f



Re: validating keytab files: Cannot find KDC for requested realm whilegetting initial credentials

Adding "dns_lookup_kdc = true" to the [libdefaults] section of krb5.conf seems to fix the problem.

Frank



                                                                                                                                           
                      "Frank Balluffi"                                                                                                     
                      <frank.balluffi+exter        To:       kerberos@mit.edu                                                              
                      nal@db.com>                  cc:                                                                                     
                      Sent by:                     Subject:  validating keytab files: Cannot find KDC for requested realm                  
                      kerberos-bounces@mit.         whilegetting initial credentials                                                       
                      edu                                                                                                                  
                                                                                                                                           
                                                                                                                                           
                      10/26/2004 04:39 PM                                                                                                  
                                                                                                                                           
                                                                                                                                           




I am able to validate (test) keytab files for service1/host1.us.foo.com@FOO.COM and service2/host2.us.foo.com@FOO.COM using the command "kinit -5 -k -t keytab-file service-principal" from host1.us.foo.com, but when I try to validate a keytab file for service3/host3.au.foo.com@FOO.COM from host1.us.foo.com I get the following error:

kinit(v5): Cannot find KDC for requested realm while getting initial credentials

krb5.conf says:

[realms]
    FOO.COM = {
        kdc = ...foo.com:88
        ...
   }

[domain_realm]
    .foo.com = FOO.COM

Is this behavior expected? Do I need to be "on" a host in .au.foo.com to validate a keytab for service3/host3.au.foo.com@FOO.COM? Thanks.

Frank


--

This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.


________________________________________________
Kerberos mailing list           Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos





--

This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.


________________________________________________
Kerberos mailing list           Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos

0
10/27/2004 1:48:44 AM
comp.protocols.kerberos 5541 articles. 1 followers. jwinius (31) is leader. Post Follow

0 Replies
1554 Views

Similar Articles

[PageSpeed] 34

Reply:

Similar Artilces:

validating keytab files: Cannot find KDC for requested realm whilegetting initial credentials
I am able to validate (test) keytab files for service1/host1.us.foo.com@FOO.COM and service2/host2.us.foo.com@FOO.COM using the command "kinit -5 -k -t keytab-file service-principal" from host1.us.foo.com, but when I try to validate a keytab file for service3/host3.au.foo.com@FOO.COM from host1.us.foo.com I get the following error: kinit(v5): Cannot find KDC for requested realm while getting initial credentials krb5.conf says: [realms] FOO.COM = { kdc = ...foo.com:88 ... } [domain_realm] .foo.com = FOO.COM Is this behavior expected? Do I need to be "on" a host in .au.foo.com to validate a keytab for service3/host3.au.foo.com@FOO.COM? Thanks. Frank -- This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden. ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos Check your krb5kdc.log file for any hint! Hooshang On Tue, 26 Oct 2004 16:39:22 -0400, Frank Balluffi <frank.balluffi@db.com> wrote: > I am able to validate (test) keytab files for service1/host1.us.foo.com@FOO.COM and service2/host2.us.foo.com@FOO.COM using the command "kinit -5 -k -t keytab-file se...

Re: AIX 5.3: kinit(v5): Cannot resolve network address for KDC in requested realm while getting initial credentials
Christopher, I had the exact same problem. I was given 2 patches for KRB 1.4.1 and it fixed the problem. I applied the patches to my 1.4.2 source and the problem is resolved there too. Here are the patches: DNSGLUE.C Patch: *** ./src/lib/krb5/os/dnsglue.c.orig Fri Jan 14 17:10:53 2005 --- ./src/lib/krb5/os/dnsglue.c Thu May 5 11:39:52 2005 *************** *** 62,68 **** --- 62,76 ---- char *host, int nclass, int ntype) { #if HAVE_RES_NSEARCH + #ifndef LANL struct __res_state statbuf; + #else /* LANL */ + #ifndef _AIX + struct __res_state statbuf; + #else /* _AIX */ + struct { struct __res_state s; char pad[1024]; } statbuf; + #endif /* AIX */ + #endif /* LANL */ #endif struct krb5int_dns_state *ds; int len, ret; LOCATE_KDC.C Patch: >*** ./src/lib/krb5/os/locate_kdc.c.orig Thu May 5 08:06:45 2005 >--- ./src/lib/krb5/os/locate_kdc.c Thu May 5 11:34:27 2005 >*************** >*** 267,275 **** >--- 267,283 ---- > memset(&hint, 0, sizeof(hint)); > hint.ai_family = family; > hint.ai_socktype = socktype; >+ #ifndef LANL > #ifdef AI_NUMERICSERV > hint.ai_flags = AI_NUMERICSERV; > #endif >+ #else /* LANL */ >+ #ifndef _AIX >+ #ifdef AI_NUMERICSERV >+ hint.ai_flags = AI_NUMERICSERV; >+ #endif >+ #endif /* _AIX */ >+ #endif /* LANL */ > sprintf(portbuf, "%d", ntohs(port)); > sprintf(s...

Cannot contact any KDC for requested realm while getting initial credentials
Hi all, I'm having a very strange problem below that I cannot figure out. Any advice would be great to hear. First a block showing the problem, then a block showing that a different machine works perfectly fine (and others I've tested but not showing here for briefness). Basically, the master KDC, rcf-kdc1.foo.com, can't seem to do jack. ============================================================ rcf-kdc1# grep hosts /etc/nsswitch.conf hosts: files dns rcf-kdc1# rcf-kdc1# cat /etc/krb5.conf [libdefaults] default_realm = RCF.FOO.COM forwardable = yes ticket_lifetime = 7d [appdefaults] forwardable = yes [domain_realm] .foo.com = RCF.FOO.COM [realms] RCF.FOO.COM = { kdc = rcf-kdc1.foo.com kdc = rcf-kdc2.foo.com kdc = rcf-kdc3.foo.com admin_server = rcf-kdc1.foo.com } [logging] kdc = FILE:/var/adm/krb5kdc.log admin_server = FILE:/var/adm/kadmin.log default = FILE:/var/adm/krb5lib.log rcf-kdc1# uname -n rcf-kdc1.foo.com rcf-kdc1# nslookup rcf-kdc1.foo.com Server: 1xx.xx.xx.xxx Address: 1xx.xx.xx.xxx#53 Name: rcf-kdc1.foo.com Address: 1xx.xx.xx.yyy rcf-kdc1# kinit -p jblaine kinit(v5): Cannot contact any KDC for realm 'RCF.FOO.COM' while getting initial credentials rcf-kdc1# ps -ef | grep krb5kdc root 6837 1 0 13:21 ? 00:00:00 /var/rcf-kdc1-krb5/sbin/krb5kdc root 14166 2856 0 16:57 pts/0 00:00:00 grep krb5kdc...

kinit: Cannot contact any KDC for requested realm while getting initial credentials
Hi, I am having problems with using kinit, with keytab and username/password. When issuing the kinit command I get the following error: kinit: Cannot contact any KDC for requested realm while getting initial credentials There is a firewall between the webservers where I issue the command from and the domain controller. The webservers are able to connect to the domain controller on port 88 over UDP. The webservers are able to resolve themselves and the domain controller, both forward and reverse lookup. Do any of you guys out there have an idea of what is going wrong? Many thanks, Celia ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos ...

Cannot resolve network address for KDC in requested realm while getting initial credentials
On Red Hat linux 2.4.9 krb5-devel-1.2.2-24 krb5-libs-1.2.2-24 krb5-server-1.2.2-24 krb5-workstation-1.2.2-24 running everything on the local host I can run kinit.just fine: kinit test Password for test@host.COM: I can create a keytab file: kadmin.local: ktadd -k /var/kerberos/krb5kdc/kadm5test test Entry for principal test with kvno 5, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/var/kerberos/krb5kdc/kadm5test. Entry for principal test with kvno 5, encryption type DES cbc mode with CRC-32 added to keytab WRFILE:/var/kerberos/krb5kdc/kadm5test. However, I can't kinit using this keytab file: [root@host/var/kerberos/krb5kdc]$ kinit -k kadm5test kinit(v5): Cannot resolve network address for KDC in requested realm while getting initial credentials klist shows: [root@bde-idm3 /var/kerberos/krb5kdc]$ klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: test@BDE-IDM3.US.ORACLE.COM Valid starting Expires Service principal 01/20/05 14:53:59 01/21/05 00:53:59 krbtgt/HOST.COM@HOST.COM Kerberos 4 ticket cache: /tmp/tkt0 klist: You have no tickets cached A secondary problem is now the password seems to have been changed after creating the keytab, and I can no longer kinit (without the keytab): [root@host /var/kerberos/krb5kdc]$ kinit test Password for test@host.US.ORACLE.COM: kinit(v5): Password incorrect while getting initial credentials For testing purposes I'm using my hostname as my realm name. I&#...

AIX 5.3: kinit(v5): Cannot resolve network address for KDC in requested realm while getting initial credentials
Hi list, kinit (krb5 1.4.2) on an AIX 5.3 gives me # /usr/local/bin/kinit -k -t foobar.keytab foobar/foo.example.net@EXAMPLE.NET kinit(v5): Cannot resolve network address for KDC in requested realm while getting initial credentials From a working Linux krb5 1.4.2 installation I copied /etc/krb5.conf and foobar.keytab to AIX 5.3. The following steps don't defer to the steps I did under Linux. # ./configure --without-krb4 --enable-shared # make && make install Using gcc 3.3.2. I found a patch for krb5 1.4.1 for AIX 5.2 from Ken Raeburn, but as far as I see it is fixed in 1.4.2. My krb5.conf looks like this: [libdefaults] default_realm = EXAMPLE.NET clockskew = 300 [realms] EXAMPLE.NET = { kdc = foo.example.net:88 admin_server = foo.example.net:749 default_domain = example.net kpasswd_server = foo.example.net } [domain_realm] .example.net = EXAMPLE.NET example.net = EXAMPLE.NET [logging] default = SYSLOG:NOTICE:DAEMON kdc = FILE:/var/log/kdc.log kadmind = FILE:/var/log/kadmind.log [appdefaults] pam = { ticket_lifetime = 1d renew_lifetime = 1d forwardable = true proxiable = false retain_after_close = false minimum_uid = 0 debug = false } Trying to analyze with tcpdump I s...

smbclient error: Cannot find KDC for requested realm
Hi there, I'am trying to connect to a Windows-Member-Server in a Win2000 Domain with Samba 3 on Fedora 1.0. Our Win2000 Domain is using MIT-Kerberos. I tried: smbclient //server.testdomain.local/doc$ -k \ --user=testuser@KERBEROS.TESTDOMAIN.LOCAL I'm still getting this message: krb5_get_credentials failed for server$@TESTDOMAIN.LOCAL (Cannot find KDC for requested realm) spnego_gen_negTokenTarg failed: Cannot find KDC for requested realm session setup failed: NT_STATUS_OK Klist told me that I'm having a TGT for Kerberos an a TGT for our Windows-Domain. But I'm missing a CIFS-Ticket. Can somebody help me with that problem? Thanx - Olli ...

KDC policy rejects request while getting initial credentials
Hello List, when i change the (fully patched 2003 SP1) KDC in krb5.conf to another (fully patched 2003 SP1 :) valid domain-controller in our domain i get : KDC policy rejects request while getting initial credentials , if i do a "kinit myusername" I can lock my account through this KDC with kinit , if i type in the wrong password 3 times, but i dont get a ticket . My windows colleague dont see anything like this in his logs. Google returns 3 results :( http://www.google.de/search?q=%22KDC+policy+rejects+request+while+gettin g+initial+credentials%22&hl=de&lr=&filter=0 Thanks for your help Greets Jakob mailto:jakob.jellbauer@interhyp.de | www.interhyp.de ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos ...

RE: kinit request on keytab fails using 2K3sp1 KDC
David, The easiest solution to this problem is to use the ktpass which was shipped with Windows 2003, and not the one with SP1. Alternatively, you can use one of the many tools available that replace the need for ktpass, and use computer accounts for key storage. These tools do not suffer from the same issues as ktpass. It seems that the sp1 version of ktpass stores a key with a specific kvno in the keytab file, and the kvno in the domain controller for the same principal is different. This is why you cannot use the keytab file to authenticate. Thanks, Tim -----Original Message----- From: kerberos-bounces@mit.edu [mailto:kerberos-bounces@mit.edu] On Behalf Of David Telfer Sent: 22 March 2006 17:09 To: kerberos@mit.edu Subject: kinit request on keytab fails using 2K3sp1 KDC Hello, I am testing a keytab obtained from a Windows 2003 Server (sp1) prior to configuring mod_auth_kerb. I have used the following command to generate a keytab on the KDC; ktpass -mapuser intsvcuser@smg.plc.uk -princ HTTP/connect.smg.plc.uk@SMG.PLC.UK +DesOnly -pass userspassword -ptype KRB5_NT_PRINCIPAL -crypto DES-CBC-MD5 -out "c:\krb5.keytab" The *nix server is running Solaris 9 with MIT krb5-1.4.3. I have transfered the keytab to /etc/krb5.keytab. When I run ; #/usr/local/bin/kinit -k -t /etc/krb5.keytab HTTP/connect.smg.plc.uk@SMG.PLC.UK I get the following error; kinit(v5): Preauthentication failed while getting initial credentials I am able to obtain a ticket directly ...

kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
Hi, there, I set up a MIT Kerberos 5 master kdc on a pc in a private domain. I have /etc/hosts mapping hostname of the pc to its ip address and /etc/krb5.conf pointing kdc to the host name, which i believe correctly set. The problem is that, I can do kadmin.local but I just couldn't do kadmin. It always complains: kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface kinit with no parameters reports the similar error: kinit(v5): Cannot contact any KDC for requested realm while getting initial credentials but kinit works if I supply a principal from another realm (that realm and its kdc is also set in /krb5.conf). I am confused that why kinit and kadmin just couldn't work in local realm? Is this a feature or I missed any setting issues? Thank you very much. yizeng ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos I would suspect a simple error in the configuration of your local realm in /etc/krb5.conf, or a DNS issue. Can you post your /etc/krb5.conf ? On 10/26/05, yi zeng <bigwhite@gmail.com> wrote: > Hi, there, > I set up a MIT Kerberos 5 master kdc on a pc in a private domain. I have > /etc/hosts mapping hostname of the pc to its ip address and /etc/krb5.conf > pointing kdc to the host name, which i believe correctly set. > The problem is that, I can do kadmin.local but I just couldn't do kadmin. >...

RE: kinit request on keytab fails using 2K3sp1 KDC #4
David, I have seen this problem before. It does not occur with the pre-SP1 version of ktpass. Conclusion : If you want to create keytable files which have correct kvno's and which work correctly with des, then you must use the pre-SP1 version of ktpass. Thanks, Tim -----Original Message----- From: kerberos-bounces@mit.edu [mailto:kerberos-bounces@mit.edu] On Behalf Of David Telfer Sent: 23 March 2006 17:39 To: kerberos@mit.edu Subject: Re: kinit request on keytab fails using 2K3sp1 KDC Jeffrey Altman wrote: > Why do you need the kvno to be 1? It wasn't so much that they needed to match, more to tidy up the situation I had on the KDC. > For example, what is the enctype of the service ticket issued by the > KDC? Does that match the enctype of the keytab entry you are using? > > What do the following commands output? > > klist -e -k /etc/krb5.keytab > > kvno HTTP/connect.smg.plc.uk@SMG.PLC.UK > klist -e > This appears to be the problem, the keytab is being generated with DES CBD MD5, the service principal is sending an ArcFour encrypted tgt. The reason this never occured to me is that the user account has the 'use DES encryption for this account' setting ticked. I have tried the following process to force the service principal to be DES; 1 - create account 2 - run ktpass util with -mapop set +DesOnly and -crypto DES-CBC-MD5 options set. 3 - view account properites and ensure that 'use DES encryption f...

RE: kinit request on keytab fails using 2K3sp1 KDC #2
David, Like yourself we spent many days/weeks trying to get the sp1 version of ktpass to work, but we could not, so we have developed our own replacement product that uses computer accounts instead. Cheers, Tim -----Original Message----- From: kerberos-bounces@mit.edu [mailto:kerberos-bounces@mit.edu] On Behalf Of David Telfer Sent: 23 March 2006 09:47 To: kerberos@mit.edu Subject: Re: kinit request on keytab fails using 2K3sp1 KDC Richard E. Silverman wrote: > > TA> It seems that the sp1 version of ktpass stores a key with a > TA> specific kvno in the keytab file, and the kvno in the domain > TA> controller for the same principal is different. This is why you > TA> cannot use the keytab file to authenticate. > > Yes; it always sets the kvno in the keytab it writes to 1, regardless of > the value in the KDB (which of course changes each time the key is > extracted). So, you can only use the keytab the first time you extract > it. If you have to do it again, just delete the principal and re-create > it. I am not sure whether this is the issue or not, I may be doing something wrong but I have used the following procedure to determine the kvno of both the keytab and the service principal. To determine the KDC principal kvno; #./kinit HTTP/connect.smg.plc.uk@SMG.PLC.UK --->prompted for system user password #./kvno HTTP/connect.smg.plc.uk@SMG.PLC.UK HTTP/connect.smg.plc.uk@SMG.PLC.UK: kvno = 3 To determine...

RE: kinit request on keytab fails using 2K3sp1 KDC #3
>From the determined kvno information, I am worried that starting again >will not resolve my issue. Assuming that the kvno is reset to 1, using >kvno and klist to determine the version number should return similar >results to above, but showing the number to be 1. What would the >difference be and would it resolve the pre-authentication issue? We found that even if we start again, we could not get the pre-auth to work. ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos Tim Alsop wrote: >>From the determined kvno information, I am worried that starting again >> will not resolve my issue. Assuming that the kvno is reset to 1, using > >> kvno and klist to determine the version number should return similar >> results to above, but showing the number to be 1. What would the >> difference be and would it resolve the pre-authentication issue? > > We found that even if we start again, we could not get the pre-auth to > work. The most important new functionality in the W2K SP1 version of KTPASS is that it allows you to export RC4-based keys instead of DES. Did you try using RC4 keys or were you only interested in using single DES? Jeffrey Altman ...

samba+kerberos "cannot resolve network address for KDC in requested realm"
Hi, i'm quite new on kerberos and samba so i hope my question is not so stupid and i hope somebody could help me. I'm trying to join a linux machine (3.0.14a-Debian) to a W2K3 domain a member . I would like to have ads security on it but i dont know why i get this message "cannot resolve network address for KDC in requested realm" when i try "net ads join -U myuser%mypassword". Maybe i did not give u enough information to know what's the problem. Thank's in advance --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y m�viles desde 1 c�ntimo por minuto. http://es.voice.yahoo.com ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos ...

kinit: Cannot contact any KDC for realm 'EXAMPLE.COM' while getting initial credentials
Hi! I have set up a kerberos server srv.example.com. This server has address 192.168.180.30. Address resolution works fine on the server and client: srv.example.com: # host srv srv.example.com has address 192.168.180.30 # host 192.168.180.30 30.180.168.192.in-addr.arpa domain name pointer srv.example.com. # host client client.example.com has address 192.168.180.6 # host 192.168.180.6 6.180.168.192.in-addr.arpa domain name pointer client.example.com # client.example.com: # host srv srv.example.com has address 192.168.180.30 # host 192.168.180.30 30.180.168.192.in-addr.arpa domain name pointer srv.example.com. # host client client.example.com has address 192.168.180.6 # host 192.168.180.6 6.180.168.192.in-addr.arpa domain name pointer client.example.com # Now from the server: # kinit user kinit: Cannot contact any KDC for realm 'EXAMPLE.COM' while getting initial credentials and from the client: # kinit user kinit: Cannot contact any KDC for realm 'EXAMPLE.COM' while getting initial credentials I am a bit lost what's going on here. In /etc/krb5.conf I have: [libdefaults] default_realm = EXAMPLE.COM dns_lookup_kdc = true dns_lookup_realm = true # The following krb5.conf variables are only for MIT Kerberos. krb4_config = /etc/krb.conf krb4_realms = /etc/krb.realms kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true [realms] EXAMPLE.COM = { k...

[rfc-dist] RFC 6141 on Re-INVITE and Target-Refresh Request Handling in the Session Initiation Protocol (SIP)
A new Request for Comments is now available in online RFC libraries. RFC 6141 Title: Re-INVITE and Target-Refresh Request Handling in the Session Initiation Protocol (SIP) Author: G. Camarillo, Ed., C. Holmberg, Y. Gao Status: Standards Track Stream: IETF Date: March 2011 Mailbox: Gonzalo.Camarillo@ericsson.com, Christer.Holmberg@ericsson.com, gao.yang2@zte.com.cn Pages: 26 Characters: 57517 Updates: RFC3261 I-D Tag: draft-ietf-sipcore-reinvite-08.txt URL: http://www.rfc-editor.org/rfc/rfc6141.txt The procedures for handling SIP re-INVITEs are described in RFC 3261. Implementation and deployment experience has uncovered a number of issues with the original documentation, and this document provides additional procedures that update the original specification to address those issues. In particular, this document defines in which situations a UAS (User Agent Server) should generate a success response and in which situations a UAS should generate an error response to a re-INVITE. Additionally, this document defines further details of procedures related to target-refresh requests. [STANDARDS-TRACK] This document is a product of the Session Initiation Protocol Core Working Group of the IETF. This is now a ...

Re: Find.find --- returns directories/files backwards
Hi,=0A=0ATry something like this=0A=0Ad =3D Dir.open('/user/path/Documents'= )=0Ad.entries.sort=0A=3D> [ ".", "..", "doc1", "doc2", etc ]=0A=0Afor some = reason block processing is counter intuitive here=0Athis code does not work= =0A=0Ae =3D Dir.open('/user/path/Documents')=0Ae.entries.sort {|file| puts = file }=0A=3D> warning: multiple values for a block parameter (2 for 1)=0A= =0ARegards,=0A=0Ajoe=0A=0A=0A----- Original Message ----=0AFrom: Brad <brad= askins@gmail.com>=0ATo: ruby-talk ML <ruby-talk@ruby-lang.org>=0AS...

question about MIT Kerberos KDC processing PROXY KDC requests
Hello, I understand that proxiable/proxy tickets are rarely used and the corresponding code in the MIT Kerberos implementation is not very well tested. However, I found two possibly buggy places in the KDC code, so I think this is worth asking about. I used the MIT Kerberos distribution and was able to make proxiable/ proxy tickets work, but had two make two changes in the KDC source code. I would like to ask if these are really bugs or not. We use the MIT Kerberos 1.6.3 release. Both suspicious places are in kdc/ kdc_util.c, validate_tgs_request(): 1. line 1144: if (request->kdc_options & NO_TGT_OPTION) { if (!krb5_principal_compare(kdc_context, ticket->server, request_server)) { *status = "SERVER DIDN'T MATCH TICKET FOR RENEW/FORWARD/ETC"; return(KDC_ERR_SERVER_NOMATCH); } } NOT_TGT_OPTION is defined as: #define NO_TGT_OPTION (KDC_OPT_FORWARDED | KDC_OPT_PROXY | KDC_OPT_RENEW | KDC_OPT_VALIDATE) The KDC returns an error here if the server principal in the ticket does not match the one in the KDC request. I can see how this check is required for the "forwarded", "renew" and "validate" KDC requests. However, for a proxy ticket request, it seems that: - the ticket must be a TGT with ticket->server = krbtgt/R1@R2, for some R1 and R2 - the KDC request must have a server principal request->server = the target application server's Kerberos principal Should the #define NO_TGT_OPTI...

Re: Subject: Re: Find maximum and minimum LRecl of a flat file
On Tue, 5 Dec 2006 11:47:52 -0500, H. Lawrence Hotchkiss <larryh@ZEBRA.US.UDEL.EDU> wrote: >On finding the record lengths of a text file, there is an option on the infile >statement (length=). The variable named on the right of the = sign is not saved >to the output data set, so you need an assignment statement. Here is a small >example > > * lrecl.sas: Get min & max record length of input data file. *; > > data; > infile 'lrecl.sas' firstobs=13 length=len; > input a b c; > lrecl=len; > ; > run; > > proc means min max...

AD KDC - msktutil
Hi, I have this error (see subject) when using msktutil. Any idea what's wrong with my setup? (I've replaced hostnames and OU structure) /etc/krb5.conf (part) ========== [libdefaults] default_realm = EXAMPLE.ORG dns_lookup_realm = false dns_lookup_kdc = true ticket_lifetime = 24h renew_lifetime = 7d forwardable = true [realms] EXAMPLE.ORG = { default_domain = msnet.railb.be kdc = ictdc01.example.org admin_server = ictdc01.example.org admin_keytab = FILE:/etc/krb5.keytab } [domain_realm] .example.org = EXAMPLE.ORG example.org = EXAMPLE.ORG msktutil --create -h tstweb01 -b "OU=Linux Servers" --server ictdc01 -- verbose -- init_password: Wiping the computer password structure -- get_default_keytab: Obtaining the default keytab name: FILE:/etc/ krb5.keytab -- create_fake_krb5_conf: Created a fake krb5.conf file: / tmp/.msktkrb5.conf-fbUui1 -- reload: Reloading Kerberos Context -- get_short_hostname: Determined short hostname: tstweb01 -- finalize_exec: SAM Account Name is: tstweb01$ -- try_machine_keytab_princ: Trying to authenticate for tstweb01$ from local keytab... -- try_machine_keytab_princ: Error: krb5_get_init_creds_keytab failed (No such file or directory) -- try_machine_keytab_princ: Authentication with keytab failed -- try_machine_keytab_princ: Trying to authenticate for host/ tstweb01.example.org from local keytab... -- try_machine_keytab_princ: Error: krb5_get_init_creds_keytab failed (Client not found in Kerberos ...

KDC: cannot initialize realm
Hi. I've got a problem in my slave KDC. I've set up time ago a slave kdc with a cron job from the master that dumps the database on a file, and makes the slave load it, all with ssh root tickets. Now the slave isn't working anymore: plm:~# /etc/init.d/krb5-kdc start Starting Kerberos KDC: krb5kdc: cannot initialize realm DIA.UNIROMA3.IT krb5kdckrb524d: Invalid argument initializing kadm5 library krb524d. plm:~# *NO* other output than that. What is it? -- Sensei <mailto:senseiwa@tin.it> The optimist says "Tomorrow is sunday". The pessimist says "The day after tomorrow is monday". (Gustave Flaubert) Sensei wrote: > > *NO* other output than that. What is it? > It happens also when running alone # krb5kdc or # krb524d What's the problem??? Please, I find it REALLY strange! It worked since two/three weeks ago! -- Sensei <mailto:senseiwa@tin.it> The optimist says "Tomorrow is sunday". The pessimist says "The day after tomorrow is monday". (Gustave Flaubert) ...

Re: Fw: Re: Finding files with Window's Search Function
Kevin, I don't want to use up much more SAS-L bandwidth on this, but I still think that we are talking about the same thing .. only that Microsoft has made it extremely difficult to find (which is why I opted for the RegEdit approach). Try the following steps (as illogical as they may appear): right click on start->search under the search companion (left side of screen) left click on back left click on Change preferences left click on With Indexing Service (for faster local searches) left click on Change Indexing Service settings (Advanced) from Indexing Service left click on View-&g...

find a matching pattern in file and find it in another file too
Problem Def: copy the pattern which before ",(comma)" and find a matching pattern in another file. status: i wrote following code. but it is not working properly. plz help me. #! C:\Perl\bin\perl.exe print "hello\n"; print "Please Enter Input File name(Give the complete path):"; $infile=<STDIN>; #give the input file name here chomp($infile); open ($in, "<", $infile) or die "Cannot open file for reading\n"; #Check whether the file can be opened for reading while (<$in>) { if(/,/) {print "before match: $`\t and after m...

RE: is this a valid zone file?
This is a multi-part message in MIME format. --===============7466131452734776186== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C9637B.C3B156DA" This is a multi-part message in MIME format. ------_=_NextPart_001_01C9637B.C3B156DA Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I've always assumed that the ";..." line in the example zone file right after the SOA record and the (...) in the SOA record itself meant that such informati...

Web resources about - Re: validating keytab files: Cannot find KDC for requested realm whilegetting initial credentials - comp.protocols.kerberos

Cisco plans to blend two NAC schemes
Customers will be able to buy Cisco's NAC appliance the NAC option most of its customers opt for first and later migrate to its network-based ...

Orlando Magic (1989-Present)
Orlando Magic Team History

Can Warlords Save Afghanistan?
Local leadership might succeed where Karzai and the Afghan military fail

Savage Love by Dan Savage - Seattle Columns - Savage Love - Dan Savage - The Stranger, Seattle's Only ...
Savage Love - Maladjusted Shits - Seattle's #1 Weekly Newspaper. Covering Seattle news, politics, music, film, and arts; plus movie times, club ...

Seven Ways Businesses and Communities Can Fight "Showrooming"
By Casey Woods and Jeff Milchen November 26, 2012 A customer walks into your place of business, pulls outtheir phone and starts taking pictures ...

America’s Ruling Class — And the Perils of Revolution
As over-leveraged investment houses began to fail in September2008, the leaders of the Republican and Democratic parties, ofmajor corporations, ...

Welcome to the Comedy Pet Theater
A classically-trained circus performer brings the Russian-style animal circus to the Las Vegas strip.

Outrun The Meteor Shower Review
The five track release starts with a short song called Not That Punk ,it sounds like it is being played with lots of energy, finishing under ...

► February (2)
skip to main - skip to sidebar Thursday, 28 February 2013 m b v Review m b v My Bloody Valentine MBV Records It suddenly struck me last night ...

Resources last updated: 3/10/2016 2:53:33 PM