Kerberos and PAM authentication

[Chris Schadl]

Hi,

I'm trying to get my network configured so that stuff authenticates against
the Kerberos realm using PAM.  So far I've installe the krb5-kdc and
krb5-admin-server packages in Debian 3.0, created the principles on the KDC
and created/imported the host principles into the keytab on the KDC.  While
I am able to get a TGT using `kinit`, I am unable to get anything to
authenticate against the KDC using PAM.  For instance, this is what I get
when I try to use the `su` command (with "auth sufficient pam_krb5.so" added
towards the top of the PAM stack, of course)

cds at lain:~$ su chris
Password for chris at LEET.ORG:
su: Authentication service cannot retrieve authentication info.
Sorry.

This is what shows up in /var/log/messages:

May 13 17:44:26 lain krb5kdc[2258]: AS_REQ (3 etypes {16 3 1})
192.168.0.2(88): ISSUE: authtime 1052865866, etypes {rep=16 tkt=16 ses=16},
chris at LEET.ORG for krbtgt/LEET.ORG at LEET.ORG
May 13 17:44:26 lain krb5kdc[2258]: TGS_REQ (3 etypes {16 3 1})
192.168.0.2(88): ISSUE: authtime 1052865866, etypes {rep=16 tkt=16 ses=16},
chris at LEET.ORG for host/lain.leet.org at LEET.ORG
May 13 17:44:26 lain su[2538]: pam_acct_mgmt: Authentication service cannot
retrieve authentication info.

And here is what the principle looks like:

root at lain:/home/cds# kadmin.local -q "getprinc chris"
Authenticating as principal root/admin at LEET.ORG with password.
Principal: chris at LEET.ORG
Expiration date: [never]
Last password change: Tue May 13 14:54:11 CDT 2003
Password expiration date: [none]
Maximum ticket life: 0 days 10:00:00
Maximum renewable life: 7 days 00:00:00
Last modified: Tue May 13 17:28:17 CDT 2003 (chris/admin at LEET.ORG)
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 6
Key: vno 1, Triple DES cbc mode with HMAC/sha1, no salt
Key: vno 1, DES cbc mode with CRC-32, no salt
Key: vno 1, DES cbc mode with RSA-MD5, Version 4
Key: vno 1, DES cbc mode with RSA-MD5, Version 5 - No Realm
Key: vno 1, DES cbc mode with RSA-MD5, Version 5 - Realm Only
Key: vno 1, DES cbc mode with RSA-MD5, AFS version 3
Attributes:
Policy: [none]

My /etc/krb5.conf is just consists of the default realm definition, and I
have the following SRV records in DNS:
_kerberos._udp      IN  SRV 01 00 88    lain.leet.org.
_kerberos._tcp      IN  SRV 01 00 88    lain.leet.org.
_kpasswd._udp       IN  SRV 01 00 464   lain.leet.org.
_kerberos-adm._tcp  IN  SRV 01 00 749   lain.leet.org.
_kerberos           IN  TXT             LEET.ORG

Anyway, I have no clue whats going wrong.  This stuff worked without a hitch
when I had it running on a hemidal KDC a while back.  If anyone knows what
the problem might be I'd love to hear from you.