Hello,
I have noticed a problem with kadmin -l dump/load when a principal
has a long list of previous passwords where it eventually will fail to
be restored:
===
root@kdc-lab-master1:~# kadmin -l get testprinc
Principal: [email protected]
Principal expires: never
Password expires: never
Last password change: 2017-11-06 12:07:27 UTC
Max ticket life: 1 day
Max renewable life: 1 week
Kvno: 1
Mkvno: unknown
Last successful login: never
Last failed login: never
Failed login count: 0
Last modified: 2017-11-06 12:07:27 UTC
Modifier: kadmin/[email protected]
Attributes:
Keytypes: aes256-cts-hmac-sha1-96(pw-salt)[1],
des3-cbc-sha1(pw-salt)[1], arcfour-hmac-md5(pw-salt)[1]
PK-INIT ACL:
Aliases:
===
A dump and load works without complaints:
===
root@kdc-lab-master1:~# kadmin -l dump hdb-backup
root@kdc-lab-master1:~# kadmin -l load hdb-backup
===
Changing the password once and everything is still fine:
===
root@kdc-lab-master1:~# kadmin -l cpw -p test --keepold testprinc
root@kdc-lab-master1:~# kadmin -l get testprinc
Principal: [email protected]
Principal expires: never
Password expires: never
Last password change: 2017-11-06 16:25:57 UTC
Max ticket life: 1 day
Max renewable life: 1 week
Kvno: 2
Mkvno: unknown
Last successful login: never
Last failed login: never
Failed login count: 0
Last modified: 2017-11-06 16:25:57 UTC
Modifier: kadmin/[email protected]
Attributes:
Keytypes: aes256-cts-hmac-sha1-96(pw-salt)[2],
des3-cbc-sha1(pw-salt)[2], arcfour-hmac-md5(pw-salt)[2],
aes256-cts-hmac-sha1-96(pw-salt)[1], des3-cbc-sha1(pw-salt)[1],
arcfour-hmac-md5(pw-salt)[1]
PK-INIT ACL:
Aliases:
===
A dump and load still works:
===
root@kdc-lab-master1:~# kadmin -l dump hdb-backup
root@kdc-lab-master1:~# kadmin -l load hdb-backup
===
However, doing the password change a few more times and the restore will
break. For me the magic number seems to be kvno 12. Here is an example
just before it breaks:
===
root@kdc-lab-master1:~# kadmin -l cpw -p test --keepold testprinc
[...]
root@kdc-lab-master1:~# kadmin -l get testprinc
Principal: [email protected]
Principal expires: never
Password expires: never
Last password change: 2017-11-06 16:28:39 UTC
Max ticket life: 1 day
Max renewable life: 1 week
Kvno: 11
Mkvno: unknown
Last successful login: never
Last failed login: never
Failed login count: 0
Last modified: 2017-11-06 16:28:39 UTC
Modifier: kadmin/[email protected]
Attributes:
Keytypes: aes256-cts-hmac-sha1-96(pw-salt)[11],
des3-cbc-sha1(pw-salt)[11], arcfour-hmac-md5(pw-salt)[11],
aes256-cts-hmac-sha1-96(pw-salt)[1], des3-cbc-sha1(pw-salt)[1],
arcfour-hmac-md5(pw-salt)[1], aes256-cts-hmac-sha1-96(pw-salt)[2],
des3-cbc-sha1(pw-salt)[2], arcfour-hmac-md5(pw-salt)[2],
aes256-cts-hmac-sha1-96(pw-salt)[3], des3-cbc-sha1(pw-salt)[3],
arcfour-hmac-md5(pw-salt)[3], aes256-cts-hmac-sha1-96(pw-salt)[4],
des3-cbc-sha1(pw-salt)[4], arcfour-hmac-md5(pw-salt)[4],
aes256-cts-hmac-sha1-96(pw-salt)[5], des3-cbc-sha1(pw-salt)[5],
arcfour-hmac-md5(pw-salt)[5], aes256-cts-hmac-sha1-96(pw-salt)[6],
des3-cbc-sha1(pw-salt)[6], arcfour-hmac-md5(pw-salt)[6],
aes256-cts-hmac-sha1-96(pw-salt)[7], des3-cbc-sha1(pw-salt)[7],
arcfour-hmac-md5(pw-salt)[7], aes256-cts-hmac-sha1-96(pw-salt)[8],
des3-cbc-sha1(pw-salt)[8], arcfour-hmac-md5(pw-salt)[8],
aes256-cts-hmac-sha1-96(pw-salt)[9], des3-cbc-sha1(pw-salt)[9],
arcfour-hmac-md5(pw-salt)[9], aes256-cts-hmac-sha1-96(pw-salt)[10],
des3-cbc-sha1(pw-salt)[10], arcfour-hmac-m
PK-INIT ACL:
Aliases:
===
.... and a dump/load works:
===
root@kdc-lab-master1:~# kadmin -l dump hdb-backup
root@kdc-lab-master1:~# kadmin -l load hdb-backup
===
However, doing one additional increment will push it past the breaking point:
===
root@kdc-lab-master1:~# kadmin -l cpw -p test --keepold testprinc
root@kdc-lab-master1:~# kadmin -l get testprinc
Principal: [email protected]
Principal expires: never
Password expires: never
Last password change: 2017-11-06 16:32:35 UTC
Max ticket life: 1 day
Max renewable life: 1 week
Kvno: 12
Mkvno: unknown
Last successful login: never
Last failed login: never
Failed login count: 0
Last modified: 2017-11-06 16:32:35 UTC
Modifier: kadmin/[email protected]
Attributes:
Keytypes: aes256-cts-hmac-sha1-96(pw-salt)[12],
des3-cbc-sha1(pw-salt)[12], arcfour-hmac-md5(pw-salt)[12],
aes256-cts-hmac-sha1-96(pw-salt)[1], des3-cbc-sha1(pw-salt)[1],
arcfour-hmac-md5(pw-salt)[1], aes256-cts-hmac-sha1-96(pw-salt)[2],
des3-cbc-sha1(pw-salt)[2], arcfour-hmac-md5(pw-salt)[2],
aes256-cts-hmac-sha1-96(pw-salt)[3], des3-cbc-sha1(pw-salt)[3],
arcfour-hmac-md5(pw-salt)[3], aes256-cts-hmac-sha1-96(pw-salt)[4],
des3-cbc-sha1(pw-salt)[4], arcfour-hmac-md5(pw-salt)[4],
aes256-cts-hmac-sha1-96(pw-salt)[5], des3-cbc-sha1(pw-salt)[5],
arcfour-hmac-md5(pw-salt)[5], aes256-cts-hmac-sha1-96(pw-salt)[6],
des3-cbc-sha1(pw-salt)[6], arcfour-hmac-md5(pw-salt)[6],
aes256-cts-hmac-sha1-96(pw-salt)[7], des3-cbc-sha1(pw-salt)[7],
arcfour-hmac-md5(pw-salt)[7], aes256-cts-hmac-sha1-96(pw-salt)[8],
des3-cbc-sha1(pw-salt)[8], arcfour-hmac-md5(pw-salt)[8],
aes256-cts-hmac-sha1-96(pw-salt)[9], des3-cbc-sha1(pw-salt)[9],
arcfour-hmac-md5(pw-salt)[9], aes256-cts-hmac-sha1-96(pw-salt)[10],
des3-cbc-sha1(pw-salt)[10], arcfour-hmac-m
PK-INIT ACL:
Aliases:
===
While it can still be displayed with kadmin (and authenticated to with kinit)
the dump and load will fail:
===
root@kdc-lab-master1:~# kadmin -l load hdb-backup
hdb-backup:2:error parsing extension
(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
hdb-backup:3:error parsing keys ()
===
... and the principal is missing from the restored database:
===
root@kdc-lab-master1:~# kadmin -l get testprinc
kadmin: get testprinc: Principal does not exist
===
Line 2 above matches the testprinc principal (and the XXXXX part matches
part of the string in the dump file), I am not sure why the problem
seems to leak over to line 3. I have actually seen it cause errors for
up to 3 followup lines.
You might wonder "why would anyone ever use --keepold with kadmin like
this" and while you will probably not do that, the bigger problem is
that kpasswdd does this unconditionally (I asked about that on an
unrelated note a while back but it went unanswered:
http://www.h5l.org/pipermail/heimdal-discuss/2016-October/000047.html).
This means backups of the database will become useless when users change
their password via kpasswdd one too many times.
I have not yet done a deep dive of this, but I guess there can be three
points where the problem might live: A problem with the heimdal.db
internal format, a problem with the kadmin dump command, or a problem
with the kadmin load command. The fact that I am able to kinit with the
account (prior to dump/load where it disappears) makes me want to zero
in on the kadmin code.
--
Patrik Lundin
