am using the MIT, but I am going 
>    to try and get it to work directly with the SSPI.
>  
>    See  ftp://achilles.ctd.anl.gov/pub/DEE/gssklog-0.6.tar

I will take a look at this, but I am leaning towards the previos 2
options. To me they seem easier.

Nic
-- 
Nicholas Henke
Penguin Herder & Linux Cluster System Programmer
Liniac Project - Univ. of Pennsylvania