1

The command

sudo kprop -r MY.DOMAIN -f /var/lib/krb5kdc/slave_datatrans slave_kdc.my.domain

returns

kprop: Key table entry not found while getting initial credentials

This is a new installation on two linux debian servers. The master_kdc seems to work, but I cannot get the database to propagate. I manually copied the database dump and loaded it onto the slave_kdc, but the propagation still does not work.

/etc/krb5.conf

[libdefaults]
    default_realm = MY.DOMAIN
# The following krb5.conf variables are only for MIT Kerberos.
    kdc_timesync = 1
    ccache_type = 4
    forwardable = true
    proxiable = true

[realms]
    MY.DOMAIN = {
            kdc = master_kdc.my.domain
            kdc = slave_kdc.my.domain
            admin_server = master_kdc.my.domain
    }
[domain_realm]
    .my.domain = MY.DOMAIN
    my.domain = MY.DOMAIN

/etc/krb5kdc/kdc.conf

[kdcdefaults]
    kdc_ports = 750,88

[realms]
    MY.DOMAIN = {
        database_name = /var/lib/krb5kdc/principal
        admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
        acl_file = /etc/krb5kdc/kadm5.acl
        key_stash_file = /etc/krb5kdc/stash
        kdc_ports = 750,88
        max_life = 10h 0m 0s
        max_renewable_life = 7d 0h 0m 0s
        master_key_type = des3-hmac-sha1
        #supported_enctypes = aes256-cts:normal aes128-cts:normal
        default_principal_flags = +preauth
    }

[logging]
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmin.log
    default = FILE:/var/log/krb5lib.log

/etc/krb6kdc/kadm5/acl

john/admin@MY.DOMAIN        *

/etc/krb5kdc/kpropd.acl

host/master_kdc.my.domain@MY.DOMAIN
host/slave_kdc.my.domain@MY.DOMAIN

I installed xinetd and created the following file and enabled and started the xinetd service. /etc/xinetd.d/krb5_prop

service krb5_prop
{
    disable = no
    socket_type = stream
    protocol = tcp
    wait = no
    user = root
    server = /usr/sbin/kpropd
}

result of sudo cat /etc/services | grep krb5

kerberos    88/tcp      kerberos5 krb5 kerberos-sec # Kerberos v5
kerberos    88/udp      kerberos5 krb5 kerberos-sec # Kerberos v5
krb5_prop   754/tcp     krb-prop krb_prop hprop # Kerberos slave propagation

I generated the /etc/krb5.keytab file on master_kdc and on slave_kdc after copying over the database.

kadmin: ktadd host/slave_kdc.my.domain

Nothing is being logged (I don't know why).

/etc/bind/zones/db.my.domain

$TTL    604800
@       IN      SOA     master_kdc.my.domain. john.my.domain. (
                          5         ; Serial
                     604800         ; Refresh
                      86400         ; Retry
                    2419200         ; Expire
                     604800 )       ; Negative Cache TTL
;
; Name servers - NS records
@       IN      NS      master_kdc.my.domain.
@       IN      NS      slave_kdc.my.domain.

; Name servers - A records
master_kdc  IN      A      AAA.BBB.CCC.DD1
slave_kdc  IN      A       AAA.BBB.CCC.DD2

; Kerberos services
_kerberos._udp.MY.DOMAIN.   IN      SRV     1       0       88      master_kdc.my.domain.
_kerberos._tcp.MY.DOMAIN.   IN      SRV     1       0       88      master_kdc.my.domain.
_kerberos._udp.MY.DOMAIN.   IN      SRV     10      0       88      slave_kdc.my.domain.
_kerberos._tcp.MY.DOMAIN.   IN      SRV     10      0       88      slave_kdc.my.domain.
_kerberos-adm._tcp.MY.DOMAIN.       IN      SRV     1       0       749     master_kdc.my.domain.
_kpasswd._udp.MY.DOMAIN.   IN      SRV     1       0       464      master_kdc.my.domain.

/etc/bind/zones/db.AAA

$TTL    604800
@       IN      SOA     master_kdc.my.domain.   john.my.domain. (
                                    5       ; Serial
                               604800       ; Refresh
                                86400       ; Retry
                              2419200       ; Expire
                               604800 )     ; Negative Cache TTL
;
; Name servers - NS records
@       IN      NS      master_kdc.my.domain.
@       IN      NS      slave_kdc.my.domain.
master_kdc  IN      A       AAA.BBB.CCC.DD1
slave_kdc   IN      A       AAA.BBB.CCC.DD2

; Name servers - PTR records
DD1      IN      PTR     master_kdc.my.domain.
DD2      IN      PTR     slave_kdc.my.domain.
  • 1
    In your description I am missing the part were the keytabs are created and deployed. The file /etc/krb5kdc/kpropd.acl can have just one entry host/master_kdc.my.domain@MY.DOMAIN. Yes, you should get rid of the extra realms in /etc/krb5.conf. The file /etc/xinetd.d/krb5_prop should also contain an entry about the IP address of the service. In my config the service has the same name in /etc/services as /etc/xinetd.d/krb5_prop. – U880D Apr 27 '18 at 6:01
  • @U880D I edited the question to reflect light modifications and added a bit about generating the keytabs. I don't know what format to add the IP address to the xinetd.d/krb5_prop. – Paul B Apr 30 '18 at 15:59
  • 1
    During my setup I've experienced the same problem and learned that DNS is very important. For all hosts hostnames, FQDNs and PTRs were necessary. The dig and host command showed the rights entries for all involved nodes. The stash file was also important, I had to check my passwords. I'll try to check my notes for a more detailed description and/or step-by-step instructions. – U880D Apr 30 '18 at 16:13
  • I have exact the same problem. Do you got a solution or have you given up? With prefixed KRB5_TRACE=/dev/stdout kprop ... I get additional information: Looked up etypes in keytab: (empty). Yes, I have added all possible keys to the /etc/krb5.keytab. – Ingo Sep 4 '19 at 21:26
0

I spent few hours to resolve this exact same issue. Finally it was solved by this steps:

  1. create master host principal " addprinc host/mastr.comain.com "
  2. On master server, add to keytab the master host principal " ktadd host/mastr.comain.com"

Apparently kprop use "kinit -k" to get a ticket and this only work when you have your master host entry in keytab.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.