Problems with Kerberos and realms Post: 302867561

Sponsored Content

Operating Systems AIX Problems with Kerberos and realms Post 302867561 by PassLine on Thursday 24th of October 2013 11:35:13 AM

10-24-2013

Registered User

If I telnet to ldap.123.com, it attempts to connect but gives a "remote host refused an attempted connect operation" error.

If I telnet to ldap.123.com:88, it cannot find it.

I do have those packages installed.

nslookup shows the correct hostname.

I can successfully ping it.

What services would I be restarting after changing?

Code:

mkkrb5clnt -c ldap.123.com -r 123.COM -s ldap.123.com -d 123.COM

(using caps where appropriate)

If I just use kinit <username> (not against any server) I get different responses.

Code:

#/usr/krb5/bin/kinit PassLine
Unable to obtain initial credentials.
        Status 0x96c73a44 - KRB5 error code 68.

(In that example, PassLine is a valid user within AD)

Code:

#/usr/krb5/bin/kinit testunix
Unable to obtain initial credentials.
        Status 0x96c73a06 - Client not found in Network Authentication Service database or client locked out.

(In that example, testunix is a user created by the AD admin. The user is not locked out.)

---------------

I've reinstalled a few times, without change. I believe I've used that doc before, but maybe I'll wipe everything and try again.

PassLine

View Public Profile for PassLine

Find all posts by PassLine

9 More Discussions You Might Find Interesting

1. Cybersecurity

Kerberos security

I have installed Kerberos security in my UNIX system but I need to disable because of an application conflict with Kerberos. So Anybody ca tell me how can I disable it? Thank you

2. Solaris

kerberos security

i m new 2 unix world can some body explain me abt kerberos pls explain in detail..!

3. AIX

SSH and Kerberos

I have 2 servers (lft1 and lft3) running AIX 5.3 ML 5. Both are installed with krb5.client.rte 1.4.0.4 and openssh.base.server 4.3.0.5300. I have configured some of the users on both servers to authenticate against our Windows 2003 Active Directory. From my PC, I can use telnet to login...

4. AIX

NFS4 with KERBEROS

I was wondering if any of you have used NFS4 with KERBEROS in a HACMP setup and environment with more than 1 resourcegroup that has NFS mount in them. I Configures the host keys for an Network File System (NFS) server I get stuck with the nfshostkey I can only add one at a time per system so...

5. Programming

Kerberos Authentication c/c++

I am in the process of developing a application that needs to be able to authenticate users details with a kerberos server, which is proving to be rather difficult. There seems to be a lack of good information on how to do this using the MIT kerberos api. Can anyone point me in the right...

6. AIX

Auth against AD (kerberos) does not work

@kah00na and all others, i have done al steps of the HowTo "Authenticate AIX users from MSActive Directory", found in this forum, but it still does not work. The test with kinit USERNAME works fine. But if i try to login i get the "UNKNOWN_USER" error in the debug.log.All steps to change...

7. AIX

Problems with kerberos and forest domain

Hi, I have a simple Apache setup that works fine when I create a keytab on a domain level authentication works fine. When I create a keytab at the forest level authentication does not work. I get the following error message. Does anyone know what I am doing wrong here? I validated there is the...

8. OS X (Apple)

OSX and Kerberos

Our Network Security folks have mandated that we "Kerberize" our systems to allow them to perform an authenticated scan. This consists of instructions to change /etc/pam.d/sshd from: # sshd: auth account password session auth optional pam_krb5.so use_kcminit auth optional ...

9. Shell Programming and Scripting

PERL and Kerberos authentication

I am installing Authen::Krb5::Easy and during make test I am getting the follwing error : kinit not ok 2 error was: could not get initial credentials: Cannot contact any KDC for requested realm we are stroring krb5.conf in diff location ( not in /etc/krb5.conf) , but, PERL is...

LEARN ABOUT CENTOS

ipa-rmkeytab

ipa-rmkeytab(1) 						 IPA Manual Pages						   ipa-rmkeytab(1)

NAME

       ipa-rmkeytab - Remove a kerberos principal from a keytab

SYNOPSIS

       ipa-rmkeytab [ -p principal-name ] [ -k keytab-file ] [ -r realm ] [ -d ]

DESCRIPTION

       Removes a kerberos principal from a keytab.

       Kerberos  keytabs  are  used  for  services (like sshd) to perform kerberos authentication. A keytab is a file with one or more secrets (or
       keys) for a kerberos principal.

       A kerberos service principal is a kerberos identity that can be used for authentication. Service principals contain the name  of  the  ser-
       vice, the hostname of the server, and the realm name.

       ipa-rmkeytab  provides  two  ways  to  remove  principals.   A specific principal can be removed or all principals for a given realm can be
       removed.

       All encryption types and versions of a principal are removed.

       The realm may be included when removing a specific principal but it is not required.

       NOTE: removing a principal from the keytab does not affect the Kerberos principal stored in the IPA server. It  merely  removes	the  entry
       from the local keytab.

OPTIONS

       -p principal-name
	      The non-realm part of the full principal name.

       -k keytab-file
	      The keytab file to append the principal(s) from.

       -r realm
	      A realm to remove all principals for.

       -d     Debug mode. Additional information is displayed.

EXAMPLES

       Remove the NFS service principal on the host foo.example.com from /tmp/nfs.keytab.

	  # ipa-rmkeytab -p nfs/foo.example.com -k /tmp/nfs.keytab

       Remove the ldap service principal on the host foo.example.com from /etc/krb5.keytab.

	  # ipa-rmkeytab -p ldap/foo.example.com -k /etc/krb5.keytab

       Remove all principals for the realm EXAMPLE.COM.

	 # ipa-rmkeytab -r EXAMPLE.COM -k /etc/krb5.keytab

EXIT STATUS

       The exit status is 0 on success, nonzero on error.

       1 Kerberos initialization failed

       2 Memory allocation error

       3 Unable to open keytab

       4 Unable to parse the principal name

       5 Principal name or realm not found in keytab

       6 Unable to remove principal from keytab

IPA
								    Oct 30 2009 						   ipa-rmkeytab(1)

9 More Discussions You Might Find Interesting

1. Cybersecurity

Kerberos security

Discussion started by: dansanmex

2. Solaris

kerberos security

Discussion started by: sriram.s

3. AIX

SSH and Kerberos

Discussion started by: asch337

4. AIX

NFS4 with KERBEROS

Discussion started by: ravager

5. Programming

Kerberos Authentication c/c++

Discussion started by: mshindo

6. AIX

Auth against AD (kerberos) does not work

Discussion started by: tomys

7. AIX

Problems with kerberos and forest domain

Discussion started by: 3junior

8. OS X (Apple)

OSX and Kerberos

Discussion started by: jnojr

9. Shell Programming and Scripting

PERL and Kerberos authentication

Discussion started by: talashil

LEARN ABOUT CENTOS

ipa-rmkeytab