1.3.4: kadmin tries to open log file R/W

[Mike Friedman]

I just installed (on my test KDC) krb5-1.3.4 along with the two recent
patches (MITKRB5-SA-2004-002 and MITKRB5-SA-2004-003). One thing I notice
is that when I use kadmin from a non-privileged user, I get this message:

  Couldn't open log file /var/log/kerberos/kerberos.log: Permission denied

However, I am able to log in as administrator and my transactions do get
logged on the KDC.  It is the *client* kadmin that's trying to open the
log file R/W, for some reason.  The KDC, of course, which is the machine
I'm doing this on, has the KDC log file configured in its krb5.conf(*).

This is a definite change from 1.2.7, which I was running before.  In
fact, if I use the kadmin from 1.2.7 against this same 1.3.4 KDC, I have
no problem and don't get the above message.

Running 'truss' (this is Solaris 8), I see that kadmin is trying to open
the log file R/W.  Anyone know why this is, or should be?

(*) My krb5.conf on the KDC host has these entries, which are the same
ones I used with 1.2.7:

   [logging]
        kdc = FILE:/var/log/kerberos/kerberos.log
        admin_server = FILE:/var/log/kerberos/kerberos.log
        default = FILE:/var/log/kerberos/kerberos.log

I even tried changing the 'default' entry to a file in /tmp, in case
kadmin was using that entry for some kind of local logging.  But truss
shows that kadmin is still trying to open /var/log/kerberos/kerberos.log
R/W.

Any ideas?

Thanks.

Mike

------------------------------------------------------------------------------
Mike Friedman                             System and Network Security
mikef at ack.Berkeley.EDU                    2484 Shattuck Avenue
1-510-642-1410                            University of California at Berkeley
http://ack.Berkeley.EDU/~mikef            http://security.berkeley.edu
------------------------------------------------------------------------------