Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When running kvno imap/prueba-mail.ejemplo.org@EJEMPLO.ORG get the following error: kvno: Server not found in Kerberos database while getting credentials for imap/prueba-mail.ejemplo.org@EJEMPLO.ORG

I show the settings and steps taken as well as catches in wireshark and I hope I can give a help.

I have a Windows Server 2003 with AD whose IP is yyy.yyy.yyy.yyy and his name is win2003. Users clients use Windows and have installed Kerberos For Windows and Thunderbird as mail client.

I have also a computer with Centos 6 whose ip is xxx.xxx.xxx.xxx and his name is prueba-mail you install Postfix + Cyrus Imap. If I do nslookup yyy.yyy.yyy.yyy from the computer that has Centos 6 operates correctly. If I do nslookup xxx.xxx.xxx.xxx from the computer that has Windows Server 2003 works correctly.

I want to have sso from Windows clients so follow the steps was:

1) Create a user in AD for each service (imap, etc. ..). These users have enabled "Use DES encryption types for this account", "Do not require Kerberos pre-authentication", "User can not change password","Password never expires".

2) When I run setspn -L in the windows 2003, shows the following:

host/prueba-mail.ejemplo.org
imap/prueba-mail.ejemplo.org

3) In Windows 2003, run the following commands:

Ktpass -princ host/prueba-mail.ejemplo.org@EJEMPLO.ORG -mapuser host -pass password -crypto DES-CBC-MD5 -out UNIXhost.keytab

Ktpass -princ imap/prueba-mail.ejemplo.org@EJEMPLO.ORG -mapuser imap -pass password -crypto DES-CBC-MD5 -out UNIXimap.keytab

4) In the UNIXhost.keytab add UNIXimap.keytab Then I made two copies of UNIXhost.keytab to /etc/krb5.keytab and /etc/krb5.keytab.cyrus Also run chown cyrus /etc/krb5.keytab.cyrus

I show configurations + wireshark capture.

---------------------------------------- /etc/krb5.conf ----------------------------------------------------------------

[logging]
        default = /var/log/krb5libs.log
        kdc = /var/log/krb5kdc.log
 admin_server = /var/log/kadmind.log
[libdefaults]
    default_realm = EJEMPLO.ORG
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true
        fcc-mit-ticketflags = true
        default_keytab_name = FILE:/etc/krb5.keytab
        allow_weak_crypto = yes
[realms]
    EJEMPLO.ORG = {
            kdc = YYY.YYY.YYY.YYY:88
            admin_server = YYY.YYY.YYY.YYY
            password_server = YYY.YYY.YYY.YYY
            default_domain = EJEMPLO.ORG

    }

[domain_realm]
.ejemplo.org = EJEMPLO.ORG
[login]
    krb4_convert = false

---------------------------------- requested (wireshark) -------------------------------

No.     Time        Source                Destination           Protocol Info
 109625 191.215550  xxx.xxx.xxx.xxx       yyy.yyy.yyy.yyy       KRB5     TGS-REQ

Frame 109625 (681 bytes on wire, 681 bytes captured)
    Arrival Time: Jul 17, 2013 17:34:59.991270000
    [Time delta from previous captured frame: 0.014822000 seconds]
    [Time delta from previous displayed frame: 191.215550000 seconds]
    [Time since reference or first frame: 191.215550000 seconds]
    Frame Number: 109625
    Frame Length: 681 bytes
    Capture Length: 681 bytes
    [Frame is marked: False]
    [Protocols in frame: eth:ip:udp:kerberos]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: CadmusCo_13:dd:bd (08:00:27:13:dd:bd), Dst: Ibm_a5:b3:46 (00:09:6b:a5:b3:46)
    Destination: Ibm_a5:b3:46 (00:09:6b:a5:b3:46)
        Address: Ibm_a5:b3:46 (00:09:6b:a5:b3:46)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: CadmusCo_13:dd:bd (08:00:27:13:dd:bd)
        Address: CadmusCo_13:dd:bd (08:00:27:13:dd:bd)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: yyy.yyy.yyy.yyy (yyy.yyy.yyy.yyy)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 667
    Identification: 0x25c6 (9670)
    Flags: 0x02 (Don't Fragment)
        0.. = Reserved bit: Not Set
        .1. = Don't fragment: Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 64
    Protocol: UDP (0x11)
    Header checksum: 0xc79b [correct]
        [Good: True]
        [Bad : False]
    Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
    Destination: yyy.yyy.yyy.yyy (yyy.yyy.yyy.yyy)
User Datagram Protocol, Src Port: 58345 (58345), Dst Port: kerberos (88)
    Source port: 58345 (58345)
    Destination port: kerberos (88)
    Length: 647
    Checksum: 0x4d89 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Kerberos TGS-REQ
    Pvno: 5
    MSG Type: TGS-REQ (12)
    padata: PA-TGS-REQ
        Type: PA-TGS-REQ (1)
            Value: 6E8201D6308201D2A003020105A10302010EA20703050000... AP-REQ
                Pvno: 5
                MSG Type: AP-REQ (14)
                Padding: 0
                APOptions: 00000000
                    .0.. .... .... .... .... .... .... .... = Use Session Key: Do NOT use the session key to encrypt the ticket
                    ..0. .... .... .... .... .... .... .... = Mutual required: Mutual authentication is NOT required
                Ticket
                    Tkt-vno: 5
                    Realm: EJEMPLO.ORG
                    Server Name (Service and Instance): krbtgt/EJEMPLO.ORG
                        Name-type: Service and Instance (2)
                        Name: krbtgt
                        Name: EJEMPLO.ORG
                    enc-part rc4-hmac
                        Encryption type: rc4-hmac (23)
                        Kvno: 2
                        enc-part: 61BCF5140DC42B2D3963D13F7784BEAAFE642F9EB7ADE907...
                Authenticator rc4-hmac
                    Encryption type: rc4-hmac (23)
                    Authenticator data: AA6A2E97EF2F71052880E7004209B535DC5ACBE517063A17...
    KDC_REQ_BODY
        Padding: 0
        KDCOptions: 50810000 (Forwardable, Proxiable, Renewable, Canonicalize)
            .1.. .... .... .... .... .... .... .... = Forwardable: FORWARDABLE tickets are allowed/requested
            ..0. .... .... .... .... .... .... .... = Forwarded: This is NOT a forwarded ticket
            ...1 .... .... .... .... .... .... .... = Proxiable: PROXIABLE tickets are allowed/requested
            .... 0... .... .... .... .... .... .... = Proxy: This ticket has NOT been proxied
            .... .0.. .... .... .... .... .... .... = Allow Postdate: We do NOT allow the ticket to be postdated
            .... ..0. .... .... .... .... .... .... = Postdated: This ticket is NOT postdated
            .... .... 1... .... .... .... .... .... = Renewable: This ticket is RENEWABLE
            .... .... ...0 .... .... .... .... .... = Opt HW Auth: False
            .... .... .... ..0. .... .... .... .... = Constrained Delegation: This is a normal request (no constrained delegation)
            .... .... .... ...1 .... .... .... .... = Canonicalize: This is a request for a CANONICALIZED ticket
            .... .... .... .... .... .... ..0. .... = Disable Transited Check: Transited checking is NOT disabled
            .... .... .... .... .... .... ...0 .... = Renewable OK: We do NOT accept renewed tickets
            .... .... .... .... .... .... .... 0... = Enc-Tkt-in-Skey: Do NOT encrypt the tkt inside the skey
            .... .... .... .... .... .... .... ..0. = Renew: This is NOT a request to renew a ticket
            .... .... .... .... .... .... .... ...0 = Validate: This is NOT a request to validate a postdated ticket
        Realm: EJEMPLO.ORG
        Server Name (Principal): imap/prueba-mail.ejemplo.org
            Name-type: Principal (1)
            Name: imap
            Name: prueba-mail.ejemplo.org
        till: 2013-07-18 06:32:17 (UTC)
        Nonce: 1374093338
        Encryption Types: aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 rc4-hmac des-cbc-crc des-cbc-md5 des-cbc-md4
            Encryption type: aes256-cts-hmac-sha1-96 (18)
            Encryption type: aes128-cts-hmac-sha1-96 (17)
            Encryption type: des3-cbc-sha1 (16)
            Encryption type: rc4-hmac (23)
            Encryption type: des-cbc-crc (1)
            Encryption type: des-cbc-md5 (3)
            Encryption type: des-cbc-md4 (2)

--------------------------------- reply (wireshark) --------------------------------------

No.     Time        Source                Destination           Protocol Info
 109626 191.217040  yyy.yyy.yyy.yyy       xxx.xxx.xxx.xxx       KRB5     KRB Error: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN

Frame 109626 (171 bytes on wire, 171 bytes captured)
    Arrival Time: Jul 17, 2013 17:34:59.992760000
    [Time delta from previous captured frame: 0.001490000 seconds]
    [Time delta from previous displayed frame: 0.001490000 seconds]
    [Time since reference or first frame: 191.217040000 seconds]
    Frame Number: 109626
    Frame Length: 171 bytes
    Capture Length: 171 bytes
    [Frame is marked: False]
    [Protocols in frame: eth:ip:udp:kerberos]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: Ibm_a5:b3:46 (00:09:6b:a5:b3:46), Dst: CadmusCo_13:dd:bd (08:00:27:13:dd:bd)
    Destination: CadmusCo_13:dd:bd (08:00:27:13:dd:bd)
        Address: CadmusCo_13:dd:bd (08:00:27:13:dd:bd)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Ibm_a5:b3:46 (00:09:6b:a5:b3:46)
        Address: Ibm_a5:b3:46 (00:09:6b:a5:b3:46)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: yyy.yyy.yyy.yyy (yyy.yyy.yyy.yyy), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 157
    Identification: 0x7913 (30995)
    Flags: 0x00
        0.. = Reserved bit: Not Set
        .0. = Don't fragment: Not Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x764c [correct]
        [Good: True]
        [Bad : False]
    Source: yyy.yyy.yyy.yyy (yyy.yyy.yyy.yyy)
    Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
User Datagram Protocol, Src Port: kerberos (88), Dst Port: 58345 (58345)
    Source port: kerberos (88)
    Destination port: 58345 (58345)
    Length: 137
    Checksum: 0xa6b2 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Kerberos KRB-ERROR
    Pvno: 5
    MSG Type: KRB-ERROR (30)
    stime: 2013-07-17 20:35:39 (UTC)
    susec: 806620
    error_code: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN (7)
    Realm: EJEMPLO.ORG
    Server Name (Principal): imap/prueba-mail.ejemplo.org
        Name-type: Principal (1)
        Name: imap
        Name: prueba-mail.ejemplo.org
    e-data
share|improve this question
    
I try running "kvno imap" no failure, but generated a ticke for imap@EJEMPLO.ORG. Why could not I be allowed to "kvno imap/test-mail.ejemplo.org@EJEMPLO.ORG"? –  Maria José Jul 22 '13 at 19:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.