>>>>> "jonr" == jonr <[EMAIL PROTECTED]> writes:
jonr> Quoting "Richard E. Silverman" <[EMAIL PROTECTED]>: >> >>>>> "jonr" == jonr <[EMAIL PROTECTED]> writes: >> jonr> I have a slave kdc and am trying to get the master to kprop the jonr> db to the slave. I continually get this error: kprop: Decrypt jonr> integrity check failed while getting initial ticket >> >> >> >> From what I have read it is a wrong password for one of the >> hosts >> in the jonr> database. >> No; the problem here is probably the key of the master kdc's host >> principal, on the slave. The slave uses it to authenticate the >> peer and compare to kpropd.conf, which lists the hosts allowed to >> update the slave's copy of the KDB. jonr> Thanks for the help Richard, I have been slowly slipping into jonr> madness trying to grasp kerberos. The file that the slave looks jonr> in to validate is the kadm5.keytab file, is that correct? No; at least, in my setup, kpropd looks in the system keytab /etc/krb5.keytab (or similar). kadm5.keytab is for kadmin(d), a different set of programs. jonr> I have tried scp'ing this file to my slave thinking that would have the jonr> correct permissions, this did not work, same error. jonr> How do I fix this error? Actually, I misspoke above. I should have said: the problem is likely that the master kdc's host principal key stored in the KDB does not match the one in the its system keytab. kprop does a kinit with the host principal, and then uses that to obtain a ticket for the slave host, in order to authenticate itself to kpropd on the slave. The error means that it could not decrypt the KDC's response with its key, indicating a mismatch. Check the key version number: # klist -k /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 14 host/[EMAIL PROTECTED] $ kvno host/[EMAIL PROTECTED] host/[EMAIL PROTECTED]: kvno = 14 Make sure they match. If they don't, re-extact the key: # kadmin Password for you/[EMAIL PROTECTED]: kadmin: ktadd -k /etc/krb5.keytab host/[EMAIL PROTECTED] -- Richard Silverman [EMAIL PROTECTED] ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos