Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am setting my machine as a kerberos client. I have a question on how the kerberos config file actually take effect and how to clear its effect. My experiment is as follow.

Step 1, without editing the /etc/krb5.conf file, I typed kinit and got what I expected.

aaaa@bbbb:~> kinit
kinit(v5): Configuration file does not specify default realm when parsing name aaaa

Step 2, I edited /etc/krb5.conf to put in valid kerberos server information, and typed kinit again.

aaaa@bbbb:~> kinit 
Password for aaaa@bbbb:
pingluo@zhejiangNEW:~> klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: aaaa@bbbb

Valid starting     Expires            Service principal
08/13/14 11:36:34  08/13/14 21:36:34  krbtgt/bbbb@bbbb
    renew until 08/20/14 11:36:34

So I could get a valid kerberos ticket, which shows my configuration is correct.

Step 3, Destroy the credential with kdestroy.

Step 4, I deleted /etc/krb5.conf with the hope that this would clear kerberos config and kinit would show the message in step 1. But, I was surprised to see the message in step 2. So the kerberos config, while it had been deleted, was still in effect! I restarted my machine and it was still the same.

Can anybody explain what has happened and how can I get rid of kerberos completely? My machine runs OpenSUSE 13.1. The krb5 client is 1.11.3.

share|improve this question

2 Answers 2

It's possible it looked at your current cached credentials. Type kdestroy, then kinit and see if that clears it.

share|improve this answer
    
I should mention in my post that I did kdestroy before I typed kinit. It was the same. I Updated post. Thanks. –  user2196452 Aug 13 at 17:28

Kinit can also use DNS lookups to find the KDC for your realm. It looks for these records.

_kerberos._udp.EXAMPLE.COM. IN SRV 10 0 88 kdc1.example.com. _kerberos._udp.EXAMPLE.COM. IN SRV 20 0 88 kdc2.example.com. _kerberos-master._udp.EXAMPLE.COM. IN SRV 0 0 88 kdc1.example.com. _kerberos-adm._tcp.EXAMPLE.COM. IN SRV 0 0 749 kdc1.example.com. _kpasswd._udp.EXAMPLE.COM. IN SRV 0 0 464 kdc1.example.com.

You can turn this off by specifying options in the krb5.conf file. If that isn't the problem I suggest running strace on kinit to find out where it is getting the information from.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.