Hi,
I am trying to set up a Kerberised authentication environment.

The test environment right now consists of one Solaris 10 host and one
FreeBSD 6.1 host.

The Solaris 10 machine is acting as KDC and is running MIT Kerberos V 1.5.1.

Except for the KDC all utilitities are the OS default (which means
Heimdal for the FreeBSD host and I believe some patched up MIT for the
Solaris host).

What I don't understund however is what happens when I request host
tickets (or whatever is the problem), so I just illustrate it by doing
some copy paste and hope someone has an idea. Sorry for the extreme
verbosity, I dont know what information is useful so I attached all.

gustafg.bakburk<~>$ kinit
gustafg@NMS.TELE2.NET's Password:
kinit: NOTICE: ticket renewable lifetime is 0

[kdc.log] Aug 28 13:29:38 mamma krb5kdc[8675](info): AS_REQ (6 etypes
{16 5 23 3 2 1}) 172.20.32.111: ISSUE: authtime 1156764578, etypes
{rep=16 tkt=16 ses=16}, gustafg@NMS.TELE2.NET for
krbtgt/NMS.TELE2.NET@NMS.TELE2.NET

gustafg.bakburk<~>$ klist -v
Credentials cache: FILE:/tmp/krb5cc_1001
Principal: gustafg@NMS.TELE2.NET
Cache version: 4

Server: krbtgt/NMS.TELE2.NET@NMS.TELE2.NET
Ticket etype: des3-cbc-sha1, kvno 1
Auth time: Aug 28 13:29:38 2006
End time: Aug 28 23:29:38 2006
Renew till: Aug 28 13:29:38 2006
Ticket flags: renewable, initial
Addresses: IPv4:172.20.32.111

gustafg.bakburk<~>$ ssh mamma
Password:

Aug 28 13:30:21 mamma krb5kdc[8675](info): TGS_REQ (6 etypes {16 5 23 3
2 1}) 172.20.32.111: ISSUE: authtime 1156764578, etypes {rep=16 tkt=16
ses=16}, gustafg@NMS.TELE2.NET for host/mamma.nms.tele2.net@NMS.TELE2.NET
Aug 28 13:30:21 mamma krb5kdc[8675](info): TGS_REQ (6 etypes {16 5 23 3
2 1}) 172.20.32.111: TGT NOT FORWARDABLE: authtime 1156764578,
gustafg@NMS.TELE2.NET for krbtgt/NMS.TELE2.NET@NMS.TELE2.NET, KDC can't
fulfill requested option

^-- The forwardable thing is not the problem, I can remove that problem
by doing 'kinit -f' and things will still not work (maybe obvious to you
but wasn't to me, I suppose that is because PAM or something is trying
to get a new ticket?).

gustafg.bakburk<~>$ klist -v
Credentials cache: FILE:/tmp/krb5cc_1001
Principal: gustafg@NMS.TELE2.NET
Cache version: 4

Server: krbtgt/NMS.TELE2.NET@NMS.TELE2.NET
Ticket etype: des3-cbc-sha1, kvno 1
Auth time: Aug 28 13:29:38 2006
End time: Aug 28 23:29:38 2006
Renew till: Aug 28 13:29:38 2006
Ticket flags: renewable, initial
Addresses: IPv4:172.20.32.111

Server: host/mamma.nms.tele2.net@NMS.TELE2.NET
Ticket etype: des3-cbc-sha1, kvno 3
Auth time: Aug 28 13:29:38 2006
Start time: Aug 28 13:30:21 2006
End time: Aug 28 23:29:38 2006
Ticket flags: transited-policy-checked
Addresses: IPv4:172.20.32.111

gustafg.bakburk<~>$ telnet -x mamma
Trying 172.20.32.110...
Connected to mamma.nms.tele2.net.
Escape character is '^]'.
[ Trying mutual KERBEROS5 (host/mamma.nms.tele2.net@NMS.TELE2.NET)... ]
[ Kerberos V5 refuses authentication because Kerberos checksum
verification failed: Bad encryption type ]
[ Trying KERBEROS5 (host/mamma.nms.tele2.net@NMS.TELE2.NET)... ]
[ Kerberos V5 refuses authentication because Kerberos checksum
verification failed: Bad encryption type ]
Connection closed by foreign host.

[kdc.log] Aug 28 13:32:02 mamma krb5kdc[8675](info): TGS_REQ (1 etypes
{1}) 172.20.32.111: ISSUE: authtime 1156764578, etypes {rep=16 tkt=16
ses=1}, gustafg@NMS.TELE2.NET for host/mamma.nms.tele2.net@NMS.TELE2.NET

gustafg.bakburk<~>$ klist
Credentials cache: FILE:/tmp/krb5cc_1001
Principal: gustafg@NMS.TELE2.NET

Issued Expires Principal
Aug 28 13:29:38 Aug 28 23:29:38 krbtgt/NMS.TELE2.NET@NMS.TELE2.NET
Aug 28 13:30:21 Aug 28 23:29:38 host/mamma.nms.tele2.net@NMS.TELE2.NET
Aug 28 13:32:02 Aug 28 23:29:38 host/mamma.nms.tele2.net@NMS.TELE2.NET

^--- Now we have 2 host tickets???

gustafg.bakburk<~>$ klist -v
Credentials cache: FILE:/tmp/krb5cc_1001
Principal: gustafg@NMS.TELE2.NET
Cache version: 4

Server: krbtgt/NMS.TELE2.NET@NMS.TELE2.NET
Ticket etype: des3-cbc-sha1, kvno 1
Auth time: Aug 28 13:29:38 2006
End time: Aug 28 23:29:38 2006
Renew till: Aug 28 13:29:38 2006
Ticket flags: renewable, initial
Addresses: IPv4:172.20.32.111

Server: host/mamma.nms.tele2.net@NMS.TELE2.NET
Ticket etype: des3-cbc-sha1, kvno 3
Auth time: Aug 28 13:29:38 2006
Start time: Aug 28 13:30:21 2006
End time: Aug 28 23:29:38 2006
Ticket flags: transited-policy-checked
Addresses: IPv4:172.20.32.111

Server: host/mamma.nms.tele2.net@NMS.TELE2.NET
Ticket etype: des3-cbc-sha1, kvno 3
Session key: des
Auth time: Aug 28 13:29:38 2006
Start time: Aug 28 13:32:02 2006
End time: Aug 28 23:29:38 2006
Ticket flags: transited-policy-checked
Addresses: IPv4:172.20.32.111

gustafg.bakburk<~>$ kdestroy

gustafg@NMS.TELE2.NET's Password:
kinit: NOTICE: ticket renewable lifetime is 0

gustafg.bakburk<~>$ telnet -x mamma
Trying 172.20.32.110...
Connected to mamma.nms.tele2.net.
Escape character is '^]'.
[ Trying mutual KERBEROS5 (host/mamma.nms.tele2.net@NMS.TELE2.NET)... ]
[ Kerberos V5 refuses authentication because Kerberos checksum
verification failed: Bad encryption type ]
[ Trying KERBEROS5 (host/mamma.nms.tele2.net@NMS.TELE2.NET)... ]
[ Kerberos V5 refuses authentication because Kerberos checksum
verification failed: Bad encryption type ]
Connection closed by foreign host.

gustafg.bakburk<~>$ klist -v
Credentials cache: FILE:/tmp/krb5cc_1001
Principal: gustafg@NMS.TELE2.NET
Cache version: 4

Server: krbtgt/NMS.TELE2.NET@NMS.TELE2.NET
Ticket etype: des3-cbc-sha1, kvno 1
Auth time: Aug 28 13:33:15 2006
End time: Aug 28 23:33:15 2006
Renew till: Aug 28 13:33:15 2006
Ticket flags: renewable, initial
Addresses: IPv4:172.20.32.111

Server: host/mamma.nms.tele2.net@NMS.TELE2.NET
Ticket etype: des3-cbc-sha1, kvno 3
Session key: des
Auth time: Aug 28 13:33:15 2006
Start time: Aug 28 13:33:27 2006
End time: Aug 28 23:33:15 2006
Ticket flags: transited-policy-checked
Addresses: IPv4:172.20.32.111

Aug 28 13:33:15 mamma krb5kdc[8675](info): AS_REQ (6 etypes {16 5 23 3 2
1}) 172.20.32.111: ISSUE: authtime 1156764795, etypes {rep=16 tkt=16
ses=16}, gustafg@NMS.TELE2.NET for krbtgt/NMS.TELE2.NET@NMS.TELE2.NET
Aug 28 13:33:27 mamma krb5kdc[8675](info): TGS_REQ (1 etypes {1})
172.20.32.111: ISSUE: authtime 1156764795, etypes {rep=16 tkt=16 ses=1},
gustafg@NMS.TELE2.NET for host/mamma.nms.tele2.net@NMS.TELE2.NET

gustafg.bakburk<~>$ ssh mamma
Last login: Mon Aug 28 12:38:46 2006 from bakburk.nms.tel
Sun Microsystems Inc. SunOS 5.10 Generic January 2005
gustafg@mamma ~>

Aug 28 13:34:01 mamma krb5kdc[8675](info): TGS_REQ (6 etypes {16 5 23 3
2 1}) 172.20.32.111: TGT NOT FORWARDABLE: authtime 1156764795,
gustafg@NMS.TELE2.NET for krbtgt/NMS.TELE2.NET@NMS.TELE2.NET, KDC can't
fulfill requested option

---------------------------

Right now the only host ticket type in the KDC for the host mamma is:

kadmin.local: getprinc host/mamma.nms.tele2.net@NMS.TELE2.NET
Principal: host/mamma.nms.tele2.net@NMS.TELE2.NET
Expiration date: [never]
Last password change: Mon Aug 28 12:37:22 CEST 2006
Password expiration date: [none]
Maximum ticket life: 1 day 00:00:00
Maximum renewable life: 0 days 00:00:00
Last modified: Mon Aug 28 12:37:22 CEST 2006 (gustafg/admin@NMS.TELE2.NET)
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 1
Key: vno 3, Triple DES cbc mode with HMAC/sha1, no salt
Attributes:
Policy: [none]
kadmin.local:

root@mamma ~> klist -k -e -t
Keytab name: FILE:/etc/krb5/krb5.keytab
KVNO Timestamp Principal
---- -----------------
---------------------------------------------------------
3 08/28/06 12:37:22 host/mamma.nms.tele2.net@NMS.TELE2.NET (Triple
DES cbc mode with HMAC/sha1)

I have experimented by using all supported encryption types and by using
only this one and I experience more or less the same result (there was a
point in time where I could do both ssh+telnet though, I believe it
doesn't work anymore because I removed some key type).

Regards,
Gustaf

________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos