[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: hprop problem with krb4-db database

To: Love Hörnquist Åstrand <lha@kth.se>
Subject: Re: hprop problem with krb4-db database
From: Florian Daniel Otel <florian.otel@gmail.com>
Date: Fri, 4 Nov 2005 11:23:11 +0100
Cc: heimdal-discuss@sics.se
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=WX2s8BGSVWTHAho4y93ygkNAkeh5rTIongK6DJp8r1f3gHUEIumVqER4gyxjqsh43y3HsOKkBj1VbhrHjhz20CaWggsrlyB8lTfZTOVR4GzMou8+enhbZk27YugfKREcCQOE1VBSXwwg+3qbfaUujjGAByQQhl3nldX14lvS1Cs=
In-Reply-To: <m24q6tz7gf.fsf@dhcp-wavelan-v-226.publik.su.se>
References: <c67a67be0511010204l65fba90ej2280561678516160@mail.gmail.com> <m24q6tz7gf.fsf@dhcp-wavelan-v-226.publik.su.se>
Sender: owner-heimdal-discuss@sics.se

Love, all

First and foremost, thanks for the patience of helping me through
this. Obviously, I've never done this before, so I might do some
rookie mistakes..

On 11/3/05, Love Hörnquist Åstrand <lha@kth.se> wrote:

> > However, hprop is a bit more cooperating if the dabase is given in
> > ASCII format (i.e. "krb4-dump" format):
>
> Since you say this, I wont comment on the problem above.

Well, this doesn't answer the question on why the above error occurs,
but still. Moving on.

> > [...]
> > root@florians:/var/lib/heimdal-kdc# hprop -d ./slave_dump
> > --source=krb4-dump -n > /tmp/test
> > hprop: krb5_425_conv_principal rcmd.server1@MY.REALM: Failed to
> > convert v4 principal
>
> It tries to do mapping between the service name "rcmd.server1" that is the
> kerberos4 style name to the FQDN host/service1.example.org@MY.REALM", but
> since the machine can't be found in dns or the [domain_realm] mapping file,
> it failes. Check if the machine is does exists, and if it does, that the
> FQDN is and why it hprop can't resolve the address in KDC.

Got that, will fix and/or recreate those principals in the new
database (no biggie). However, I have a bigger problem

First, I manually removed from that krb4-dump file  all "rcmd..."  
other "questionable"/already existing principals (e.g.  "changepw",
"krbtgt", etc). Btw, do I really need to remove them manually ??
Anyway. I tried the procedure below both with and without those
principals in the dump, with same result.

After "cleaning" the dump, when trying to importing the resulting
krb4-dump my resulting principal database becomes garbled:

root@florians:/var/lib/heimdal-kdc# kinit oteflo0507/admin
oteflo0507/admin@IPSC.SECODE.COM's Password:
kinit: NOTICE: ticket renewable lifetime is 1 week

root@florians:/var/lib/heimdal-kdc# klist
Credentials cache: FILE:/tmp/krb5cc_0
        Principal: oteflo0507/admin@MY.REALM.COM

  Issued           Expires          Principal
Nov  4 10:27:51  Nov  4 20:27:51  krbtgt/MY.REALM.COM@MY.REALM.COM
Nov  4 10:27:51  Nov  4 20:27:51  krbtgt/MY.REALM.COM@MY.REALM.COM
Nov  4 10:28:21  Nov  4 11:28:21  kadmin/admin@MY.REALM.COM

   V4-ticket file: /tmp/tkt0
        Principal: oteflo0507.admin@MY.REALM.COM

  Issued           Expires          Principal
Nov  4 10:27:51  Nov  4 20:27:51  krbtgt.MY.REALM.COM@MY.REALM.COM

root@florians:/var/lib/heimdal-kdc# kadmin list */*
  kadmin/admin@MY.REALM.COM
  kadmin/hprop@MY.REALM.COM
  kadmin/changepw@MY.REALM.COM
  oteflo0507/admin@MY.REALM.COM
  changepw/kerberos@MY.REALM.COM
  krbtgt/MY.REALM.COM@MY.REALM.COM
  host/host1.my.domain.com@MY.REALM.COM
  host/host2.my.domain.com@MY.REALM.COM
  hprop/host1.my.domain.com@MY.REALM.COM
  hprop/host2.my.domain.com@MY.REALM.COM

root@florians:/var/lib/heimdal-kdc# hprop -n -d ./slave_dump.working2
--source=krb4-dump --master-key=./.k   | hpropd -n

root@florians:/var/lib/heimdal-kdc# kadmin list */*
kadmin: kadm5_get_principals: Key table entry not found

kadmin> root@florians:/var/lib/heimdal-kdc# kadmin -l
kadmin> list */*
kadmin: get K/M@MY.REALM.COM: Invalid argument
kadmin: get afs/neon@MY.REALM.COM: Invalid argument
kadmin: get httpd/host3@MY.REALM.COM: Invalid argument
kadmin: get tobbe/root@MY.REALM.COM: Invalid argument
kadmin: get httpd/host4@MY.REALM.COM: Invalid argument
kadmin: get httpd/host5@MY.REALM.COM: Invalid argument
kadmin: get tobbe/admin@MY.REALM.COM: Invalid argument
kadmin: get httpd/host1@MY.REALM.COM: Invalid argument
kadmin: get httpd/host6@MY.REALM.COM: Invalid argument
kadmin: get httpd/host7@MY.REALM.COM: Invalid argument
kadmin: get httpd/host8@MY.REALM.COM: Invalid argument
kadmin: get httpd/host2@MY.REALM.COM: Invalid argument
kadmin: get httpd/hosst9@MY.REALM.COM: Invalid argument
kadmin: get backup/host10@MY.REALM.COM: Invalid argument
kadmin: get httpd/host11@MY.REALM.COM: Invalid argument
kadmin: get user1/root@MY.REALM.COM: Invalid argument
kadmin: get user2/root@MY.REALM.COM: Invalid argument
kadmin: get user3/root@MY.REALM.COM: Invalid argument
kadmin: get user4/root@MY.REALM.COM: Invalid argument
kadmin: get user5/admin@MY.REALM.COM: Invalid argument
kadmin: get user6/admin@MY.REALM.COM: Invalid argument
...

root@florians:/var/lib/heimdal-kdc# kdestroy

root@florians:/var/lib/heimdal-kdc# kinit oteflo0507/admin
oteflo0507/admin@MY.REALM.COM's Password:
kinit: Can't send request (send_to_kdc)
kinit: krb5_get_init_creds: unable to reach any KDC in realm IPSC.SECODE.COM

Thanks again for any help

Follow-Ups:
- Re: hprop problem with krb4-db database
  - From: Florian Daniel Otel <florian.otel@gmail.com>

References:
- hprop problem with krb4-db database
  - From: Florian Daniel Otel <florian.otel@gmail.com>
- Re: hprop problem with krb4-db database
  - From: Love Hörnquist Åstrand <lha@kth.se>

Prev by Date: Re: last password change, default password lifetime.
Next by Date: Re: hprop problem with krb4-db database
Prev by thread: Re: hprop problem with krb4-db database
Next by thread: Re: hprop problem with krb4-db database
Index(es):
- Date
- Thread