[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

heimdal 0.6.5 kinit from keytab/srvtab: oddness



We noticed after upgrading to 0.6.5 that kinit didn't work reliably from
keytabs/srvtabs any more.  Some principals work, others fail.

Working principal:
kadmin> get -l audit
               Principal: audit@ECE.CMU.EDU
       Principal expires: never
        Password expires: never
    Last password change: never
         Max ticket life: 1 day 1 hour
      Max renewable life: unlimited
                    Kvno: 1
                   Mkvno: 0
                  Policy: none
   Last successful login: never
       Last failed login: never
      Failed login count: 0
           Last modified: 2000-11-13 16:24:02 UTC
                Modifier: admin@ECE.CMU.EDU
              Attributes:
Keytypes(salttype[(salt-value)]): des-cbc-crc(afs3-salt(ece.cmu.edu)), des-cbc-md4(afs3-salt(ece.cmu.edu)), des-cbc-md5(afs3-salt(ece.cmu.edu)), des3-cbc-sha1(pw-salt)

(one of many) Failing principal:

kadmin> get -l opr
               Principal: opr@ECE.CMU.EDU
       Principal expires: never
        Password expires: never
    Last password change: never
         Max ticket life: 1 day 1 hour
      Max renewable life: unlimited
                    Kvno: 6
                   Mkvno: 0
                  Policy: none
   Last successful login: never
       Last failed login: never
      Failed login count: 0
           Last modified: 2002-05-21 14:26:24 UTC
                Modifier: admin@ECE.CMU.EDU
              Attributes:
Keytypes(salttype[(salt-value)]): des3-cbc-sha1(pw-salt), des-cbc-md5(pw-salt()), des-cbc-md4(pw-salt()), des-cbc-crc(pw-salt()), des-cbc-md5(afs3-salt(ece.cmu.
edu)), des-cbc-md4(afs3-salt(ece.cmu.edu)), des-cbc-crc(afs3-salt(ece.cmu.edu))

>From here it gets kind of odd.  Here's another principal, just created
today, that we've been working with:

kadmin> get -l lsfclient
               Principal: lsfclient@ECE.CMU.EDU
       Principal expires: never
        Password expires: never
    Last password change: never
         Max ticket life: 1 day 1 hour
      Max renewable life: unlimited
                    Kvno: 1
                   Mkvno: 0
                  Policy: none
   Last successful login: never
       Last failed login: never
      Failed login count: 0
           Last modified: 2005-09-01 15:13:31 UTC
                Modifier: admin@ECE.CMU.EDU
              Attributes: disallow-postdated
Keytypes(salttype[(salt-value)]): arcfour-hmac-md5(pw-salt), des3-cbc-sha1(pw-salt), des-cbc-md5(pw-salt()), des-cbc-md4(pw-salt()), des-cbc-crc(pw-salt()), des-cbc-md5(afs3-salt(ece.cmu.edu)), des-cbc-md4(afs3-salt(ece.cmu.edu)), des-cbc-crc(afs3-salt(ece.cmu.edu))

And keytab and srvtab extracted therefrom:

lsf.keytab:

Vno  Type              Principal
  1  arcfour-hmac-md5  lsfclient@ECE.CMU.EDU
  1  des3-cbc-sha1     lsfclient@ECE.CMU.EDU
  1  des-cbc-md5       lsfclient@ECE.CMU.EDU
  1  des-cbc-md4       lsfclient@ECE.CMU.EDU
  1  des-cbc-crc       lsfclient@ECE.CMU.EDU
  1  des-cbc-md5       lsfclient@ECE.CMU.EDU
  1  des-cbc-md4       lsfclient@ECE.CMU.EDU
  1  des-cbc-crc       lsfclient@ECE.CMU.EDU

SRVTAB:lsf.srvtab:

Vno  Type         Principal
  1  des-cbc-md5  lsfclient@ECE.CMU.EDU
  1  des-cbc-md4  lsfclient@ECE.CMU.EDU
  1  des-cbc-crc  lsfclient@ECE.CMU.EDU
  1  des-cbc-md5  lsfclient@ECE.CMU.EDU
  1  des-cbc-md4  lsfclient@ECE.CMU.EDU
  1  des-cbc-crc  lsfclient@ECE.CMU.EDU

Start with the srvtab:

2@bajinaji000:511 Z# od -c lsf.srvtab
0000000   l   s   f   c   l   i   e   n   t  \0  \0   E   C   E   .   C
0000020   M   U   .   E   D   U  \0 001   � \v  \b   O   C 001      @
0000040   l   s   f   c   l   i   e   n   t  \0  \0   E   C   E   .   C
0000060   M   U   .   E   D   U  \0 001   �  �  �   224
0000100

I count only two keys there; where'd ktutil get six?

The keytab is even weirder:  after examining the above "get" lists, we
concluded that it might be a good idea to remove all the krb4 keys (the
one difference that stands out to me is that the working principal has
no krb4 keys with pw-salt, only with afs3-salt; but you can't delete
keys by salt type).  Which led to:

2@bajinaji000:512 Z# ktutil -k lsf.keytab remove -p lsfclient -e des-cbc-md5
2@bajinaji000:513 Z# ktutil -k lsf.keytab remove -p lsfclient -e des-cbc-md4
2@bajinaji000:514 Z# ktutil -k lsf.keytab remove -p lsfclient -e des-cbc-crc
2@bajinaji000:515 Z# kinit --use-keytab --keytab=/tmp/lsf.keytab -n lsfclient
kinit: krb5_get_init_creds: failed to find lsfclient@ECE.CMU.EDU in keytab /tmp/lsf.keytab
2@bajinaji000:516 Z# ktutil -k lsf.keytab list
lsf.keytab:

Vno  Type              Principal
  1  arcfour-hmac-md5  lsfclient@ECE.CMU.EDU
  1  des3-cbc-sha1     lsfclient@ECE.CMU.EDU

I'm flummoxed...

-- 
brandon s. allbery   [linux,solaris,freebsd,perl]      allbery@kf8nh.com
system administrator      [WAY too many hats]        allbery@ece.cmu.edu
electrical and computer engineering, carnegie mellon univ.         KF8NH