In regard to: Re: CentOS attempting to set up Kerberos 5-tickets created & ...:
> I have now verified that I have connections working between the two > test machines. Unfortunately it appears that I can only connect from > my server/kdc to the client machine utilizing kerberized services. > > SERVER: > KVNO Principal > ----------------------------------------- > 3 host/[EMAIL PROTECTED] > 3 host/[EMAIL PROTECTED] > 3 host/[EMAIL PROTECTED] > 3 host/[EMAIL PROTECTED] > > CLIENT: > KVNO Principal > ----------------------------------------- > 8 host/[EMAIL PROTECTED] > 8 host/[EMAIL PROTECTED] > 8 host/[EMAIL PROTECTED] > 8 host/[EMAIL PROTECTED] > 4 host/[EMAIL PROTECTED]@MYDOMAIN.COM > 4 host/[EMAIL PROTECTED]@MYDOMAIN.COM > 4 host/[EMAIL PROTECTED]@MYDOMAIN.COM > 4 host/[EMAIL PROTECTED]@MYDOMAIN.COM You have several problems here. Working in generalities, as you have been, also hasn't made this issue any more straightforward to explain. - the keytabs should only hold entries for the name(s) by which *that particular system* is known. Your kdc should NOT have an /etc/krb5.keytab with entries for any of your clients. The kdc should only have entries in its keytab for any of its names. Likewise, each of your clients should only have entries for the name(s) by which that particular client is known. They absolutely should NOT have the KDC's host/ entries in their /etc/krb5.keytab. - Each time you extract a principal to a keytab (with ktadd), the key version number (kvno) is incremented. That essentially invalidates the previous key version number. The current key version number can be seen by looking up the entry in the KDC. It has to match what's in your keytab, or the keytab won't work. So, you need to: - delete all the host/myclient.mydomain.com entries from your server's keytab. You might as well just rm the KDC's keytab and start over. - delete all the host/[EMAIL PROTECTED] entries in your client keytab, leaving just the kvno 8 host/myclient.mydomain.com entries in that keytab. You do keytab manipulation with ktutil. It has an odd interface. You'll probably want to do something like sudo /usr/kerberos/sbin/ktutil # within ktutil, you do this read_kt /etc/krb5.keytab delent 5 delent 5 delent 5 delent 5 list write_kt /etc/krb5.keytab quit - Your server's host principal looks wrong to me. If the server's DNS name is myserver.mydomain.com and your only krb5 realm is MYDOMAIN.COM, then its host principal should be host/[EMAIL PROTECTED] The host/[EMAIL PROTECTED]@MYDOMAIN.COM is likely incorrect. Once you've created host/myserver.mydomain.com in the MYDOMAIN.COM realm (using kadmin), use getprinc on that entry, and note the kvno. It will likely be 1. Note also how many keys there are for it (my guess is there will be four). - On the kdc itself, extract that principal to the keytab, using the ktadd command within kadmin. After you've extracted the keys to the keytab, use getprinc again on that principal, and note the kvno. It should have incremented by one. - Examine the keytab with ktutil. It should have only entries for host/[EMAIL PROTECTED] and the kvno should match the kvno that you found with getprinc. Once the keytab is correct on the KDC, the services that you've set up on the KDC (krb5-telnet, eklogin, etc.) should now work. Tim -- Tim Mooney [EMAIL PROTECTED] Information Technology Services (701) 231-1076 (Voice) Room 242-J6, IACC Building (701) 231-8541 (Fax) North Dakota State University, Fargo, ND 58105-5164 ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos