up vote 0 down vote favorite
share [g+] share [fb]

I have a small problem of getting my client to authenticate to a kerberos server that I just setup. Whenever I run:

[root@localhost log]# kadmin -r KERBEROS.MONZELL.COM -p host/kerberos.monzell.com
Authenticating as principal host/kerberos.monzell.com with password.

I get the following message:

Password for host/kerberos.monzell.com@KERBEROS.MONZELL.COM: 
kadmin: Communication failure with server while initializing kadmin interface

On the server side, I see the following:

Sep 12 23:19:47 sl6 krb5kdc[6349](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.15.31: SERVER_NOT_FOUND: host/kerberos.monzell.com@KERBEROS.MONZELL.COM for kadmin/kerberos.monzell.com@KERBEROS.MONZELL.COM, Server not found in Kerberos database

Although it seems to be doing else afterwards:

Sep 12 23:19:47 sl6 krb5kdc[6349](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.15.31: ISSUE: authtime 1315883987, etypes {rep=18 tkt=18 ses=18}, host/kerberos.monzell.com@KERBEROS.MONZELL.COM for kadmin/admin@KERBEROS.MONZELL.COM
Sep 12 23:24:14 sl6 krb5kdc[6349](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.15.31: ISSUE: authtime 1315884254, etypes {rep=18 tkt=18 ses=18}, host/kerberos.monzell.com@KERBEROS.MONZELL.COM for kadmin/kerberos.monzell.com@KERBEROS.MONZELL.COM

I tried to a few principals to get it working:

kadmin.local:  listprincs
K/M@KERBEROS.MONZELL.COM
host/kerberos.monzell.com@KERBEROS.MONZELL.COM
host/kvm0001.monzell.com@KERBEROS.MONZELL.COM
kadmin/admin@KERBEROS.MONZELL.COM
kadmin/changepw@KERBEROS.MONZELL.COM
kadmin/kerberos.monzell.com@KERBEROS.MONZELL.COM
kadmin/sl6@KERBEROS.MONZELL.COM
ken@KERBEROS.MONZELL.COM
krbtgt/KERBEROS.MONZELL.COM@KERBEROS.MONZELL.COM
rilindo@KERBEROS.MONZELL.COM
root/admin@KERBEROS.MONZELL.COM

As well as adding the hostnames for the real and client on both the client's hosts file as well as the server hosts file (client is kvm0001.monzell.com, while the kerberos server is kerberos.monzell.com). So far, no success.

What direction should I go from here?

Both client and server are running Scientific Linux 6, BTW, the client being a KVM instance running on top of the server.

Let me add that yes, there is an option to enable Kerberos Authentication within the authconfig utility. However, it is my first time setting up a Kerberos server, so I don't know if it would actually work. Which is why I am going through this particular exercise.

link|improve this question
90% accept rate
Are you trying to get kerberos tickets for your client? or are you trying to kerberize the host? – 84104 Sep 14 '11 at 2:05
Yes to both questions. Let me add the OS information, while I am it. . . – Rilindo Sep 14 '11 at 2:09
feedback

1 Answer

up vote 0 down vote accepted

I figured it out - well, first of all, of all, it turns out that running kadmin was not the right way to test kerberos. Instead, I installed the kerberized server utilis at the KDC and then tested krsh with:

/usr/kerberos/bin/krsh -x -PN kerberos.monzell.com

As for kadmin, the error I was getting was because I need to open port 749 at the KDC:

iptables -I INPUT -s 192.168.15.0/24 -m tcp -p tcp --dport 749 -j ACCEPT

That resolved the issue and allow me to administer the KDC from the client box.

[root@localhost ~]# kadmin -p rilindo/admin@MONZELL.COM
Authenticating as principal rilindo/admin@MONZELL.COM with password.
Password for rilindo/admin@MONZELL.COM: 
kadmin:  listprincs
K/M@MONZELL.COM
host/kerberos.monzell.com@MONZELL.COM
host/kvm0007.monzell.com@MONZELL.COM
kadmin/admin@MONZELL.COM
kadmin/changepw@MONZELL.COM
kadmin/sl6@MONZELL.COM
krbtgt/MONZELL.COM@MONZELL.COM
rilindo/admin@MONZELL.COM
rilindo@MONZELL.COM
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.