error reading keytab file krb5.keytab

Question

I've noticed these kerberos keytab error messages on both SLES 11.2 and CentOS 6.3:

sshd[31442]: pam_krb5[31442]: error reading keytab 'FILE: / etc/ krb5. keytab'

/etc/krb5.keytab does not exist on our hosts, and from what I understand of the keytab file, we don't need it. Per this kerberos keytab introduction:

A keytab is a file containing pairs of Kerberos principals and encrypted keys (these are derived from the Kerberos password). You can use this file to log into Kerberos without being prompted for a password. The most common personal use of keytab files is to allow scripts to authenticate to Kerberos without human interaction, or store a password in a plaintext file.

This sounds like something we do not need and is perhaps better security-wise to not have it.

How can I keep this error from popping up in our system logs? Here is my krb5.conf if its useful:

banjer@myhost:~> cat /etc/krb5.conf
# This file managed by Puppet
#
[libdefaults]
        default_tkt_enctypes = RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
        default_tgs_enctypes = RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
        preferred_enctypes = RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
        default_realm = FOO.EXAMPLE.COM
        dns_lookup_kdc = true
        clockskew = 300

[logging]
        default = SYSLOG:NOTICE:DAEMON
        kdc = FILE:/var/log/kdc.log
        kadmind = FILE:/var/log/kadmind.log

[appdefaults]
pam = {
        ticket_lifetime = 1d
        renew_lifetime = 1d
        forwardable = true
        proxiable = false
        retain_after_close = false
        minimum_uid = 0
        debug = false
        banner = "Enter your current"
}

Let me know if you need to see any other configs. Thanks.

EDIT

This message shows up in /var/log/secure whenever a non-root user logs in via SSH or the console. It seems to only occur with password-based authentication. If I do a key-based ssh to a server, I don't see the error. If I log in with root, I do not see the error. Our Linux servers authenticate against Active Directory, so its a hearty mix of PAM, samba, kerberos, and winbind that is used to authenticate a user.

Answer 1

Generally, the keytab file is required in order for your Linux host to "pre-authenticate" to the KDC (Active Directory) without a user inputting a password. Pre-authentication is part of the logon process by which your host gets it's own TGT.

When the user logs on to the server they are using their TGT to request a Service Ticket from the KDC to authenticate them to your host, but your host cannot validate that without it's own TGT. The host is attempting to resolve this by getting a TGT, but failing since it has no keytab file.

Key-based auth might be bypassing the kerberos config in PAM, and password auth is probably failing through kerberos to NTLM (via winbind).

Answer 2

As @ryan-fisher mentioned in his reply, the host needs a keytab file in order for it to be able to retrieve a TGT for preauth.

The reason the message isn't seen for root is because that user is local (does not need Kerberos for authentication). When using SSH authorized-keys, you also circumvent Kerberos, so there will be no error regaring missing keytab there either.

Now, what you need to do is to make sure that /etc/krb5.keytab contains the keys for the principal host/domain.name.of.host for the machine. Assuming the reverse DNS is correctly set up, you will then be able to log in using ssh without typing a password assuming you have a valid TGT.