Can use kerberized telnet, but cannot use pam_krb5

[Ralf Hildebrandt]

I'm at my wits' end.

I'm trying to use a Win2k ADS/Kerberos Infrastructure with Debian
GNU/Linux clients.

What I can do on the host:

----------- snip ----------
# kinit -V hildeb
Password for hildeb at CHARITE.DE:
Authenticated to Kerberos v5

# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: hildeb at CHARITE.DE

Valid starting     Expires            Service principal
02/01/06 12:58:23  02/01/06 22:58:25  krbtgt/CHARITE.DE at CHARITE.DE
        renew until 02/02/06 12:58:23
	
	
Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached
----------- snip ----------

I can also use the kerberized telnetd (/usr/bin/telnet.krb5 from the
krb5-clients package) and log into that host successfully (with the
username & password that the win2k provides).

What I can't do: I'm trying to use 
libpam-krb5              1.2.0-1PAM module for MIT Kerberos

as PAM modules for OpenVPN:


----------- snip ----------
# PAM configuration for OpenVPN
auth                sufficient          pam_krb5.so debug ignore_root
account             required            pam_krb5.so debug ignore_root
----------- snip ----------

any login attempt from openvpn results in:

Jan 31 20:54:05 vpn-gw-int openvpn[3005]: (pam_krb5): none: pam_sm_authenticate: entry
Jan 31 20:54:05 vpn-gw-int openvpn[3005]: pam_krb5: openvpn-krb5
Jan 31 20:54:05 vpn-gw-int openvpn[3005]: pam_krb5: verify_krb_v5_tgt(): krb5_kt_read_service_key(): Key table entry not found
Jan 31 20:54:05 vpn-gw-int openvpn[3005]: (pam_krb5): hildeb: pam_sm_authenticate: exit (success)
Jan 31 20:54:05 vpn-gw-int openvpn[3005]: (pam_krb5): none: pam_sm_acct_mgmt: entry

and openvpn crashes afterwards...

Questions:
==========

What does "verify_krb_v5_tgt(): krb5_kt_read_service_key(): Key table entry not found" mean?
I probably need to get rid of that error in order to get things flying.

My /etc/krb5.conf is attached.

-- 
Ralf Hildebrandt (i.A. des IT-Zentrums)         Ralf.Hildebrandt at charite.de
Charite - Universitätsmedizin Berlin            Tel.  +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-Berlin    Fax.  +49 (0)30-450 570-962
IT-Zentrum Standort CBF                 send no mail to spamtrap at charite.de
-------------- next part --------------
[libdefaults]
  default_realm = CHARITE.DE
# das ist wirklich der Domainenname. Witzigerweise scheinen andere Institutionen immer
# DNS-Domaine == Win2k-Domaine zu machen. Bei uns ist das anders :(
# GROSSSCHREIBUNG ist wichtig!!

  clockskew = 300
  default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc
  default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc
#  dns_lookup_kdc = true

[realms]
  CHARITE.DE = {
#    kdc = DC-CHARITE-1.CHARITE.DE
#    kdc = dc-charite-2.charite.de
#    kdc = dc-charite-3.charite.de
    kdc = dc-charite-4.charite.de
    default_domain = CHARITE.DE
    kpasswd_server = DC-CHARITE-1.CHARITE.DE
  }

[domain_realm]
   .charite.de = CHARITE.DE

[logging]
  default = FILE:/var/log/krb5lib.log
  kdc = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmin.log
	    
[appdefaults]
  pam = {
    ticket_lifetime = 1d
    renew_lifetime = 1d
    forwardable = true
    proxiable = false
    retain_after_close = false
    minimum_uid = 0
    debug = true
  }