[OpenAFS] Active Directory 2003, kerberos 5, openAFS - rxkad error=19270407, arghhhh

Lönroth Erik erik.lonroth@scania.com
Mon, 8 Jan 2007 09:45:47 +0100


This is a multi-part message in MIME format.

------_=_NextPart_001_01C73301.645A4E28
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable


" I am trying to piece things together like Eric.
What we need is clear steps on how to create the Windows
AD afs/cell.name user and the proper way to export the
afs/cell.name key. Would be nice to have this for both
W2K and W2003. The linux "asetkey" man page  is real clear
on how to do this in linux, (thanks Russ). "

What we do now is that we have replaced the ktpass from WIN2003, SP1 =
with a working one.
We had big problems with a version that generated unusable tickets that =
gave us the annoying: =20

rxkad error=3D19270407

We basically follwed the procedure:

* Create AFS user in AD and set correct options. "Des only", "Delegate =
Service", "Password dont expires", "dont change at first login".

* Export keytab with "ktpass.exe", just make sure its not the version =
windows 2003,SP1.

* Import it to your AFS:cell(s) with "asetkey". (You might need to =
restart the openAFS server, I'm not sure.)

The thing that made this difficult for us was to find out about the =
WIN2003,SP1 bugg.

/Erik

-----Original Message-----
From: John W. Sopko Jr. [mailto:sopko@cs.unc.edu]
Sent: Fri 1/5/2007 5:39 PM
To: jaltman@secure-endpoints.com
Cc: openafs; L=F6nroth Erik
Subject: Re: [OpenAFS] Active Directory 2003, kerberos 5, openAFS - =
rxkad error=3D19270407, arghhhh
=20


Jeffrey Altman wrote:
> John:
>=20
> unless you plan to get rid of the MIT realm and move all of your
> principals to active directory, you are going to have to rename
> one of the Kerberos realms.

I should have been more clear. I am only running a TEST
krb5 1.4.4 server under linux. I am still running kaserver.
Like lots of folks looking to migrate to K5, have been for
years.

Our test linux/krb5 server has a different kerberos realm name
then the Windows realm name. I am not attempting/planning to run
2 kdc's with the same REALM name. We setup different DNS records
to find the kdc's etc. I got k5 authentication working fine.
Had problems with the transition kit. I think mostly because
the kerberos realm name is different from the afs cell name.
(no need to respond to this issue).

I would prefer to keep the dns/realm/afs.cell names all the same.
The only way to do this is to run one kerberos 5 server. The
linux krb5_pam module seems to work fine for authenticating
to k5 and getting afs tokens. Aklog works great also. Have tested
linux krb5_pam and apache authentication to Windows AD.

We run 3 active directory servers, currently Windows 2000
to be upgraded to 2003 very soon. We have a Windows group that
manages these machines.

I am trying to piece things together like Eric.
What we need is clear steps on how to create the Windows
AD afs/cell.name user and the proper way to export the
afs/cell.name key. Would be nice to have this for both
W2K and W2003. The linux "asetkey" man page  is real clear
on how to do this in linux, (thanks Russ).

I plan on trying to attend the AFS & Kerberos
Best Practices Workshop 2007. I am sure over the next few
months things will get more clear on this.


>=20
> In my family there are two first cousins named "Jeffrey" who were
> born two weeks apart.  Our Mothers both loved the name and refused
> to let the other use it, and so, we both got the name and our parents
> did not speak to each other for months.  We lived blocks away from
> each other and went to the same schools and of course once our parents
> got over the theft of their child's name, they started to baby sit
> for each other.  You can imagine what life was like.  Any one parent
> would call out "Jeffrey" and never know which kid they were going to
> get.  In the end, there was mutual agreement that when both of the
> Jeffreys were present that we would be called by our middle names.
> Hence, I became Eric and he became Alan.  (This worked just fine
> except when our second cousin Alan came to visit but that is a =
different
> story.)
>=20
> The point is that your clients and services are always going to be
> confused if you have two realms with the same name and no other
> mechanism by which they can be identified.  Now, because of the desire
> to have peer-to-peer realms, there is some discussion about developing
> a public key identifier that would turn the realm name into a display
> name.  However, its not even specified yet let alone a standard and =
you
> wouldn't see it deployed in a Microsoft OS for ten years so there is
> little point in considering it.
>=20
> Microsoft knows that many Windows 2000 domains were installed using
> the same name as MIT Kerberos realms but at the time Windows domains
> really did not handle having a name different from the DNS domain.
> With the release of Windows 2003, Microsoft fixed the issues with =
Domain
> names vs DNS names and also provided a tool that can be used to rename
> the Windows domain.  The procedure is painful but it is better than
> running two realms with the same name.
>=20
> Once the Windows domain has been renamed you can:
>=20
>  * Create a Windows domain account called "AFS.CS.UNC.EDU"
>  * Use setspn to assign a service principal name to the account
>      setspn -A afs/cs.unc.edu  AFS.CS.UNC.EDU
>  * Use a working (non-2003 SP1) version of ktpass to export the key
>    The 2003 SP1 Support Tools version is 5.2.3790.1830.  Do not use =
it.
>    The Vista version has not been released yet.  It is supposed to be
>    published under KB926036.  I suspect we will see it on Jan 30.
>=20
>    ktpass -out <keytab> -princ afs/cs.unc.edu@WIN.CS.UNC.EDU \
>       -crypto DES-CBC-CRC +rndPass -DesOnly
>=20
>    The vista version of ktpass will allow you to:
>      -DumpSalt to have it display the salt that was used
>      -RawSalt <salt>  to specify a specific salt
>      -SetUPN to set the user principal name in addition to the Service
>              Principal Name
>      -SetPass to set a user account password
>    as well as supporting the new AES crypto types.
>  * copy the keytab to your AFS servers and import the key with asetkey
>=20
> The reason that ktutil could be used to generate the keytab was that
> the password for the service principal was known.  Therefore, ktutil
> didn't have to query the Kerberos database.
>=20
> Jeffrey Altman
>=20
>=20
>=20
> John W. Sopko Jr. wrote:
>> I have been following this thread. I also want to test our Windows AD =
for
>> authentication. I have tested a krb5 server on linux and am familiar =
with
>> generating a keytab/KeyFile for the afs/cell.name service principal =
using
>> kadmin and asetkey. I got a bit confused with your Windows AD =
procedure.
>> Could you please summarize and post the steps you used including =
command
>> line options.
>>
>> For example, one  thread says you ran ktutil on linux not Windows but =
as
>> far as I know ktutil on linux is used to manipulate keytabs files not
>> export keys from the krb5 principal database. Looks like you =
basically
>> did this:
>>
>> - Create Windows AD user afs/cell.name user with "DES" key only
>> - Used Microsoft 2003 SP1 ktpass.exe to export the afs/cell.name to a
>> keytab
>> - Used OpenAFS asetkey to import keytab to /usr/afs/etc/KeyFile
>> - This did not work
>> - You then used ktutil.exe on Windows to to export the afs/cell.name =
to
>> a keytab
>> - Used OpenAFS asetkey to import keytab to /usr/afs/etc/KeyFile
>> - Success
>> - Appears to be some issue with Microsoft 2003 SP1 ktpass.exe
>>
>> Which ktutil command did you run, on Windows or L/Uinux?
>> Where did you get the ktutil command for Windows?
>> Did you upgrade to a Microsoft ktpass.exe that worked?
>>
>> Appreciate the info and the time you saved us!
>>
>> I would prefer to run the MIT K5 server on linux for OpenAFS but I =
bet
>> others have the same issue I have. Our Windows machines run in the =
same
>> DNS domain as our L/Unix machines. The Windows folks have been =
running
>> AD under our DNS/cell.name/realm name for sometime. Our afs cellname
>> is the same as our DNS name. I have tested using a different KRB =
realm
>> name and using the "domain_realm" mapping, it gets confusing to have =
2
>> kerberos realm names in the same DNS domain. It does not make sense =
to
>> run 2 different krb5 servers for authentication.
>>
>>
>>> Date: Wed, 3 Jan 2007 16:40:33 +0100
>>> From: =3D?iso-8859-1?Q?L=3DF6nroth_Erik?=3D =
<erik.lonroth@scania.com>
>>> To: =3D?iso-8859-1?Q?L=3DF6nroth_Erik?=3D <erik.lonroth@scania.com>,
>>>     "Jeffrey Altman" <jaltman@secure-endpoints.com>
>>> Cc: <openafs-info@openafs.org>
>>> Subject: RE: [OpenAFS] Active Directory 2003, kerberos 5, openAFS -
>>> rxkad error=3D19270407, arghhhh
>>>
>>> This is a multi-part message in MIME format.
>>>
>>> ------_=3D_NextPart_001_01C72F4D.B4C63582
>>> Content-Type: text/plain;
>>>     charset=3D"iso-8859-1"
>>> Content-Transfer-Encoding: quoted-printable
>>>
>>> Correction on that:
>>>
>>> The "ktutil" was run on the linux host! (not windows)
>>>
>>> But still... the ktpass.exe gives me bogus keyfiles.
>>>
>>> /Erik
>>>
>>>
>>> -----Original Message-----
>>> From: openafs-info-admin@openafs.org on behalf of L=3DF6nroth Erik
>>> Sent: Wed 1/3/2007 4:34 PM
>>> To: Jeffrey Altman
>>> Cc: openafs-info@openafs.org
>>> Subject: RE: [OpenAFS] Active Directory 2003, kerberos 5, openAFS - =
=3D
>>> rxkad error=3D3D19270407, arghhhh
>>> =3D20
>>> OK, I believe have resolved the problem now after 5 whole days of =
trial =3D
>>> and error.
>>>
>>> It turns out that using the "KTPASS" native from Active Directory =
=3D
>>> generates keys that is not liked by AFS.
>>>
>>> I instead used ktutil.exe (for windows) to generate my key that I =
then =3D
>>> imported as usual into AFS. =3D20
>>>
>>> On Microsoft AD side:
>>>
>>>> ktutil
>>> ktutil: addent -password -p afs/sss.se.scania.com@LAB.SCANIA.COM -k =
9
>>> -e =3D
>>> des-cbc-crc
>>> ktutil: wkt ./keytab.file
>>> ktutil: quit=3D20
>>>
>>> This file is then copied to linux and imported exactly as I would =
=3D
>>> normally:
>>>
>>> asetkey add 9 keytab.file afs/sss.se.scania.com
>>>
>>> Now - everything works=3D20
>>>
>>> kinit sssler
>>> aklog
>>> touch /afs/sss.se.scania.com/home/sssler/somefile
>>> ls /afs/sss.se.scania.com/home/sssler/somefile
>>>  /afs/sss.se.scania.com/home/sssler/somefile
>>>
>>> Success!
>>>
>>> I verified this by behaviour - AGAIN - by using the "KTPASS.EXE" =3D
>>> (without changing anything else) and importing the key with =
"asetkey"
>>> as =3D
>>> normal.
>>>
>>> C:\ktpass -out afs-keytab-md5-verify -princ =3D
>>> afs/sss.se.scania.com@LAB.SCANIA.COM -mapuser afs -crypto =
DES-CBC-CRC  =3D
>>> -pass *
>>> Targeting domain controller: SeSoCoLab11.scania.se
>>> Successfully mapped afs/sss.se.scania.com to afs.
>>> Type the password for afs/sss.se.scania.com:
>>> Type the password again to confirm:
>>> WARNING: pType and account type do not match. This might cause  =3D
>>> problems.
>>> Key created.
>>> Output keytab to afs-keytab-md5-verify:
>>> Keytab version: 0x502
>>> keysize 63 afs/sss.se.scania.com@LAB.SCANIA.COM ptype 0 =3D
>>> (KRB5_NT_UNKNOWN) vno 9
>>> etype 0x1 (DES-CBC-CRC) keylength 8 (0xbff2e56b29943d3e)
>>>
>>> (Again publishing the key to the whole world ;-)=3D20
>>>
>>> ... and - using this key in AFS - I get the same error again : rxkad =
=3D
>>> error=3D3D19270407
>>>
>>> I swapped back again to the key generated by ktutil.exe - and it =
works =3D
>>> again.
>>>
>>> It seems that using the KTPASS.EXE generates bogus keys for me!
>>>
>>> I have not read this anywhere and I have read pretty much everyting,
>>> did =3D
>>> I miss something critical here or is this a bug/feature?
>>>
>>> /Erik
>>>
>>>

--=20
John W. Sopko Jr.               University of North Carolina
email: sopko AT cs.unc.edu      Computer Science Dept., CB 3175
Phone: 919-962-1844             Sitterson Hall; Room 044
Fax:   919-962-1799             Chapel Hill, NC 27599-3175


------_=_NextPart_001_01C73301.645A4E28
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
6.5.7650.28">
<TITLE>RE: [OpenAFS] Active Directory 2003, kerberos 5, openAFS - rxkad =
error=3D19270407, arghhhh</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>

<P><FONT SIZE=3D2>&quot; I am trying to piece things together like =
Eric.<BR>
What we need is clear steps on how to create the Windows<BR>
AD afs/cell.name user and the proper way to export the<BR>
afs/cell.name key. Would be nice to have this for both<BR>
W2K and W2003. The linux &quot;asetkey&quot; man page&nbsp; is real =
clear<BR>
on how to do this in linux, (thanks Russ). &quot;<BR>
<BR>
What we do now is that we have replaced the ktpass from WIN2003, SP1 =
with a working one.<BR>
We had big problems with a version that generated unusable tickets that =
gave us the annoying:&nbsp;<BR>
<BR>
rxkad error=3D19270407<BR>
<BR>
We basically follwed the procedure:<BR>
<BR>
* Create AFS user in AD and set correct options. &quot;Des only&quot;, =
&quot;Delegate Service&quot;, &quot;Password dont expires&quot;, =
&quot;dont change at first login&quot;.<BR>
<BR>
* Export keytab with &quot;ktpass.exe&quot;, just make sure its not the =
version windows 2003,SP1.<BR>
<BR>
* Import it to your AFS:cell(s) with &quot;asetkey&quot;. (You might =
need to restart the openAFS server, I'm not sure.)<BR>
<BR>
The thing that made this difficult for us was to find out about the =
WIN2003,SP1 bugg.<BR>
<BR>
/Erik<BR>
<BR>
-----Original Message-----<BR>
From: John W. Sopko Jr. [<A =
HREF=3D"mailto:sopko@cs.unc.edu">mailto:sopko@cs.unc.edu</A>]<BR>
Sent: Fri 1/5/2007 5:39 PM<BR>
To: jaltman@secure-endpoints.com<BR>
Cc: openafs; L=F6nroth Erik<BR>
Subject: Re: [OpenAFS] Active Directory 2003, kerberos 5, openAFS - =
rxkad error=3D19270407, arghhhh<BR>
<BR>
<BR>
<BR>
Jeffrey Altman wrote:<BR>
&gt; John:<BR>
&gt;<BR>
&gt; unless you plan to get rid of the MIT realm and move all of =
your<BR>
&gt; principals to active directory, you are going to have to rename<BR>
&gt; one of the Kerberos realms.<BR>
<BR>
I should have been more clear. I am only running a TEST<BR>
krb5 1.4.4 server under linux. I am still running kaserver.<BR>
Like lots of folks looking to migrate to K5, have been for<BR>
years.<BR>
<BR>
Our test linux/krb5 server has a different kerberos realm name<BR>
then the Windows realm name. I am not attempting/planning to run<BR>
2 kdc's with the same REALM name. We setup different DNS records<BR>
to find the kdc's etc. I got k5 authentication working fine.<BR>
Had problems with the transition kit. I think mostly because<BR>
the kerberos realm name is different from the afs cell name.<BR>
(no need to respond to this issue).<BR>
<BR>
I would prefer to keep the dns/realm/afs.cell names all the same.<BR>
The only way to do this is to run one kerberos 5 server. The<BR>
linux krb5_pam module seems to work fine for authenticating<BR>
to k5 and getting afs tokens. Aklog works great also. Have tested<BR>
linux krb5_pam and apache authentication to Windows AD.<BR>
<BR>
We run 3 active directory servers, currently Windows 2000<BR>
to be upgraded to 2003 very soon. We have a Windows group that<BR>
manages these machines.<BR>
<BR>
I am trying to piece things together like Eric.<BR>
What we need is clear steps on how to create the Windows<BR>
AD afs/cell.name user and the proper way to export the<BR>
afs/cell.name key. Would be nice to have this for both<BR>
W2K and W2003. The linux &quot;asetkey&quot; man page&nbsp; is real =
clear<BR>
on how to do this in linux, (thanks Russ).<BR>
<BR>
I plan on trying to attend the AFS &amp; Kerberos<BR>
Best Practices Workshop 2007. I am sure over the next few<BR>
months things will get more clear on this.<BR>
<BR>
<BR>
&gt;<BR>
&gt; In my family there are two first cousins named &quot;Jeffrey&quot; =
who were<BR>
&gt; born two weeks apart.&nbsp; Our Mothers both loved the name and =
refused<BR>
&gt; to let the other use it, and so, we both got the name and our =
parents<BR>
&gt; did not speak to each other for months.&nbsp; We lived blocks away =
from<BR>
&gt; each other and went to the same schools and of course once our =
parents<BR>
&gt; got over the theft of their child's name, they started to baby =
sit<BR>
&gt; for each other.&nbsp; You can imagine what life was like.&nbsp; Any =
one parent<BR>
&gt; would call out &quot;Jeffrey&quot; and never know which kid they =
were going to<BR>
&gt; get.&nbsp; In the end, there was mutual agreement that when both of =
the<BR>
&gt; Jeffreys were present that we would be called by our middle =
names.<BR>
&gt; Hence, I became Eric and he became Alan.&nbsp; (This worked just =
fine<BR>
&gt; except when our second cousin Alan came to visit but that is a =
different<BR>
&gt; story.)<BR>
&gt;<BR>
&gt; The point is that your clients and services are always going to =
be<BR>
&gt; confused if you have two realms with the same name and no other<BR>
&gt; mechanism by which they can be identified.&nbsp; Now, because of =
the desire<BR>
&gt; to have peer-to-peer realms, there is some discussion about =
developing<BR>
&gt; a public key identifier that would turn the realm name into a =
display<BR>
&gt; name.&nbsp; However, its not even specified yet let alone a =
standard and you<BR>
&gt; wouldn't see it deployed in a Microsoft OS for ten years so there =
is<BR>
&gt; little point in considering it.<BR>
&gt;<BR>
&gt; Microsoft knows that many Windows 2000 domains were installed =
using<BR>
&gt; the same name as MIT Kerberos realms but at the time Windows =
domains<BR>
&gt; really did not handle having a name different from the DNS =
domain.<BR>
&gt; With the release of Windows 2003, Microsoft fixed the issues with =
Domain<BR>
&gt; names vs DNS names and also provided a tool that can be used to =
rename<BR>
&gt; the Windows domain.&nbsp; The procedure is painful but it is better =
than<BR>
&gt; running two realms with the same name.<BR>
&gt;<BR>
&gt; Once the Windows domain has been renamed you can:<BR>
&gt;<BR>
&gt;&nbsp; * Create a Windows domain account called =
&quot;AFS.CS.UNC.EDU&quot;<BR>
&gt;&nbsp; * Use setspn to assign a service principal name to the =
account<BR>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; setspn -A afs/cs.unc.edu&nbsp; =
AFS.CS.UNC.EDU<BR>
&gt;&nbsp; * Use a working (non-2003 SP1) version of ktpass to export =
the key<BR>
&gt;&nbsp;&nbsp;&nbsp; The 2003 SP1 Support Tools version is =
5.2.3790.1830.&nbsp; Do not use it.<BR>
&gt;&nbsp;&nbsp;&nbsp; The Vista version has not been released =
yet.&nbsp; It is supposed to be<BR>
&gt;&nbsp;&nbsp;&nbsp; published under KB926036.&nbsp; I suspect we will =
see it on Jan 30.<BR>
&gt;<BR>
&gt;&nbsp;&nbsp;&nbsp; ktpass -out &lt;keytab&gt; -princ =
afs/cs.unc.edu@WIN.CS.UNC.EDU \<BR>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -crypto DES-CBC-CRC +rndPass =
-DesOnly<BR>
&gt;<BR>
&gt;&nbsp;&nbsp;&nbsp; The vista version of ktpass will allow you =
to:<BR>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -DumpSalt to have it display the salt =
that was used<BR>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -RawSalt &lt;salt&gt;&nbsp; to =
specify a specific salt<BR>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -SetUPN to set the user principal =
name in addition to the Service<BR>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp; Principal Name<BR>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -SetPass to set a user account =
password<BR>
&gt;&nbsp;&nbsp;&nbsp; as well as supporting the new AES crypto =
types.<BR>
&gt;&nbsp; * copy the keytab to your AFS servers and import the key with =
asetkey<BR>
&gt;<BR>
&gt; The reason that ktutil could be used to generate the keytab was =
that<BR>
&gt; the password for the service principal was known.&nbsp; Therefore, =
ktutil<BR>
&gt; didn't have to query the Kerberos database.<BR>
&gt;<BR>
&gt; Jeffrey Altman<BR>
&gt;<BR>
&gt;<BR>
&gt;<BR>
&gt; John W. Sopko Jr. wrote:<BR>
&gt;&gt; I have been following this thread. I also want to test our =
Windows AD for<BR>
&gt;&gt; authentication. I have tested a krb5 server on linux and am =
familiar with<BR>
&gt;&gt; generating a keytab/KeyFile for the afs/cell.name service =
principal using<BR>
&gt;&gt; kadmin and asetkey. I got a bit confused with your Windows AD =
procedure.<BR>
&gt;&gt; Could you please summarize and post the steps you used =
including command<BR>
&gt;&gt; line options.<BR>
&gt;&gt;<BR>
&gt;&gt; For example, one&nbsp; thread says you ran ktutil on linux not =
Windows but as<BR>
&gt;&gt; far as I know ktutil on linux is used to manipulate keytabs =
files not<BR>
&gt;&gt; export keys from the krb5 principal database. Looks like you =
basically<BR>
&gt;&gt; did this:<BR>
&gt;&gt;<BR>
&gt;&gt; - Create Windows AD user afs/cell.name user with =
&quot;DES&quot; key only<BR>
&gt;&gt; - Used Microsoft 2003 SP1 ktpass.exe to export the =
afs/cell.name to a<BR>
&gt;&gt; keytab<BR>
&gt;&gt; - Used OpenAFS asetkey to import keytab to =
/usr/afs/etc/KeyFile<BR>
&gt;&gt; - This did not work<BR>
&gt;&gt; - You then used ktutil.exe on Windows to to export the =
afs/cell.name to<BR>
&gt;&gt; a keytab<BR>
&gt;&gt; - Used OpenAFS asetkey to import keytab to =
/usr/afs/etc/KeyFile<BR>
&gt;&gt; - Success<BR>
&gt;&gt; - Appears to be some issue with Microsoft 2003 SP1 =
ktpass.exe<BR>
&gt;&gt;<BR>
&gt;&gt; Which ktutil command did you run, on Windows or L/Uinux?<BR>
&gt;&gt; Where did you get the ktutil command for Windows?<BR>
&gt;&gt; Did you upgrade to a Microsoft ktpass.exe that worked?<BR>
&gt;&gt;<BR>
&gt;&gt; Appreciate the info and the time you saved us!<BR>
&gt;&gt;<BR>
&gt;&gt; I would prefer to run the MIT K5 server on linux for OpenAFS =
but I bet<BR>
&gt;&gt; others have the same issue I have. Our Windows machines run in =
the same<BR>
&gt;&gt; DNS domain as our L/Unix machines. The Windows folks have been =
running<BR>
&gt;&gt; AD under our DNS/cell.name/realm name for sometime. Our afs =
cellname<BR>
&gt;&gt; is the same as our DNS name. I have tested using a different =
KRB realm<BR>
&gt;&gt; name and using the &quot;domain_realm&quot; mapping, it gets =
confusing to have 2<BR>
&gt;&gt; kerberos realm names in the same DNS domain. It does not make =
sense to<BR>
&gt;&gt; run 2 different krb5 servers for authentication.<BR>
&gt;&gt;<BR>
&gt;&gt;<BR>
&gt;&gt;&gt; Date: Wed, 3 Jan 2007 16:40:33 +0100<BR>
&gt;&gt;&gt; From: =3D?iso-8859-1?Q?L=3DF6nroth_Erik?=3D =
&lt;erik.lonroth@scania.com&gt;<BR>
&gt;&gt;&gt; To: =3D?iso-8859-1?Q?L=3DF6nroth_Erik?=3D =
&lt;erik.lonroth@scania.com&gt;,<BR>
&gt;&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp; &quot;Jeffrey Altman&quot; =
&lt;jaltman@secure-endpoints.com&gt;<BR>
&gt;&gt;&gt; Cc: &lt;openafs-info@openafs.org&gt;<BR>
&gt;&gt;&gt; Subject: RE: [OpenAFS] Active Directory 2003, kerberos 5, =
openAFS -<BR>
&gt;&gt;&gt; rxkad error=3D19270407, arghhhh<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; This is a multi-part message in MIME format.<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; ------_=3D_NextPart_001_01C72F4D.B4C63582<BR>
&gt;&gt;&gt; Content-Type: text/plain;<BR>
&gt;&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp; =
charset=3D&quot;iso-8859-1&quot;<BR>
&gt;&gt;&gt; Content-Transfer-Encoding: quoted-printable<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; Correction on that:<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; The &quot;ktutil&quot; was run on the linux host! (not =
windows)<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; But still... the ktpass.exe gives me bogus keyfiles.<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; /Erik<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; -----Original Message-----<BR>
&gt;&gt;&gt; From: openafs-info-admin@openafs.org on behalf of =
L=3DF6nroth Erik<BR>
&gt;&gt;&gt; Sent: Wed 1/3/2007 4:34 PM<BR>
&gt;&gt;&gt; To: Jeffrey Altman<BR>
&gt;&gt;&gt; Cc: openafs-info@openafs.org<BR>
&gt;&gt;&gt; Subject: RE: [OpenAFS] Active Directory 2003, kerberos 5, =
openAFS - =3D<BR>
&gt;&gt;&gt; rxkad error=3D3D19270407, arghhhh<BR>
&gt;&gt;&gt; =3D20<BR>
&gt;&gt;&gt; OK, I believe have resolved the problem now after 5 whole =
days of trial =3D<BR>
&gt;&gt;&gt; and error.<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; It turns out that using the &quot;KTPASS&quot; native from =
Active Directory =3D<BR>
&gt;&gt;&gt; generates keys that is not liked by AFS.<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; I instead used ktutil.exe (for windows) to generate my key =
that I then =3D<BR>
&gt;&gt;&gt; imported as usual into AFS. =3D20<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; On Microsoft AD side:<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt;&gt; ktutil<BR>
&gt;&gt;&gt; ktutil: addent -password -p =
afs/sss.se.scania.com@LAB.SCANIA.COM -k 9<BR>
&gt;&gt;&gt; -e =3D<BR>
&gt;&gt;&gt; des-cbc-crc<BR>
&gt;&gt;&gt; ktutil: wkt ./keytab.file<BR>
&gt;&gt;&gt; ktutil: quit=3D20<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; This file is then copied to linux and imported exactly as I =
would =3D<BR>
&gt;&gt;&gt; normally:<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; asetkey add 9 keytab.file afs/sss.se.scania.com<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; Now - everything works=3D20<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; kinit sssler<BR>
&gt;&gt;&gt; aklog<BR>
&gt;&gt;&gt; touch /afs/sss.se.scania.com/home/sssler/somefile<BR>
&gt;&gt;&gt; ls /afs/sss.se.scania.com/home/sssler/somefile<BR>
&gt;&gt;&gt;&nbsp; /afs/sss.se.scania.com/home/sssler/somefile<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; Success!<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; I verified this by behaviour - AGAIN - by using the =
&quot;KTPASS.EXE&quot; =3D<BR>
&gt;&gt;&gt; (without changing anything else) and importing the key with =
&quot;asetkey&quot;<BR>
&gt;&gt;&gt; as =3D<BR>
&gt;&gt;&gt; normal.<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; C:\ktpass -out afs-keytab-md5-verify -princ =3D<BR>
&gt;&gt;&gt; afs/sss.se.scania.com@LAB.SCANIA.COM -mapuser afs -crypto =
DES-CBC-CRC&nbsp; =3D<BR>
&gt;&gt;&gt; -pass *<BR>
&gt;&gt;&gt; Targeting domain controller: SeSoCoLab11.scania.se<BR>
&gt;&gt;&gt; Successfully mapped afs/sss.se.scania.com to afs.<BR>
&gt;&gt;&gt; Type the password for afs/sss.se.scania.com:<BR>
&gt;&gt;&gt; Type the password again to confirm:<BR>
&gt;&gt;&gt; WARNING: pType and account type do not match. This might =
cause&nbsp; =3D<BR>
&gt;&gt;&gt; problems.<BR>
&gt;&gt;&gt; Key created.<BR>
&gt;&gt;&gt; Output keytab to afs-keytab-md5-verify:<BR>
&gt;&gt;&gt; Keytab version: 0x502<BR>
&gt;&gt;&gt; keysize 63 afs/sss.se.scania.com@LAB.SCANIA.COM ptype 0 =
=3D<BR>
&gt;&gt;&gt; (KRB5_NT_UNKNOWN) vno 9<BR>
&gt;&gt;&gt; etype 0x1 (DES-CBC-CRC) keylength 8 =
(0xbff2e56b29943d3e)<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; (Again publishing the key to the whole world ;-)=3D20<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; ... and - using this key in AFS - I get the same error =
again : rxkad =3D<BR>
&gt;&gt;&gt; error=3D3D19270407<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; I swapped back again to the key generated by ktutil.exe - =
and it works =3D<BR>
&gt;&gt;&gt; again.<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; It seems that using the KTPASS.EXE generates bogus keys for =
me!<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; I have not read this anywhere and I have read pretty much =
everyting,<BR>
&gt;&gt;&gt; did =3D<BR>
&gt;&gt;&gt; I miss something critical here or is this a =
bug/feature?<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt; /Erik<BR>
&gt;&gt;&gt;<BR>
&gt;&gt;&gt;<BR>
<BR>
--<BR>
John W. Sopko =
Jr.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp; University of North Carolina<BR>
email: sopko AT cs.unc.edu&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Computer =
Science Dept., CB 3175<BR>
Phone: =
919-962-1844&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp; Sitterson Hall; Room 044<BR>
Fax:&nbsp;&nbsp; =
919-962-1799&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp; Chapel Hill, NC 27599-3175<BR>
<BR>
</FONT>
</P>

</BODY>
</HTML>
------_=_NextPart_001_01C73301.645A4E28--