cisco & krb5
Tim Alsop
Tim.Alsop at CyberSafe.Ltd.UK
Wed Mar 24 10:13:17 EST 2004
Mahai,
I am not familiar with the ktadd utility that exports two keys into a keytab. Our KDC key table management utility does not work this way. Is it possible using your key table management utility to remove a specific key from the table ?
Sorry, but I cannot help with MIT specifics with regards to key table management - our product is not based on MIT code, but conforms to the same RFC's and Internet drafts. Maybe somebody else on this list can help you on this bit ?
Thanks, Tim.
-----Original Message-----
From: Mihai RUSU [mailto:dizzy at roedu.net]
Sent: 24 March 2004 15:17
To: Kerberos at mit.edu
Subject: RE: cisco & krb5
On Wed, 24 Mar 2004, Tim Alsop wrote:
> Mahai,
>
> I cannot see any issue with creating a service principal in KDC and
> extracting a DES-CBC key into a keytab, then using this keytab on the
> CISCO router. When you do this the user principal must also use
> DES-CBC-CRC or DES-CBC-MD5 etype.
The user principal (acording to klist -e) is "DES cbc mode with CRC-32,
Triple DES cbc mode with HMAC/sha1" so here it seems to be ok to have the
user principal with both DES and 3DES keys.
> It is not clear to me what you mean by having principals using
> DES3-<something> ? Which principal do you refer to (user or service) ?
> Can you give a specific example to help me understand what you are
> trying to do ?
Ok, sorry for not giving all the details. First it should be noted that my
kerberos experience is pretty small so I might confuse terms etc. But what
I ment to say is that when exporting keys (with ktadd) from kadmin by
default it exports for both DES and 3DES. Problem was (I think) that the
3DES is exported "first" in the keytab file than the DES one. When I
issued "kerberos srvtab remote" on the cisco device it said that it had
duplicat keys in the keytab file and that it "discarded" one of them (my
tests prove that the second one, ie the DES one was discarded). So it
couldnt decrypt the tickets encrypted from its own service key from the
KDC. When I modified krb5.conf and kdc.conf to use only DES, recreated the
service principal, reuploaded to the cisco device it worked (but as you
see I havent touched the user principal which was created with the default
options).
So what Im asking is how to either export only the DES key or some way to
remove the 3DES key from a file with both DES and 3DES keys exported (of
the same principal, the service principal).
> Tim.
--
Mihai RUSU Email: dizzy at roedu.net
GPG : http://dizzy.roedu.net/dizzy-gpg.txt WWW: http://dizzy.roedu.net
"Linux is obsolete" -- AST
________________________________________________
Kerberos mailing list Kerberos at mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
More information about the Kerberos
mailing list