Fwd: Re: Kerberos error authenticating from Unix to Windows AD

Tyson Oswald oswaldt at ameritech.net
Thu Feb 19 14:36:37 EST 2004


I did a manual comparision between the two files like this
 
on Windows ktpass -in my.keytab
 
on unix klist -k -K
 
they are identical.

Any idea what the ticket option FORWARDED means?
 
thanks,
 
Tyson Oswald

"Douglas E. Engert" <deengert at anl.gov> wrote:


Tyson Oswald wrote:
> 
> Tyson Oswald wrote: I generated a host key on the a Windows server and installed it on the Sun workstation with ktutil. The key was generated with the same password as the user on windows. It was setup with DES-CBC-CRC enctype, also krb5.conf is setup to use des-cbc-crc for both tkt and tgs. One thing I did do was when I FTPed the host key to the Sun box I used binary instead of ascii, if that caused a problem I do not know. If you think this could cause this issue I will re-copy it.

Anyother way to do it is when you run the ktpass /out ...
it will type out the entry on the console, and show the kvno and the
DES key in hex. 

You can then use the ktutil "addent -key" and type in the DES key in
hex on the UNIX system. This avoids any string-to-key problems, as well 
as any transfer problems.

If nothing else you cold verify if the key and kvno is as expected
by using klist -k -K ...


> 
> thank you,
> 
> Tyson Oswald
> 
> Jeffrey Altman wrote:
> Do you have a host key for the Windows workstation?
> 
> Does the Windows workstation know the name you have used for its host key?
> 
> Is the host key restricted to use an enctype of DES-CBC-CRC?
> 
> Did you create the host key with a password and not a random key?
> 
> Did you install the password into the Workstation using KSETUP?
> 
> Jeffrey Altman
> 
> Tyson Oswald wrote:
> > Hello all,
> >
> > I read the white paper on the MS site
> > (http://www.microsoft.com/windows2000/techinfo/planning/security/kerbsteps.asp)
> > to setup AD authentication on Unix. It is based on MIT KDC, but I am
> > using SEAM. Since SEAM is based on MIT, I assumed it would work. I
> > am using SEAM 1.0.1 on SPARC Solaris 8. I followed the instructions
> > in the white paper, and according to the event log on our PDC the user
> > authenticates successfully. But, the Service Ticket is failing
> > authentication. I am troubled as to why. The event id I am getting
> > in the event log is 677. The failure code is 0x0d (bad option) and
> > the ticket option is 0x02. According the the RFC 0x02 menas FORWARDED.
> >
> > Has anyone run into this error or know what is wrong?
> >
> > thank you,
> >
> > Tyson Oswald
> 
> ________________________________________________
> Kerberos mailing list Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos

-- 

Douglas E. Engert 
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439 
(630) 252-54444From deengert at anl.gov Thu Feb 19 15:05:38 2004
Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU
	[18.7.21.83])
	by pch.mit.edu (8.12.8p2/8.12.8) with ESMTP id i1JK5cqb010161
	for <kerberos at PCH.mit.edu>; Thu, 19 Feb 2004 15:05:38 -0500 (EST)
Received: from hermes.ctd.anl.gov (hermes.ctd.anl.gov [130.202.113.27])
	i1JK5bCD022293
	for <kerberos at mit.edu>; Thu, 19 Feb 2004 15:05:37 -0500 (EST)
Received: from hermes.ctd.anl.gov (localhost [127.0.0.1])
	by hermes.ctd.anl.gov (8.9.1a/8.9.1) with ESMTP id OAA12759
	for <kerberos at mit.edu>; Thu, 19 Feb 2004 14:05:36 -0600 (CST)
Received: from anl.gov (atalanta.ctd.anl.gov [146.137.194.4])
	by hermes.ctd.anl.gov (8.9.1a/8.9.1) with ESMTP id OAA12752;
	Thu, 19 Feb 2004 14:05:36 -0600 (CST)
Message-ID: <4035172C.F60ACDFF at anl.gov>
Date: Thu, 19 Feb 2004 14:06:04 -0600
From: "Douglas E. Engert" <deengert at anl.gov>
X-Mailer: Mozilla 4.79 [en] (Windows NT 5.0; U)
X-Accept-Language: en
MIME-Version: 1.0
To: Tyson Oswald <oswaldt at ameritech.net>
References: <20040219193637.32528.qmail at web80603.mail.yahoo.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
cc: kerberos at mit.edu
Subject: Re: Fwd: Re: Kerberos error authenticating from Unix to Windows AD
X-BeenThere: kerberos at mit.edu
X-Mailman-Version: 2.1
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Help: <mailto:kerberos-request at mit.edu?subject=help>
List-Post: <mailto:kerberos at mit.edu>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
	<mailto:kerberos-request at mit.edu?subject=subscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos>
List-Unsubscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
	<mailto:kerberos-request at mit.edu?subject=unsubscribe>
X-List-Received-Date: Thu, 19 Feb 2004 20:05:38 -0000



Tyson Oswald wrote:
> 
> I did a manual comparision between the two files like this
> 
> on Windows ktpass -in my.keytab
> 
> on unix klist -k -K
> 
> they are identical.
> 
> Any idea what the ticket option FORWARDED means?

It means the ticket was issued based on a previous TGT. i.e. this
is usually by delegations as done by GSSAPI.  That may not be the problem.


When you setup the servic e principal for the machine, it should have
had a name like host/myserver.ameritech.net at MY.REALM
where myserver.ameritech.net is the FQDN of the host, and MY.REALM
is the realm where hte host is registered. 

P.S. We have sun workstaions using pam_krb5 which allow one to login
to the workstaion fromn the console. We are using the MIT Kerberos, not
SEAM. 

Somethinhg else to try:  

login to the Sun using normal login. 

 Using the SEAM commands: 
  
  kinit user at realm
  klist -f -e

Then try 

  kinit -S t/myserver.ameritech.net at MY.REALM

which will ask for your user and password, then try and get a service ticket
for the host. 

Also look at the /etc/krb5.conf file. (I think SEAM uses the same locaiton.)


> 
> thanks,
> 
> Tyson Oswald
> 
> "Douglas E. Engert" <deengert at anl.gov> wrote:
> 
> Tyson Oswald wrote:
> >
> > Tyson Oswald wrote: I generated a host key on the a Windows server and installed it on the Sun workstation with ktutil. The key was generated with the same password as the user on windows. It was setup with DES-CBC-CRC enctype, also krb5.conf is setup to use des-cbc-crc for both tkt and tgs. One thing I did do was when I FTPed the host key to the Sun box I used binary instead of ascii, if that caused a problem I do not know. If you think this could cause this issue I will re-copy it.
> 
> Anyother way to do it is when you run the ktpass /out ...
> it will type out the entry on the console, and show the kvno and the
> DES key in hex.
> 
> You can then use the ktutil "addent -key" and type in the DES key in
> hex on the UNIX system. This avoids any string-to-key problems, as well
> as any transfer problems.
> 
> If nothing else you cold verify if the key and kvno is as expected
> by using klist -k -K ...
> 
> >
> > thank you,
> >
> > Tyson Oswald
> >
> > Jeffrey Altman wrote:
> > Do you have a host key for the Windows workstation?
> >
> > Does the Windows workstation know the name you have used for its host key?
> >
> > Is the host key restricted to use an enctype of DES-CBC-CRC?
> >
> > Did you create the host key with a password and not a random key?
> >
> > Did you install the password into the Workstation using KSETUP?
> >
> > Jeffrey Altman
> >
> > Tyson Oswald wrote:
> > > Hello all,
> > >
> > > I read the white paper on the MS site
> > > (http://www.microsoft.com/windows2000/techinfo/planning/security/kerbsteps.asp)
> > > to setup AD authentication on Unix. It is based on MIT KDC, but I am
> > > using SEAM. Since SEAM is based on MIT, I assumed it would work. I
> > > am using SEAM 1.0.1 on SPARC Solaris 8. I followed the instructions
> > > in the white paper, and according to the event log on our PDC the user
> > > authenticates successfully. But, the Service Ticket is failing
> > > authentication. I am troubled as to why. The event id I am getting
> > > in the event log is 677. The failure code is 0x0d (bad option) and
> > > the ticket option is 0x02. According the the RFC 0x02 menas FORWARDED.
> > >
> > > Has anyone run into this error or know what is wrong?
> > >
> > > thank you,
> > >
> > > Tyson Oswald
> >
> > ________________________________________________
> > Kerberos mailing list Kerberos at mit.edu
> > https://mailman.mit.edu/mailman/listinfo/kerberos
> 
> --
> 
> Douglas E. Engert
> Argonne National Laboratory
> 9700 South Cass Avenue
> Argonne, Illinois 60439
> (630) 252-5444
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos

-- 

 Douglas E. Engert  <DEEngert at anl.gov>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444


More information about the Kerberos mailing list