2013-11-09 14:58, Per Olofsson skrev:
I can confirm this bug as well and I've done some further experiments.
It seems that there is a problem with the kadmind in wheezy.
I'm running wheezy on both the KDC and the server. When I extract a new
keytab, I can't log in with ssh anymore. Running sshd in debug mode
(with -d), I get a GSS failure: "Wrong principal in request". However,
if I extract the keytab on the KDC with "kadmin -l" and copy it to the
server (as suggested in this bug report), then it works.
OK, I found the problem.
It seems that there is a new right in wheezy's kadmind called "get-keys"
which is necessary to extract keytabs. However:
* I already had "all" rights in /etc/heimdal-kdc/kadmind.acl.
Apparently, the "all" right does not include the "get-keys" right. I
changed to "all,get-keys" and now extracting keytabs works again.
* There is no error message in kadmin when trying to extract a keytab
without having the get-keys right. It just extracts principals but no
keys to the keytab.
* The documentation is ambiguous. The kadmind(8) man page mentions the
"get-keys" right, but does not say whether "all" includes it or not. The
example at the bottom seems to imply that "all" really includes all rights.
So something is wrong here. In my opinion, "all" rights should include
the get-keys right (it did so before), so it should simply be changed to
include it:
--- lib/kadm5/admin.h.orig 2013-11-09 15:37:20.000000000 +0100
+++ lib/kadm5/admin.h 2013-11-09 15:37:36.000000000 +0100
@@ -201,7 +201,7 @@
#define KADM5_PRIV_LIST (1 << 4)
#define KADM5_PRIV_CPW (1 << 5)
#define KADM5_PRIV_GET_KEYS (1 << 6)
-#define KADM5_PRIV_ALL (KADM5_PRIV_GET | KADM5_PRIV_ADD |
KADM5_PRIV_MODIFY | KADM5_PRIV_DELETE | KADM5_PRIV_LIST | KADM5_PRIV_CPW)
+#define KADM5_PRIV_ALL (KADM5_PRIV_GET | KADM5_PRIV_ADD |
KADM5_PRIV_MODIFY | KADM5_PRIV_DELETE | KADM5_PRIV_LIST | KADM5_PRIV_CPW
| KADM5_PRIV_GET_KEYS)
typedef struct _kadm5_config_params {
uint32_t mask;
But I'll ask upstream about it.
--
Pelle
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
