> When I tried to give the following command: > > [r...@~]# /usr/local/libexec/kimpersonate -c testu...@mydomain -s > krbtgt/mydom...@mydomain -5 > > to test how kimpersonate works, I got the following error: > > kimpersonate: krb5_kt_get_entry: Failed to find krbtgt/mydom...@mydomain in > keytab ANY:FILE:/etc/krb5.keytab (des-cbc-md5)
>From http://www.h5l.org/blog/index.php/2006/09/kimpersonate/ : # kimpersonate -s host/[email protected] -c lha/[email protected] -t des3-cbc-sha1 -5 --ccache=FILE:/tmp/cache -k FILE:nutcracker-keytab So you want a afs/myc...@mydomain for user testu...@mydomain, don't you? (Or maybe a...@mydomain for user testu...@mydomain, if your setup is like that) That would be incomplete command# kimpersonate -s afs/myc...@mydomain -c testu...@mydomain then you have to figure out from where to take the secret. The easiest thing for you is probably to (safely!) copy the AFS key file from one of your AFS servers to /etc/my-AFS-KeyFile. Chmod 600 /etc/my-AFS-KeyFile !! incomplete command# kimpersonate -s afs/myc...@mydomain -c testu...@mydomain -k AFSKEYFILE:/etc/my-AFS-KeyFile The AFSKEYFILE: tells the Heimdal krb5 library that it is not in normal keytab format. Then you have to tell kimpersonate where to write the tickets and what format, so you probably end up with something like: root# KRB5CCNAME=/tmp/krb5cc_`id -u testuser` root# kimpersonate -s afs/myc...@mydomain -c testu...@mydomain -k AFSKEYFILE:/etc/my-AFS-KeyFile -t des3-cbc-sha1 -5 root# chown testuser $KRB5CCNAME testuser$ afslog -c mydomain testuser$ klist -T Credentials cache: FILE:/tmp/krb5cc_666 Principal: testu...@mydomain Issued Expires Principal Apr 1 11:53:29 May 1 11:53:28 afs/myc...@mydomain Apr 1 11:53:29 May 1 11:53:28 User's (AFS ID 666) tokens for mycell I made this example without any actual kimpersonate, so it is a little like dry swimming, so it might contain some errors. Remember: Everyone who can read your KeyFile can do anything with your AFS data in that cell. Harald. _______________________________________________ OpenAFS-info mailing list [email protected] https://lists.openafs.org/mailman/listinfo/openafs-info
