3

I am setting my machine as a kerberos client. I have a question on how the kerberos config file actually take effect and how to clear its effect. My experiment is as follow.

Step 1, without editing the /etc/krb5.conf file, I typed kinit and got what I expected.

aaaa@bbbb:~> kinit
kinit(v5): Configuration file does not specify default realm when parsing name aaaa

Step 2, I edited /etc/krb5.conf to put in valid kerberos server information, and typed kinit again.

aaaa@bbbb:~> kinit 
Password for aaaa@bbbb:
pingluo@zhejiangNEW:~> klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: aaaa@bbbb

Valid starting     Expires            Service principal
08/13/14 11:36:34  08/13/14 21:36:34  krbtgt/bbbb@bbbb
    renew until 08/20/14 11:36:34

So I could get a valid kerberos ticket, which shows my configuration is correct.

Step 3, Destroy the credential with kdestroy.

Step 4, I deleted /etc/krb5.conf with the hope that this would clear kerberos config and kinit would show the message in step 1. But, I was surprised to see the message in step 2. So the kerberos config, while it had been deleted, was still in effect! I restarted my machine and it was still the same.

Can anybody explain what has happened and how can I get rid of kerberos completely? My machine runs OpenSUSE 13.1. The krb5 client is 1.11.3.

2 Answers 2

2

Kinit can also use DNS lookups to find the KDC for your realm. It looks for these records.

_kerberos._udp.EXAMPLE.COM. IN SRV 10 0 88 kdc1.example.com. _kerberos._udp.EXAMPLE.COM. IN SRV 20 0 88 kdc2.example.com. _kerberos-master._udp.EXAMPLE.COM. IN SRV 0 0 88 kdc1.example.com. _kerberos-adm._tcp.EXAMPLE.COM. IN SRV 0 0 749 kdc1.example.com. _kpasswd._udp.EXAMPLE.COM. IN SRV 0 0 464 kdc1.example.com.

You can turn this off by specifying options in the krb5.conf file. If that isn't the problem I suggest running strace on kinit to find out where it is getting the information from.

1

It's possible it looked at your current cached credentials. Type kdestroy, then kinit and see if that clears it.

1
  • I should mention in my post that I did kdestroy before I typed kinit. It was the same. I Updated post. Thanks. Aug 13, 2014 at 17:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .