Package: krb5-user Version: 1.10.1+dfsg-3 Severity: important
Hi (@Russ: This is partially also, what I wrote you already in private). It seems that Debians Kerberos have some problems with using keytabs, at least with some remote KDCs. What I do is always about this. 1) Creating a keytab with: $ ktutil ktutil: add_entry -password -p [email protected] -k 1 -e arcfour-hmac-md5 Password for [email protected]: ktutil: wkt keytab ktutil: q $ 2) Trying it out with: $ kinit -k -t keytab [email protected] The password is always from the clipboard and correct as it works when I manually use kinit. When doing this under Scientific Linux 6, which has KRB 1.9, it just works as expected and I get my tgt. Under sid I get: kinit: Generic preauthentication failure while getting initial credentials Tried it of course with different algos, too, including aes256-cts-hmac-sha1-96 and des3-cbc-sha1. Under squeeze I get: kinit: Key table entry not found while getting initial credentials Interestingly, when using the realm/KDC of our local university, it works in Debian, too. According too the CERN support guys, they may be using ActiveDirectory. Could this be an error in either Debian itself or rather some upstream issue? Thanks, Chris. -- System Information: Debian Release: 7.0 APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 3.7-trunk-amd64 (SMP w/8 CPU cores) Locale: LANG=en_DE.UTF-8, LC_CTYPE=en_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages krb5-user depends on: ii krb5-config 2.3 ii libc6 2.13-38 ii libcomerr2 1.42.5-1 ii libgssapi-krb5-2 1.10.1+dfsg-3 ii libgssrpc4 1.10.1+dfsg-3 ii libk5crypto3 1.10.1+dfsg-3 ii libkadm5clnt-mit8 1.10.1+dfsg-3 ii libkadm5srv-mit8 1.10.1+dfsg-3 ii libkdb5-6 1.10.1+dfsg-3 ii libkeyutils1 1.5.5-4 ii libkrb5-3 1.10.1+dfsg-3 ii libkrb5support0 1.10.1+dfsg-3 ii libss2 1.42.5-1 krb5-user recommends no packages. krb5-user suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
