kadmin problems

2002-01-21 Thread Yau-Kwan Yeung
Hi, Im a total noob to the world of linux. Just trying to get kerberos up by direction posted on the Redhat site. Get this error message when trying to start kadmin- Starting Kerberos 5 Admin Server: kadmind: Cannot set GSS-API authenication names please help, Thanks.

Re: Login always Returns Sytem Error

2002-01-21 Thread Nalin Dahyabhai
On Mon, Jan 21, 2002 at 03:43:15AM +, Hatem AbouHassan wrote: I've just installed Redhat 7.2 recently, and choose all the authentication modules for security. I got into a problem after all when I tried to login to the system from the console, it always retuns System Error and restarts

Re: service ticket acls on the KDC?

2002-01-21 Thread Sam Hartman
Paul == Paul Jakma [EMAIL PROTECTED] writes: Paul hi, i'm wondering whether it would be possible to implement Paul ACLs for service ticket requests? Yes, unfortunately it might be possible to do this. This means someone might do it. Depending on how they did it they would either

service ticket acls on the KDC?

2002-01-21 Thread Paul Jakma
hi, i'm wondering whether it would be possible to implement ACLs for service ticket requests? eg, something like a way to specify on the KDC which principals are allowed to request service tickets for whatever service principals. perhaps something as simple as: host/* *

Re: service ticket acls on the KDC?

2002-01-21 Thread Paul Jakma
On 21 Jan 2002, Sam Hartman wrote: Yes, unfortunately it might be possible to do this. This means someone might do it. Depending on how they did it they would either create a security problem or an interoperability problem. shouldnt be an interoperability problem should it? it would be

Re: service ticket acls on the KDC?

2002-01-21 Thread Sam Hartman
Paul == Paul Jakma [EMAIL PROTECTED] writes: Paul On 21 Jan 2002, Sam Hartman wrote: Yes, unfortunately it might be possible to do this. This means someone might do it. Depending on how they did it they would either create a security problem or an interoperability

Re: service ticket acls on the KDC?

2002-01-21 Thread Paul Jakma
On 21 Jan 2002, Sam Hartman wrote: No, at worst a principal is granted access because a service assuming the KDC does authorization is deployed in a realm where this is not the case. The interop problem happens when someone wants to deploy a service but realizes they cannot do so because

Re: Authentication negotation has failed, which is required for encryption. Goodbye

2002-01-21 Thread Måns Nilsson
Thus spoke matt glogowski: i have seen this error before under solaris. if you compile Kerberos without the correct DNS settings, then the host resolution fails, even though you may see a successful authentication on the KDC. to solve this problem under Solaris, i modified my /etc/hosts file to

Re: service ticket acls on the KDC?

2002-01-21 Thread Wyllys Ingersoll
No, at worst a principal is granted access because a service assuming the KDC does authorization is deployed in a realm where this is not the case. The interop problem happens when someone wants to deploy a service but realizes they cannot do so because it requires authorization features their

Re: service ticket acls on the KDC?

2002-01-21 Thread Ken Hornstein
I am aware of no widely deployed Kerberos applications without authorization support. pam_krb5? You have to be in the Unix password file for pam_krb5 to give you access to a machine. At least, any pam_krb5 implementation I've ever seen works that way. And assuming you could login as