From: "Aleksey Avdeev" <solo@solin.spb.ru> To: community@altlinux.ru Subject: [Comm] Неполучается поднять kerberos Date: Tue, 13 Jan 2004 16:03:21 +0300 Message-ID: <4003EC99.8030407@solin.spb.ru> (raw) [-- Attachment #1: Type: text/plain, Size: 2076 bytes --] Здравствуйте. Пользуясь krb5-install.html и книгой "Сетевые средства Linux" (Родерик В. Смит) поднимаю KDC на kerberos. Пока не получается. :-( После редактирования /etc/krb5.conf и /var/lib/kerberos/krb5kdc/kdc.conf (файлы прилагаю) немогу создать основных принципалов (и возможно, есть проблемы с основным ключом). Симптомы такие: 1. При добавлении принципала он не добавляется (первое что заметил): [solo@solo krb5kdc]$ sudo kadmin.local Authenticating as principal root/admin@MZ.OFFICE.RAMAX.RU with password. kadmin.local: addprinc admin/admin WARNING: no policy specified for admin/admin@MZ.OFFICE.RAMAX.RU; defaulting to no policy Enter password for principal "admin/admin@MZ.OFFICE.RAMAX.RU": Re-enter password for principal "admin/admin@MZ.OFFICE.RAMAX.RU": add_principal: Unsupported salt type while creating "admin/admin@MZ.OFFICE.RAMAX.RU". kadmin.local: listprincs K/M@MZ.OFFICE.RAMAX.RU kadmin/history@MZ.OFFICE.RAMAX.RU krbtgt/MZ.OFFICE.RAMAX.RU@MZ.OFFICE.RAMAX.RU kadmin.local: q 2. kdb5_util тоже ругается (после очередного kdb5_util destroy): [solo@solo krb5kdc]$ sudo kdb5_util create -r MZ.OFFICE.RAMAX.RU -s Loading random data Initializing database '/var/lib/kerberos/krb5kdc/principal' for realm 'MZ.OFFICE .RAMAX.RU', master key name 'K/M@MZ.OFFICE.RAMAX.RU' You will be prompted for the database Master Password. It is important that you NOT FORGET this password. Enter KDC database master key: Re-enter KDC database master key to verify: kdb5_util: Unsupported salt type while storing kadmin/admin@MZ.OFFICE.RAMAX.RU in Kerberos database. И в том и в другом случаи меня смущает диагностика "Unsupported *". При этом в логе (/var/log/kadmind.log) повторяются следующие строки: Jan 13 14:04:07 solo.mz.office.ramax.ru kdb5_util[23670](info): No dictionary file specified, continuing without one. Jan 13 15:10:08 solo.mz.office.ramax.ru kadmin.local[29982](info): No dictionary file specified, continuing without one. Т. е. чего-то я неучёл в настройках :-( Спасибо за внимание. -- С уважением. Алексей. [-- Attachment #2: krb5.conf --] [-- Type: text/plain, Size: 669 bytes --] [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] ticket_lifetime = 24000 default_realm = MZ.OFFICE.RAMAX.RU dns_lookup_realm = false dns_lookup_kdc = false [realms] MZ.OFFICE.RAMAX.RU = { kdc = solo.mz.office.ramax.ru:88 admin_server = solo.mz.office.ramax.ru:749 default_domain = mz.office.ramax.ru } [domain_realm] .mz.office.ramax.ru = MZ.OFFICE.RAMAX.RU mz.office.ramax.ru = MZ.OFFICE.RAMAX.RU [kdc] profile = /var/lib/kerberos/krb5kdc/kdc.conf [pam] debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false [-- Attachment #3: kdc.conf --] [-- Type: text/plain, Size: 330 bytes --] [kdcdefaults] acl_file = /var/lib/kerberos/krb5kdc/kadm5.acl dict_file = /usr/share/dict/words admin_keytab = /var/lib/kerberos/krb5kdc/kadm5.keytab [realms] MZ.OFFICE.RAMAX.RU = { master_key_type = des-cbc-crc supported_enctypes = rc4-hmac des-cbc-crc:normal des3-cbc-raw:normal des3-cbc-sha1:normal des-cbc-crc:afs3 } [-- Attachment #4: kadm5.acl --] [-- Type: text/plain, Size: 29 bytes --] */admin@MZ.OFFICE.RAMAX.RU *
next reply other threads:[~2004-01-13 13:03 UTC|newest] Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top 2004-01-13 13:03 Aleksey Avdeev [this message] 2004-01-13 13:21 ` Aleksey Avdeev 2004-01-15 14:09 ` Aleksey Avdeev
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=4003EC99.8030407@solin.spb.ru \ --to=solo@solin.spb.ru \ --cc=community@altlinux.ru \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
ALT Linux Community general discussions This inbox may be cloned and mirrored by anyone: git clone --mirror http://lore.altlinux.org/community/0 community/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 community community/ http://lore.altlinux.org/community \ mandrake-russian@linuxteam.iplabs.ru community@lists.altlinux.org community@lists.altlinux.ru community@lists.altlinux.com public-inbox-index community Example config snippet for mirrors. Newsgroup available over NNTP: nntp://lore.altlinux.org/org.altlinux.lists.community AGPL code for this site: git clone https://public-inbox.org/public-inbox.git