Re: pam-krb5.so

2011-01-26 Thread Russ Allbery
Tom Parker writes: > I am wondering if the account > account required pam_krb5.so minimum_uid=1000 > line is required at all in common-account if I am using LDAP for access > control. it seems to be doing nothing on my systems and my login > behaviour does not change if this line is com

pam-krb5.so

2011-01-26 Thread Tom Parker
Good Morning I am wondering if the account account required pam_krb5.so minimum_uid=1000 line is required at all in common-account if I am using LDAP for access control. it seems to be doing nothing on my systems and my login behaviour does not change if this line is commented out. Wh

Logging in with kerberos fails, but acquiring a ticket with kinit does not

2011-01-26 Thread Thomas Schweikle
Hi! I've set up Ubuntu to auth against a kerberos server. The client is equiped with: krb5-config krb5-user libgssapi-krb5-2 libkrb5-3 libkrb5support0 libpam-krb5 /etc/krb5.config holds: [libdefaults] default_realm = EXAMPLE.COM #dns_lookup_kdc = true #dns_lookup_realm = t

Two host, virt-manager, kerberos

2011-01-26 Thread Thomas Schweikle
Hi! Some mysterious problem: Some mysterious problem: Host1 /etc/sasl2/libvirt.conf listen_tls = 0 listen_tcp = 1 mdns_adv = 0 auth_unix_ro = "none" auth_unix_rw = "none" auth_tcp = "sasl" Host2 /etc/sasl2/libvirt.conf listen_tls = 0 listen_tcp = 1 mdns_adv = 0 auth_unix_ro = "none" auth_uni

Re: kinit: Cannot contact any KDC for realm 'EXAMPLE.COM' while getting initial credentials

2011-01-26 Thread Thomas Schweikle
Am 25.01.2011 23:06, schrieb Brian Candler: > On Tue, Jan 25, 2011 at 05:54:16PM +0100, Thomas Schweikle wrote: >> kinit just keeps telling me It could not contact any kdc for this >> realm (EXAMPLE.COM). >> >> Any ideas? > > Is your KDC running? Is your KDC firewalled off? > > Try running tcpdu

Re: acceptor

2011-01-26 Thread Brian Candler
On Wed, Jan 26, 2011 at 04:16:54AM +, Victor Sudakov wrote: > Is there a generic way for a kerberized server to configure which > acceptor principal it will use from the keytab? Why is it so that e.g. > sshd uses a "host/foo" principal while svnserve uses a "svn/foo" principal? > Is it configu

Re: Cross-Platform/Realm Authentication Error Assistance

2011-01-26 Thread Grant Cohoe
AHA! Got it. Your mentioning of the cross-realm princ's gave me the idea to compare them to the basic krbtgt/example@example.com. It seems that when I created the cross-realm princ's, I did not explicitly set their encryption type to our default. So technically the principal did contain the DES

Re: some cross-realm trust questions

2011-01-26 Thread Victor Sudakov
I have been able to ssh from a Windows host (using Centrify PuTTY) to a FreeBSD host using a cross-realm trust between a w2k domain and a Heimdal realm. However, I had to manually configure the Windows host for this to work: "ksetup /addkdc MY.UNIX.REALM server1 server2". Do you know how I can a

Re: acceptor

2011-01-26 Thread Greg Hudson
On Tue, 2011-01-25 at 23:16 -0500, Victor Sudakov wrote: > Colleagues, > > Is there a generic way for a kerberized server to configure which > acceptor principal it will use from the keytab? Why is it so that e.g. > sshd uses a "host/foo" principal while svnserve uses a "svn/foo" principal? > Is

Re: Cross Realm Administration?

2011-01-26 Thread Douglas E. Engert
On 1/25/2011 3:01 PM, Jeff draht wrote: > Doug, > this is the issue I am having after creating a users keytab > file; > > ktutil: addent -password -p xf1...@lab-passhe.lcl -k 7 -e arcfour- > hmac-md5 > Password for xf1...@lab-passhe.lcl: > ktutil: list > slot KVNO Principal >