MIT kpasswd with heimdal kdc and kpasswdd

[Alexander Bergolth]

Hi!

Alexander Bergolth wrote:
> When I'm trying to use MIT kpasswd to change a password on a Heimdal 
> server, I'm getting the following error:
> 
>  > /usr/kerberos/bin/kpasswd leo
> Password for leo at WU-WIEN.AC.AT:
> /usr/kerberos/bin/kpasswd: Password incorrect while getting initial ticket

I've debugged kpasswd and found out that it expects des-cbc-md5 in
decrypt_as_reply as encoding but it gets a des3-cbc-sha1 encoded ticket
instead.

(krb5_do_preauth returned ENCTYPE_DES_CBC_MD5 as_key and etype)

However, the request contained three encodings: des3-cbc-sha1, 
des-cbc-md5 and des-cbc-crc (the default if default_tkt_enctypes is not 
set).

Is this a bug in the MIT krb5 kpasswd?

Any help would be appreciated,
--leo

-----------------------------------------------------------------------
Alexander (Leo) Bergolth                          leo at leo.wu-wien.ac.at
WU-Wien - Zentrum fuer Informatikdienste       http://leo.wu-wien.ac.at
                  Computers are like air conditioners -
            they stop working properly when you open Windows