[OpenAFS] "ktadd -k <anywhere> afs/xyz@REALM" breaks AFS instantly?
Mon, 13 Feb 2006 20:49:45 -0800
Adam Megacz <email@example.com> writes:
> Wow, I just went through a really confusing experience. Please tell me
> if this is a correct understanding:
> 1. Exporting a key from the KDC into a keytab using "ktadd" causes
> the principal's "kvno" to be incremented.
It also causes the key stored in the KDC to be re-randomized, which is
more the problem. :)
> If I understand correctly, simply exporting the afs principal's key from
> the KDC (regardless of where you're exporting *to*) will instantly break
> all servers in the cell.
You have to use the same keytab everywhere; you can't download new copies
with ktadd. ktadd changes the key.
Russ Allbery (firstname.lastname@example.org) <http://www.eyrie.org/~eagle/>