Re: heimdal 0.7.2 with Windows 2003 KDC

["Douglas E. Engert" <deengert@anl.gov>]

michel.brabants@euphonynet.be wrote:

> Hello,
> 
> some more information: when I type in a wrong password, I het
> "pre-authentication failed". When I type in the correct password, I get
> password incorrect.

Have you looked at a network trace? Ethereal can decode the KRB5 packets.
http://www.ethereal.com

Note that Windows treats the user as is case insensitive, but the salt
is case sensitive.   So to Windows User@REALM is the same as user@REALM.


> 
> Thank you and greetings,
> 
> Michel
> 
> 
>>Hello,
>>
>>I found the following interesting page -
>>http://searchwindowssecurity.techtarget.com/originalContent/0,289142,sid45_gci1014058,00.html
>>, which describes encryption-capabilities of windows 2000 and windows 2003
>>with regard to kerberos. It also contains other information regarding
>>their kerberos-implementations. I hope this is usefull to people.
>>
>>Greetings,
>>
>>Michel
>>
>>P.S: My questions are still open, but I'm looking how to detect if
>>pre-authentication is enabled or not.

Ethereal would show this.

>>
>>
>>>Hello,
>>>
>>>I'm trying to authenticate to a Windows 2003 KDC using kinit from
>>>heimdal
>>>0.7.2 on linux. My loginname is recognized, but I continuously get
>>>password incorrect, while I'm 99% sure that it is ok. I read that I
>>>should
>>>force DES, which didn't help. The samba docs said that with heimdal
>>>
>>>>0.6,
>>>
>>>you shouldn't force DES, which also didn't help.
>>>
>>>Is ther an incompability at the moment? I had the impression that
>>>heindal
>>>0.6.x worked, but I can't compile heimdal 0.6.6 with gcc 4.0.3.
>>>
>>>Any idea, if there is already a fix for this or if this is a known
>>>issue?
>>>
>>>Thank you,
>>>
>>>Michel
>>>
>>>P.s.: Is there a way to enbale logging for kinit?
>>>
>>>
>>
>>
>>
> 
> 

-- 

  Douglas E. Engert  <DEEngert@anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444