gmane.comp.encryption.kerberos.heimdal.general

Re: Network Identity manager, heimdal and change password

Christian — 2013-05-24T06:53:57

Oh, that explains it. Thanks,

Christian

Am 22.05.2013 16:24, schrieb Paul Robert Marino:

Kerberos Change password

2013-05-22T16:07:24

Hi,

My mac app allows users to change their AD passwords. while everything works
fine I've this case at one client where, when I call krb5_set_password the
password is changed but API returns (4) soft error.

What could be going wrong?

Re: Network Identity manager, heimdal and change password

Paul Robert Marino — 2013-05-22T14:24:16

kpasswd from Heimdal is compatible with MIT Kerberos 5 KDC; however
Heimdals kadmin APIs are different and not compatible with MIT Kerberos 5
KDC.
it looks like network identity manager is using kadmin instead of kpasswd.
so either network identity manager to use kpasswd or you need to migrate to
a Heimdal KDC.



On Wed, May 22, 2013 at 9:48 AM, Christian <chanlists< at >googlemail.com> wrote:

Network Identity manager, heimdal and change password

Christian — 2013-05-22T13:48:48

All,

we are using network identity manager (2.102.907) and Heimdal (1.5) on 
x64 Windows 7. Using kpasswd in a cmd window allows me to change my 
password; when I click on the "change password" button in the network 
identity manager, it prompts for existing and new passwords, but then 
gives me "generic error (see e-text)". The kdc is MIT.

When using the network identity manger, I only get the kadmin/changepw 
AS_REQ in the KDC logs.

When using cmd and kpasswd, I also get the setpw request: success log 
message.

What is going on here?

Best ,

Christian

Re: Kerberos SSH

Victor Sudakov — 2013-05-20T02:17:04

[dd]


I somehow don't like this line. For me the sshd says at this point:
"debug1: Received some client credentials"

Are you sure you have got the correct ticket? What does 'klist -v'
show on the client?

What does "ktutil list" on the FreeBSD server say?  Have you imported
the correct key into the server's keytab?

What's in /etc/krb5.conf on the FreeBSD server?

Re: Kerberos SSH

Martin Häggström — 2013-05-18T22:12:07

Hi!

I am not using GSSAPIKeyExchange on the FreeBSD machine because there is
no support for it. But that shouldn't be the problem??

Cheers Martin



<-----Ursprungligt Meddelande----->

  From: Harald Barth [haba< at >kth.se]
Sent: 17/5/2013 11:00:44 PM
To: hejpadej< at >spray.se
Cc: heimdal-discuss< at >sics.se
Subject: Re: Kerberos SSH 

Hm? Is GSSAPIKeyExchange = yes in _both_ ends and why does the log 
not contain any refs to gssapi-with-kex? 

Harald. 
. 



<P><p><font face="Arial, Helvetica, sans-serif" size="2" style="font-size:13.5px">_______________________________________________________________<BR>Annons: <a href="http://blimedlem.spray.se/">Skaffa Spray Mail du också - Gratis, enkelt och säkert!</a></font>

Re: Kerberos SSH

Harald Barth — 2013-05-17T21:00:44

Hm? Is GSSAPIKeyExchange = yes in _both_ ends and why does the log
not contain any refs to gssapi-with-kex?

Harald.

Re: Kerberos SSH

Martin Häggström — 2013-05-17T19:40:30

Hi!


<-----Ursprungligt Meddelande----->

  From: Harald Barth [haba< at >kth.se]
Sent: 17/5/2013 6:41:20 AM
To: heimdal-discuss< at >sics.se;hejpadej< at >spray.se
Subject: Re: Kerberos SSH 

receive 

Looks to me you sent the logs of the client side. Please send 
the log of the server side, the one that starts with something 
like: 

debug2: load_server_config: filename /etc/ssh/sshd_config 
debug2: load_server_config: done config len = 471 
debug2: parse_server_config: config /etc/ssh/sshd_config len 471 
debug3: /etc/ssh/sshd_config:15 setting Protocol 2 
debug3: /etc/ssh/sshd_config:43 setting RSAAuthentication no 
debug3: /etc/ssh/sshd_config:45 setting PubkeyAuthentication no 
debug3: /etc/ssh/sshd_config:60 setting PasswordAuthentication no 
debug3: /etc/ssh/sshd_config:65 setting ChallengeResponseAuthentication
no 
debug3: /etc/ssh/sshd_config:74 setting GSSAPIAuthentication yes 
debug3: /etc/ssh/sshd_config:77 setting GSSAPICleanupCredentials no 
debug3: /etc/ssh/sshd_config:80 setting GSSAPIKeyExchange yes 
(

Re: Kerberos SSH

Harald Barth — 2013-05-17T04:41:20


Looks to me you sent the logs of the client side. Please send
the log of the server side, the one that starts with something
like:

debug2: load_server_config: filename /etc/ssh/sshd_config
debug2: load_server_config: done config len = 471
debug2: parse_server_config: config /etc/ssh/sshd_config len 471
debug3: /etc/ssh/sshd_config:15 setting Protocol 2
debug3: /etc/ssh/sshd_config:43 setting RSAAuthentication no
debug3: /etc/ssh/sshd_config:45 setting PubkeyAuthentication no
debug3: /etc/ssh/sshd_config:60 setting PasswordAuthentication no
debug3: /etc/ssh/sshd_config:65 setting ChallengeResponseAuthentication no
debug3: /etc/ssh/sshd_config:74 setting GSSAPIAuthentication yes
debug3: /etc/ssh/sshd_config:77 setting GSSAPICleanupCredentials no
debug3: /etc/ssh/sshd_config:80 setting GSSAPIKeyExchange yes
(...)

Harald.

Re: Kerberos SSH

Victor Sudakov — 2013-05-17T01:45:55

In fact, he did do that, and sshd's debug output was given below.
But the message from the server: 
"Failed gssapi-with-mic for martin from 192.168.1.216 port 54878 ssh2" 
was not very informative.

Re: Kerberos SSH

Richard E. Silverman — 2013-05-16T18:25:59


The client-side debug doesn't tell you much; I suggest you run a
debugging instance of sshd (e.g. /usr/sbin/sshd -dep2222) and connect to
it (ssh -p2222 ...).

- Richard

Re: Kerberos SSH

Victor Sudakov — 2013-05-16T15:43:30

It did work for me. What does "ktutil list" on the FreeBSD server say?
Have you imported the correct key into the server's keytab?

What's in /etc/krb5.conf on the FreeBSD server?

Kerberos SSH

Martin Häggström — 2013-05-16T15:16:25

Hi again!

Some of you have followed me through my attempts to use kerberized
services. I have managed to ssh from both Ubuntu and FreeBSD to an
Ubuntuserver. Right now I am trying to ssh from Ubuntu and FreeBSD to a
FreeBSD ssh server. I can get the ticket from the kdc on Ubuntu but have
problem reaching the FreeBSD server. I started the ssh server on FreeBSD
like this, /usr/sbin/sshd -ddd -p 2020. It looks like it doesn't receive
any credentials from the clients as you can see in the debug.

Ubuntu ubuntuclient.hemma.local

ssh -vvv -p 2020 martin< at >testserver.hemma.local
<mailto:martin< at >testserver.hemma.local> 
debug3: preferred gssapi-with-mic
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: 
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug2: we sent a gssapi-with-mic packet, wait for reply
debug1: Authentications that can continue:
publickey,gssapi-with-mic,keyboard-interactive
debug2: we sent a gssapi-with-mic packet, wait for re

Re: Server unknown

Martin Häggström — 2013-05-11T20:18:21

Hi!

Thansk for the answer. After a little investigation I found out that the
dns-domain was not set up properly. After a little configuration
everything worked like it should.

Cheers Martin.



<-----Ursprungligt Meddelande----->

  From: Love Hörnquist Åstrand [lha< at >kth.se]
Sent: 7/5/2013 8:41:06 PM
To: heimdal-discuss< at >sics.se;hejpadej< at >spray.se
Subject: Re: Server unknown 



4 maj 2013 kl. 09:35 skrev Martin Häggström < hejpadej< at >spray.se
<mailto:hejpadej< at >spray.se> >:


Hi!

I wrote to the mailinglist two weeks ago or so where I had
problem with mk_req failed when I ssh to a server. Adding the fqdn to
/etc/hosts on the server solved that problem.

But I have problem ssh to the same server from a FreeBSD
machine, getting error "Server ( krbtgt/LOCAL< at >HEMMA.LOCAL
<mailto:krbtgt/LOCAL< at >HEMMA.LOCAL> ) unknown". I can get a ticket without
any problems, see below.

Server:  krbtgt/HEMMA.LOCAL< at >HEMMA.LOCAL
<mailto:krbtgt/HEMMA.LOCAL< at >HEMMA.LOCAL> 
Client:  martin< at >HEMMA.LOCAL <mailto:martin< at >HEMMA.LOCAL>

Re: Server unknown

Love Hörnquist Åstrand — 2013-05-07T18:41:06

4 maj 2013 kl. 09:35 skrev Martin Häggström <hejpadej< at >spray.se>:


Yes, the client though that the entry doesn't exists when doing referrals, or domain->realm mapping is setup strange.

what what it seems going on is the the code tries to do a tree traversal. (its fixed that newer Heimdal won't try to traverse though a TLD)

What is the server name you are using and do you have any [domain_realm] mappings ?

Love

Server unknown

Martin Häggström — 2013-05-04T16:35:07

Hi!

I wrote to the mailinglist two weeks ago or so where I had problem with
mk_req failed when I ssh to a server. Adding the fqdn to /etc/hosts on
the server solved that problem.

But I have problem ssh to the same server from a FreeBSD machine,
getting error "Server (krbtgt/LOCAL< at >HEMMA.LOCAL) unknown". I can get a
ticket without any problems, see below.

Server: krbtgt/HEMMA.LOCAL< at >HEMMA.LOCAL
Client: martin< at >HEMMA.LOCAL
Ticket etype: aes256-cts-hmac-sha1-96, kvno 1
Ticket length: 320
Auth time:  May  4 17:46:41 2013
End time:   May  5 03:46:41 2013
Ticket flags: forwardable, proxiable, initial, pre-authenticated
Addresses: addressless

But as I said I get the error "Server (krbtgt/LOCAL< at >HEMMA.LOCAL)
unknown" on the FreeBSD machine. It shortens
krbtgt/HEMMA.LOCAL< at >HEMMA.LOCAL to krbtgt/LOCAL< at >HEMMA.LOCAL. Why?
I also tried to put the ssh-server to /etc/hosts on the FreeBSD machine
without any success.

Do anyone have a clue?

Cheers Martin




<P><p><font face="Arial, Helvetica, sans-serif" size="2" style="fon

Re: [patch] Remote LDAP Support

Love Hörnquist Åstrand — 2013-04-29T20:48:26

19 apr 2013 kl. 13:33 skrev Landon J Fuller <landonf< at >plausible.coop>:



Applied this delta a couple of days ago, forgot to mention it.

Love

Re: Heimdal KDC on Windows?

Jeffrey Altman — 2013-04-25T22:20:09

Sergio,

I have answered your questions both here and in private several months 
ago.
There are no libraries in the Secure Endpoints distribution which is 
not a SDK
(Software Developers Kit).  If you want libraries, you are encouraged 
to build
Heimdal from source.  Heimdal libraries are packaged as a signed 
assembly which
should be distributed as part of your application installer.

The Secure Endpoints distribution is also not a KDC distribution.  It 
is client only
and the only executables it ships with are the command line tools:

  kinit, klist, kdestroy, kcc, kswitch, ktutil, etc.

openldap is built for Windows as part of the Cygwin distribution as is 
Heimdal.
I do not know if openldap is built with GSS support using Heimdal or 
not.  If it isn't,
I suggest that the Cygwin heimdal package become a dependency for 
openldap.

Good luck.

Jeffrey Altman



On Thursday, April 25, 2013 5:55:15 PM, Sergio NNX wrote:

Heimdal KDC on Windows?

Sergio NNX — 2013-04-25T21:55:15

Thanks, but I'm NOT interested in any GUI.

Please, I'd appreciate if you could answer my questions. If not, advise who can and I'll forward the queries.

Cheers.

Sergio.

Re: Heimdal KDC on Windows?

Jeffrey Altman — 2013-04-25T19:30:15

The Secure Endpoints distribution is not an SDK for developers.  It is a
package which provides end users a Heimdal 1.5 distribution plus a set
of compatibility DLLs which permit applications built against MIT
Kerberos for Windows 3.2.x to use Heimdal instead.

Heimdal does not provide a Graphical User Interface.  Download Network
Identity Manager 2.0.

Jeffrey Altman

RE: Heimdal KDC on Windows?

Sergio NNX — 2013-04-24T12:27:29


I downloaded the binaries from here ' https://www.secure-endpoints.com/heimdal/#download' yesterday and I installed it. But I didn't know how to proceed. There're no entries in the Start menu, there's only one folder (\bin) under Program Files. How can I set it up and test the installation? 
Let's say I need the library files (.a) in order to build another application (e.g. OpenLDAP, etc), I couldn't find them under Program Files folder.

Any help is appreciated.

Thanks.