Re: More kpasswd woes.

[Alf Wachsmann <alfw@slac.stanford.edu>]

On Fri, 5 Mar 2004, Henry B. Hotz wrote:
> The Solaris SEAM kpasswd command and the Heimdal kpasswd seem to
> work.  They change the password without error, but the resulting keys
> are like this:
>
> Keytypes(salttype[(salt-value)]): des3-cbc-sha1(pw-salt),
> des-cbc-md5(pw-salt), des-cbc-md4(pw-salt), des-cbc-crc(pw-salt)
>
> which works fine with kinit, but not with good old AFS klog.
> [ snip ]
> [kadmin]
>          default_keys = des3:pw-salt v4

This "default_keys" definition is the problem.

The following works for our AFS cell "slac.stanford.edu":

[kadmin]
  default_keys = v4 des:afs3-salt:slac.stanford.edu

You need to explicitly put your AFS cell name as the salt in there.

-- Alf.

-----------------------------------------------------------------------
  Alf Wachsmann                       | e-mail: alfw@slac.stanford.edu
  SLAC Computing Service              | Phone:  +1-650-926-4802
  2575 Sand Hill Road, M/S 97         | FAX:    +1-650-926-3329
  Menlo Park, CA 94025, USA           | Office: Bldg. 50/323
-----------------------------------------------------------------------
                http://www.slac.stanford.edu/~alfw (PGP)
-----------------------------------------------------------------------