Sorry, the strange case is: gmazza2@futurama:~$ kinit gma...@ic.ac.uk Password for gma...@ic.ac.uk: debug3: Received SSH2_MSG_IGNORE debug3: Received SSH2_MSG_IGNORE debug3: Received SSH2_MSG_IGNORE debug3: Received SSH2_MSG_IGNORE debug3: Received SSH2_MSG_IGNORE debug3: Received SSH2_MSG_IGNORE debug3: Received SSH2_MSG_IGNORE debug3: Received SSH2_MSG_IGNORE
gmazza2@futurama:~$ klist -e Ticket cache: FILE:/tmp/krb5cc_868_M0Lmlr Default principal: gma...@ic.ac.uk Valid starting Expires Service principal 16/06/16 14:17:44 17/06/16 00:17:44 krbtgt/ic.ac...@ic.ac.uk renew until 17/06/16 00:17:44, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 - it does not work: gmazza2@futurama:~$ ssh gmazza@futurama uptime gmazza@futurama's password: debug3: Received SSH2_MSG_IGNORE - however there are gmazza's tickets: gmazza2@futurama:~$ klist -e Ticket cache: FILE:/tmp/krb5cc_868_M0Lmlr Default principal: gma...@ic.ac.uk Valid starting Expires Service principal 16/06/16 14:17:44 17/06/16 00:17:44 krbtgt/ic.ac...@ic.ac.uk renew until 17/06/16 00:17:44, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 16/06/16 14:18:05 17/06/16 00:17:44 krbtgt/doc.ic.ac...@ic.ac.uk renew until 17/06/16 00:17:44, Etype (skey, tkt): des-cbc-crc, des-cbc-md5 16/06/16 14:18:05 17/06/16 00:17:44 host/futurama.doc.ic.ac...@doc.ic.ac.uk Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 - it does work: gmazza2@futurama:~$ ssh gmazza@futurama uptime 14:18:17 up 21:46, 2 users, load average: 0.00, 0.01, 0.05 In my previous email I had copied and pasted a wrong case, i.e. gmazza2@futurama:~$ ssh gmazza2@futurama that it does not work as expected, because I had kinit-ed gma...@ic.ac.uk Giuseppe. On 16/06/16 14:09, Giuseppe Mazza wrote: > (I apologize for my long email) > > I am going to try to provide some feedback: > # > # my (not) working scenario... > # > 1] Linux kerberos server: > Ubuntu 14.04.4 LTS \n \l > ii krb5-kdc 1.12+dfsg-2ub amd64 MIT Kerberos key > server (KDC) > > 2.a] Ubuntu 16.04 linux client, called futurama.doc.ic.ac.uk: > ii krb5-user 1.13.2+dfsg-5 amd64 Basic programs to > authenticate using MIT K > > > 2.b] Ubuntu 14.04 linux client, called bee.doc.ic.ac.uk: > ii krb5-user 1.12+dfsg-2ub amd64 Basic programs to > authenticate using MIT > > 3] same /etc/krb5.conf on both clients, i.e. no hardcoded hostnames of > my dc's. > > 4] I will be using my two accounts, gma...@ic.ac.uk (user in the Windows > DC) and gmaz...@doc.ic.ac.uk (user in kerberos realm). > > The things I will describe work for bee.doc.ic.ac.uk, but not > for futurama.doc.ic.ac.uk. In particular I have noticed the things below: > > - it works: > gmazza2@futurama:~$ ssh gmazza2@futurama > > - it does not work: > gmazza2@futurama:~$ ssh gmazza@futurama > gmazza@futurama's password: > Permission denied, please try again. > gmazza@futurama's password: > > - it works: > gmazza2@futurama:~$ export KRB5_TRACE=/dev/stdout > gmazza2@futurama:~$ kinit gma...@ic.ac.uk > [325] 1466081998.890390: Getting initial credentials for gma...@ic.ac.uk > [325] 1466081998.890912: Sending request (169 bytes) to IC.AC.UK > [325] 1466081998.894103: Resolving hostname icads43.ic.ac.uk. > [325] 1466081998.896228: Sending initial UDP request to dgram > 129.31.100.150:88 > [325] 1466081998.899013: Received answer (174 bytes) from dgram > 129.31.100.150:88 > [325] 1466081998.900138: Response was not from master KDC > [325] 1466081998.900216: Received error from KDC: -1765328359/Additional > pre-authentication required > [325] 1466081998.900281: Processing preauth types: 16, 15, 19, 2 > [325] 1466081998.900308: Selected etype info: etype aes256-cts, salt > "IC.AC.UKgmazza", params "" > Password for gma...@ic.ac.uk: debug3: Received SSH2_MSG_IGNORE > debug3: Received SSH2_MSG_IGNORE > debug3: Received SSH2_MSG_IGNORE > debug3: Received SSH2_MSG_IGNORE > debug3: Received SSH2_MSG_IGNORE > debug3: Received SSH2_MSG_IGNORE > debug3: Received SSH2_MSG_IGNORE > debug3: Received SSH2_MSG_IGNORE > > [325] 1466082004.103603: AS key obtained for encrypted timestamp: > aes256-cts/1F56 > [325] 1466082004.103637: Encrypted timestamp (for 1466082003.328534): > plain 301AA011180F32303136303631363133303030335AA1050203050356, > encrypted > C915E62DB9E0CE17F45BA2FDABB44DEF69EF02DAE0ADF1138204A1D114B27FF0AE505BB410C1FCB00E0F31BFE6939ED3E7B2C68B9C52FDA4 > > [325] 1466082004.103654: Preauth module encrypted_timestamp (2) (real) > returned: 0/Success > [325] 1466082004.103657: Produced preauth for next request: 2 > [325] 1466082004.103668: Sending request (247 bytes) to IC.AC.UK > [325] 1466082004.106120: Resolving hostname icads39.ic.ac.uk. > [325] 1466082004.106383: Sending initial UDP request to dgram > 155.198.63.21:88 > [325] 1466082004.110203: Received answer (88 bytes) from dgram > 155.198.63.21:88 > [325] 1466082004.111234: Response was not from master KDC > [325] 1466082004.111262: Received error from KDC: -1765328332/Response > too big for UDP, retry with TCP > [325] 1466082004.111268: Request or response is too big for UDP; > retrying with TCP > [325] 1466082004.111281: Sending request (247 bytes) to IC.AC.UK (tcp only) > [325] 1466082004.112344: Resolving hostname icads44.ic.ac.uk. > [325] 1466082004.113626: Initiating TCP connection to stream 129.31.47.2:88 > [325] 1466082004.114123: Sending TCP request to stream 129.31.47.2:88 > [325] 1466082004.117400: Received answer (2689 bytes) from stream > 129.31.47.2:88 > [325] 1466082004.117416: Terminating TCP connection to stream > 129.31.47.2:88 > [325] 1466082004.118434: Response was not from master KDC > [325] 1466082004.118467: Processing preauth types: 19 > [325] 1466082004.118475: Selected etype info: etype aes256-cts, salt > "IC.AC.UKgmazza", params "" > [325] 1466082004.118480: Produced preauth for next request: (empty) > [325] 1466082004.118489: AS key determined by preauth: aes256-cts/1F56 > [325] 1466082004.118538: Decrypted AS reply; session key is: > aes256-cts/5BA4 > [325] 1466082004.118555: FAST negotiation: unavailable > [325] 1466082004.118578: Initializing FILE:/tmp/krb5cc_868_TQFkWp with > default princ gma...@ic.ac.uk > [325] 1466082004.118635: Storing gma...@ic.ac.uk -> > krbtgt/ic.ac...@ic.ac.uk in FILE:/tmp/krb5cc_868_TQFkWp > [325] 1466082004.118662: Storing config in FILE:/tmp/krb5cc_868_TQFkWp > for krbtgt/ic.ac...@ic.ac.uk: pa_type: 2 > [325] 1466082004.118684: Storing gma...@ic.ac.uk -> > krb5_ccache_conf_data/pa_type/krbtgt\/IC.AC.UK\@IC.AC.UK@X-CACHECONF: in > FILE:/tmp/krb5cc_868_TQFkWp > > gmazza2@futurama:~$ klist -e > Ticket cache: FILE:/tmp/krb5cc_868_TQFkWp > Default principal: gma...@ic.ac.uk > > Valid starting Expires Service principal > 16/06/16 14:00:04 17/06/16 00:00:04 krbtgt/ic.ac...@ic.ac.uk > renew until 17/06/16 00:00:04, Etype (skey, tkt): > aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 > > - it does not work: > gmazza2@futurama:~$ ssh gmazza2@futurama > [375] 1466082089.872003: ccselect can't find appropriate cache for > server principal host/futurama.doc.ic.ac...@doc.ic.ac.uk > [375] 1466082089.872158: Getting credentials gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk using ccache > FILE:/tmp/krb5cc_868_TQFkWp > [375] 1466082089.872299: Retrieving gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk from FILE:/tmp/krb5cc_868_TQFkWp > with result: -1765328243/Matching credential not found > [375] 1466082089.872397: Retrieving gma...@ic.ac.uk -> > krbtgt/doc.ic.ac...@doc.ic.ac.uk from FILE:/tmp/krb5cc_868_TQFkWp with > result: -1765328243/Matching credential not found > [375] 1466082089.872489: Retrieving gma...@ic.ac.uk -> > krbtgt/ic.ac...@ic.ac.uk from FILE:/tmp/krb5cc_868_TQFkWp with result: > 0/Success > [375] 1466082089.872507: Starting with TGT for client realm: > gma...@ic.ac.uk -> krbtgt/ic.ac...@ic.ac.uk > [375] 1466082089.872611: Retrieving gma...@ic.ac.uk -> > krbtgt/doc.ic.ac...@doc.ic.ac.uk from FILE:/tmp/krb5cc_868_TQFkWp with > result: -1765328243/Matching credential not found > [375] 1466082089.872628: Requesting TGT krbtgt/doc.ic.ac...@ic.ac.uk > using TGT krbtgt/ic.ac...@ic.ac.uk > [375] 1466082089.872694: Generated subkey for TGS request: aes256-cts/36BD > [375] 1466082089.872848: etypes requested in TGS request: aes256-cts, > aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, > des-cbc-crc, des, des-cbc-md4 > [375] 1466082089.873071: Encoding request body and padata into FAST request > [375] 1466082089.873237: Sending request (2863 bytes) to IC.AC.UK > [375] 1466082089.875549: Resolving hostname icads44.ic.ac.uk. > [375] 1466082089.876375: Sending initial UDP request to dgram > 129.31.47.2:88 > [375] 1466082089.878367: Received answer (311 bytes) from dgram > 129.31.47.2:88 > [375] 1466082089.879374: Response was not from master KDC > [375] 1466082089.879420: Decoding FAST response > [375] 1466082089.879497: Request or response is too big for UDP; > retrying with TCP > [375] 1466082089.879512: Sending request (2863 bytes) to IC.AC.UK (tcp > only) > [375] 1466082089.880644: Resolving hostname icads43.ic.ac.uk. > [375] 1466082089.881101: Initiating TCP connection to stream > 129.31.100.150:88 > [375] 1466082089.881629: Sending TCP request to stream 129.31.100.150:88 > [375] 1466082089.883386: Received answer (2758 bytes) from stream > 129.31.100.150:88 > [375] 1466082089.883408: Terminating TCP connection to stream > 129.31.100.150:88 > [375] 1466082089.884435: Response was not from master KDC > [375] 1466082089.884481: Decoding FAST response > [375] 1466082089.884661: FAST reply key: aes256-cts/C91B > [375] 1466082089.884730: TGS reply is for gma...@ic.ac.uk -> > krbtgt/doc.ic.ac...@ic.ac.uk with session key des-cbc-crc/A617 > [375] 1466082089.884819: TGS request result: 0/Success > [375] 1466082089.884838: Storing gma...@ic.ac.uk -> > krbtgt/doc.ic.ac...@ic.ac.uk in FILE:/tmp/krb5cc_868_TQFkWp > [375] 1466082089.884915: Received TGT for service realm: > krbtgt/doc.ic.ac...@ic.ac.uk > [375] 1466082089.884927: Requesting tickets for > host/futurama.doc.ic.ac...@doc.ic.ac.uk, referrals on > [375] 1466082089.884955: Generated subkey for TGS request: des-cbc-crc/14B2 > [375] 1466082089.885000: etypes requested in TGS request: aes256-cts, > aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, > des-cbc-crc, des, des-cbc-md4 > [375] 1466082089.885099: Encoding request body and padata into FAST request > [375] 1466082089.885228: Sending request (2832 bytes) to DOC.IC.AC.UK > (tcp only) > [375] 1466082089.885263: Resolving hostname kerberos.doc.ic.ac.uk > [375] 1466082089.885710: Initiating TCP connection to stream > 146.169.1.157:88 > [375] 1466082089.886276: Terminating TCP connection to stream > 146.169.1.157:88 > [375] 1466082089.886314: Resolving hostname kerberos1.doc.ic.ac.uk > [375] 1466082089.886738: Initiating TCP connection to stream > 146.169.1.11:88 > [375] 1466082089.887249: Terminating TCP connection to stream > 146.169.1.11:88 > [375] 1466082089.887270: Resolving hostname kerberos2.doc.ic.ac.uk > [375] 1466082089.887611: Initiating TCP connection to stream > 146.169.1.71:88 > [375] 1466082089.888136: Terminating TCP connection to stream > 146.169.1.71:88 > [375] 1466082089.889673: ccselect can't find appropriate cache for > server principal host/futurama.doc.ic.ac...@doc.ic.ac.uk > [375] 1466082089.889789: Getting credentials gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk using ccache > FILE:/tmp/krb5cc_868_TQFkWp > [375] 1466082089.889906: Retrieving gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk from FILE:/tmp/krb5cc_868_TQFkWp > with result: -1765328243/Matching credential not found > [375] 1466082089.890009: Retrieving gma...@ic.ac.uk -> > krbtgt/doc.ic.ac...@doc.ic.ac.uk from FILE:/tmp/krb5cc_868_TQFkWp with > result: 0/Success > [375] 1466082089.890024: Found cached TGT for service realm: > gma...@ic.ac.uk -> krbtgt/doc.ic.ac...@ic.ac.uk > [375] 1466082089.890033: Requesting tickets for > host/futurama.doc.ic.ac...@doc.ic.ac.uk, referrals on > [375] 1466082089.890062: Generated subkey for TGS request: des-cbc-crc/B04E > [375] 1466082089.890113: etypes requested in TGS request: aes256-cts, > aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, > des-cbc-crc, des, des-cbc-md4 > [375] 1466082089.890252: Encoding request body and padata into FAST request > [375] 1466082089.890394: Sending request (2832 bytes) to DOC.IC.AC.UK > [375] 1466082089.890446: Resolving hostname kerberos.doc.ic.ac.uk > [375] 1466082089.890897: Initiating TCP connection to stream > 146.169.1.157:88 > [375] 1466082089.891502: Terminating TCP connection to stream > 146.169.1.157:88 > [375] 1466082089.891525: Resolving hostname kerberos.doc.ic.ac.uk > [375] 1466082089.891874: Sending initial UDP request to dgram > 146.169.1.157:750 > [375] 1466082089.893602: Received answer (861 bytes) from dgram > 146.169.1.157:750 > [375] 1466082089.894766: Response was not from master KDC > [375] 1466082089.894812: Decoding FAST response > [375] 1466082089.894897: FAST reply key: des-cbc-crc/EE43 > [375] 1466082089.894953: TGS reply is for gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk with session key aes256-cts/4216 > [375] 1466082089.894987: TGS request result: 0/Success > [375] 1466082089.894997: Received creds for desired service > host/futurama.doc.ic.ac...@doc.ic.ac.uk > [375] 1466082089.895012: Storing gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk in FILE:/tmp/krb5cc_868_TQFkWp > [375] 1466082089.895181: Creating authenticator for gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk, seqnum 683096606, subkey > aes256-cts/1E3F, session key aes256-cts/4216 > [375] 1466082089.896680: ccselect can't find appropriate cache for > server principal host/futurama.doc.ic.ac...@doc.ic.ac.uk > [375] 1466082089.896837: Getting credentials gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk using ccache > FILE:/tmp/krb5cc_868_TQFkWp > [375] 1466082089.896953: Retrieving gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk from FILE:/tmp/krb5cc_868_TQFkWp > with result: 0/Success > [375] 1466082089.897036: Creating authenticator for gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk, seqnum 249884086, subkey > aes256-cts/FDB1, session key aes256-cts/4216 > [375] 1466082089.898397: ccselect can't find appropriate cache for > server principal host/futurama.doc.ic.ac...@doc.ic.ac.uk > [375] 1466082089.898517: Getting credentials gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk using ccache > FILE:/tmp/krb5cc_868_TQFkWp > [375] 1466082089.898630: Retrieving gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk from FILE:/tmp/krb5cc_868_TQFkWp > with result: 0/Success > [375] 1466082089.898760: Getting credentials gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk using ccache > FILE:/tmp/krb5cc_868_TQFkWp > [375] 1466082089.898865: Retrieving gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk from FILE:/tmp/krb5cc_868_TQFkWp > with result: 0/Success > [375] 1466082089.898946: Creating authenticator for gma...@ic.ac.uk -> > host/futurama.doc.ic.ac...@doc.ic.ac.uk, seqnum 1071734415, subkey > aes256-cts/0F2B, session key aes256-cts/4216 > gmazza2@futurama's password: > > > BUT... > - there are gmazza's tickets now: > gmazza2@futurama:~$ klist -e > Ticket cache: FILE:/tmp/krb5cc_868_TQFkWp > Default principal: gma...@ic.ac.uk > > Valid starting Expires Service principal > 16/06/16 14:00:04 17/06/16 00:00:04 krbtgt/ic.ac...@ic.ac.uk > renew until 17/06/16 00:00:04, Etype (skey, tkt): > aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 > 16/06/16 14:01:29 17/06/16 00:00:04 krbtgt/doc.ic.ac...@ic.ac.uk > renew until 17/06/16 00:00:04, Etype (skey, tkt): des-cbc-crc, > des-cbc-md5 > 16/06/16 14:01:29 17/06/16 00:00:04 > host/futurama.doc.ic.ac...@doc.ic.ac.uk > Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 > > > - it works the second time with the same command "ssh gmazza@futurama" > gmazza2@futurama:~$ export KRB5_TRACE= > gmazza2@futurama:~$ ssh gmazza@futurama uptime > 14:02:58 up 21:31, 2 users, load average: 0.01, 0.05, 0.07 > > > Sorry for my long email. > Hope my description makes sense. > > Cheers, > Giuseppe ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos