LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
LinkBack Search this Thread
Old 05-17-2006, 09:33 AM   #1
joadoor
Member
 
Registered: Apr 2002
Location: Clevedon, UK
Distribution: SUSE 8.2, 9.2, 10.0 OSS
Posts: 57

Rep: Reputation: 15
Kerberos kinit "reply did not match expectations"


Hi all,

I hope someone here can help me before I go completely mad, abandon computers all together, and go back to slate and chisel!

I have been banging my head against a brick wall trying to get a SUSE 10 OSS installation talking to our live W2K Active Directory.

Purpose: Seemless authentication for Squid Proxy

I have successfully tested this inside VMware with a SUSE OSS install, and a test Domain Controller. However, replicating my steps in the live environment is proving frustrating.

After following countless google search leads, everything I try and do comes down to Kerberos (the bl**dy 3 headed dog! Grrrr).
Upon issuing:
# kinit adminuser@domainname
I get:
kinit(v5): KDC reply did not match expectations while getting initial credentials

I know that the request is hitting the Domain Controller because if I enter a wrong password I get:
kinit(v5): Preauthentication failed while getting initial credentials

I have sync'd the clocks, tried with UPPPERCASE DOMAINS and lowercase domains, included the .LOCAL and .local at the end (our domain is domainname, but domainname.local with full domain suffix).
From what I can gather from the many sites on this subject the overview processes are:
1. Initiate the kerberos ticket with kinit
2. Configure Samba and Winbind
3. Join the domain (net join rpc or ads)
4. Start Samba and Winbind
5. Test connection to AD with wbinfo
6. Install & Configure Squid

Like I said, I have managed this before, but cannot replicate it, and am getting stuck at the first hurdle.

Please someone help, this is doing my nut in

Andy
 
Click here to see the post LQ members have rated as the most helpful post in this thread.
Old 08-15-2006, 07:51 AM   #2
logicalfuzz
Member
 
Registered: Aug 2005
Distribution: Arch Linux
Posts: 291

Rep: Reputation: 39
I had similar problems. I figured out that krb5.conf requires the realm names to be in upper case. I have converted the domain names (wherever it appears in krb5.conf) to uppercase. Now my krb5.conf looks something like this:
Code:
<..SNIP..>
[libdefaults]
 default_realm = CORP.EXAMPLE.COM
 dns_lookup_realm = true
 dns_lookup_kdc = true

[realms]
  CORP.EXAMPLE.COM = {
  kdc = MYKDC.CORP.EXAMPLE.COM:88
 }

<../SNIP..>
Additionally, i involke the kinit command as follows:

Code:
[root@LinuxLS logicalfuzz]# kinit myaccount@corp.example.com
Password for myaccount@corp.example.com:
kinit(v5): KDC reply did not match expectations while getting initial credentials
[root@LinuxLS logicalfuzz]# kinit myaccount@CORP.EXAMPLE.COM
Password for myaccount@CORP.EXAMPLE.COM:
[root@LinuxLS logicalfuzz]#
see? the way you invoke kinit also make a diference.


Regards,
LF.
 
2 members found this post helpful.
Old 06-19-2007, 09:48 AM   #3
dragin33
LQ Newbie
 
Registered: Apr 2003
Distribution: SuSE
Posts: 18

Rep: Reputation: 0
Thank You logicalfuzz!!! Looked on countless other pages for this simple answer but what you suggested was exactly right.


Quote:
Originally Posted by logicalfuzz
I had similar problems. I figured out that krb5.conf requires the realm names to be in upper case. I have converted the domain names (wherever it appears in krb5.conf) to uppercase. Now my krb5.conf looks something like this:
Code:
<..SNIP..>
[libdefaults]
 default_realm = CORP.EXAMPLE.COM
 dns_lookup_realm = true
 dns_lookup_kdc = true

[realms]
  CORP.EXAMPLE.COM = {
  kdc = MYKDC.CORP.EXAMPLE.COM:88
 }

<../SNIP..>
Additionally, i involke the kinit command as follows:

Code:
[root@LinuxLS logicalfuzz]# kinit myaccount@corp.example.com
Password for myaccount@corp.example.com:
kinit(v5): KDC reply did not match expectations while getting initial credentials
[root@LinuxLS logicalfuzz]# kinit myaccount@CORP.EXAMPLE.COM
Password for myaccount@CORP.EXAMPLE.COM:
[root@LinuxLS logicalfuzz]#
see? the way you invoke kinit also make a diference.


Regards,
LF.
 
Old 09-12-2007, 05:52 PM   #4
MasterC
Guru
 
Registered: Mar 2002
Location: Salt Lake City, UT - USA
Distribution: Gentoo ; LFS ; Kubuntu
Posts: 12,612

Rep: Reputation: 64
w00t! Thanks, I was in a similar boat at this step...

-Chad

Quote:
Originally Posted by logicalfuzz View Post
I had similar problems. I figured out that krb5.conf requires the realm names to be in upper case. I have converted the domain names (wherever it appears in krb5.conf) to uppercase. Now my krb5.conf looks something like this:
Code:
<..SNIP..>
[libdefaults]
 default_realm = CORP.EXAMPLE.COM
 dns_lookup_realm = true
 dns_lookup_kdc = true

[realms]
  CORP.EXAMPLE.COM = {
  kdc = MYKDC.CORP.EXAMPLE.COM:88
 }

<../SNIP..>
Additionally, i involke the kinit command as follows:

Code:
[root@LinuxLS logicalfuzz]# kinit myaccount@corp.example.com
Password for myaccount@corp.example.com:
kinit(v5): KDC reply did not match expectations while getting initial credentials
[root@LinuxLS logicalfuzz]# kinit myaccount@CORP.EXAMPLE.COM
Password for myaccount@CORP.EXAMPLE.COM:
[root@LinuxLS logicalfuzz]#
see? the way you invoke kinit also make a diference.


Regards,
LF.
 
Old 10-05-2007, 10:26 AM   #5
bkfullmer
LQ Newbie
 
Registered: Oct 2007
Posts: 1

Rep: Reputation: 0
Cool Kerberos revisited

I am new to this forum, but have a question regarding this error:

In the snippet of the error:
Kerberos kinit "reply did not match expectations"

I have the following entries in my krb5.conf file.

What is the difference between

CORP.EXAMPLE.COM and MYKDC.CORP.EXAMPLE.COM:88 ?

I am trying to set kerberos on a small network for internal testing. My domain controller name is DNASilo and my domain name is dna.qa.silo.ad.

What goes in the default_realm and what goes in the kdc ?

Any help would be appreciated

Thanks,
Brad

[libdefaults]
default_realm = CORP.EXAMPLE.COM
dns_lookup_realm = true
dns_lookup_kdc = true

[realms]
CORP.EXAMPLE.COM = {
kdc = MYKDC.CORP.EXAMPLE.COM:88
 
Old 10-25-2007, 08:03 AM   #6
moravia
LQ Newbie
 
Registered: Aug 2003
Distribution: primarily Red Hat
Posts: 13

Rep: Reputation: 0
Kerberos realm

Hi bkfullmer. This thread just helped me through the problem, so I think I can clear up a few things for you. Everywhere you see an entry with EXAMPLE.COM in it, substitute your own, real domain.

The kdc entries are for your domain controllers.

default_realm = DNA.QA.SILO.AD

[realms]
DNA.QA.SILO.AD {
kdc = DNASILO.DNA.QA.SILO.AD:88

Quote:
Originally Posted by bkfullmer View Post
What is the difference between

CORP.EXAMPLE.COM and MYKDC.CORP.EXAMPLE.COM:88 ?

I am trying to set kerberos on a small network for internal testing. My domain controller name is DNASilo and my domain name is dna.qa.silo.ad.

What goes in the default_realm and what goes in the kdc ?

Any help would be appreciated

Thanks,
Brad

[libdefaults]
default_realm = CORP.EXAMPLE.COM
dns_lookup_realm = true
dns_lookup_kdc = true

[realms]
CORP.EXAMPLE.COM = {
kdc = MYKDC.CORP.EXAMPLE.COM:88
 
Old 04-09-2008, 07:40 AM   #7
colonboy
Member
 
Registered: Dec 2005
Location: Prior Lake, MN
Distribution: Fedora, Suse, Mandriva, Ubuntu
Posts: 35

Rep: Reputation: 15
Exactly what I was looking for. I changed to upper case in my krb.conf file as well as within the kinit command, and I was able to authenticate. Before that, I was able to verify KDC with # host -t srv _kerberos._tcp.mydomain.com.

Thanks for the kick in the butt reminder that case sensitivity is something to always watch out for.

Colonboy
 
Old 03-20-2010, 12:56 AM   #8
singhpps
LQ Newbie
 
Registered: Jan 2007
Posts: 3

Rep: Reputation: 0
Thumbs up

Quote:
Originally Posted by logicalfuzz View Post
I had similar problems. I figured out that krb5.conf requires the realm names to be in upper case. I have converted the domain names (wherever it appears in krb5.conf) to uppercase. Now my krb5.conf looks something like this:
Code:
<..SNIP..>
[libdefaults]
 default_realm = CORP.EXAMPLE.COM
 dns_lookup_realm = true
 dns_lookup_kdc = true

[realms]
  CORP.EXAMPLE.COM = {
  kdc = MYKDC.CORP.EXAMPLE.COM:88
 }

<../SNIP..>
Additionally, i involke the kinit command as follows:

Code:
[root@LinuxLS logicalfuzz]# kinit myaccount@corp.example.com
Password for myaccount@corp.example.com:
kinit(v5): KDC reply did not match expectations while getting initial credentials
[root@LinuxLS logicalfuzz]# kinit myaccount@CORP.EXAMPLE.COM
Password for myaccount@CORP.EXAMPLE.COM:
[root@LinuxLS logicalfuzz]#
see? the way you invoke kinit also make a diference.


Regards,
LF.


Hi Thanks a lot. You made my day
 
Old 11-09-2010, 06:35 AM   #9
jonnymccullagh
LQ Newbie
 
Registered: Apr 2006
Location: Ireland
Distribution: Kubuntu
Posts: 6

Rep: Reputation: 0
Thanks
 
Old 11-09-2010, 03:00 PM   #10
alexsdba
LQ Newbie
 
Registered: Dec 2009
Posts: 4

Rep: Reputation: 0
Thank You. UPPERCASE fixed me up.
 
Old 02-15-2011, 08:21 PM   #11
kbp
Senior Member
 
Registered: Aug 2009
Posts: 3,715

Rep: Reputation: 634Reputation: 634Reputation: 634Reputation: 634Reputation: 634Reputation: 634
I realize I'm bumping an old thread but wanted to clear up the reason behind this issue :-

- kerberos user principals are username@realm *not* username@domain

Don't get confused just because the realm name is usually an upper-case version of the domain name

hth
 
Old 03-29-2011, 01:49 AM   #12
Pupkur
LQ Newbie
 
Registered: Mar 2011
Posts: 1

Rep: Reputation: 0
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = TABAK-INVEST
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true

[realms]
TABAK-INVEST = {
kdc = SRVPDC
admin_server = SRVPDC
default_domain=TABAK-INVEST
}

[domain_realm]
.TABAK-INVEST = TABAK-INVEST
TABAK-INVEST = TABAK-INVEST

[login]
krb4_convert=false
krb4_get_tickets=false

[root@Pupkur ~]# kinit Pupkur@TABAK-INVEST
Password for Pupkur@TABAK-INVEST:
kinit: KDC reply did not match expectations while getting initial credentials

Please somebody say what wrong?(Sorry my bad english I`m russian )

Last edited by Pupkur; 03-29-2011 at 03:40 AM.
 
Old 04-13-2011, 02:49 PM   #13
thegs68
LQ Newbie
 
Registered: Apr 2011
Posts: 1

Rep: Reputation: 0
Thumbs up Thanks Plenty

Quote:
Originally Posted by logicalfuzz View Post
I had similar problems. I figured out that krb5.conf requires the realm names to be in upper case. I have converted the domain names (wherever it appears in krb5.conf) to uppercase. Now my krb5.conf looks something like this:
Code:
<..SNIP..>
[libdefaults]
 default_realm = CORP.EXAMPLE.COM
 dns_lookup_realm = true
 dns_lookup_kdc = true

[realms]
  CORP.EXAMPLE.COM = {
  kdc = MYKDC.CORP.EXAMPLE.COM:88
 }

<../SNIP..>
Additionally, i involke the kinit command as follows:

Code:
[root@LinuxLS logicalfuzz]# kinit myaccount@corp.example.com
Password for myaccount@corp.example.com:
kinit(v5): KDC reply did not match expectations while getting initial credentials
[root@LinuxLS logicalfuzz]# kinit myaccount@CORP.EXAMPLE.COM
Password for myaccount@CORP.EXAMPLE.COM:
[root@LinuxLS logicalfuzz]#
see? the way you invoke kinit also make a diference.


Regards,
LF.
Thanks. This was exactly what I needed to fix my issue which was the same. Keep up with the great info. You are one in a million who is not afraid to pass on your knowledge. Others go into long winded explanations and barely give any examples of their work and/or if it even worked for them, they just like to make people think that they are smarter than everybody else.
Once again thanks!
 
Old 08-19-2011, 03:50 PM   #14
philhu
LQ Newbie
 
Registered: Aug 2011
Posts: 1

Rep: Reputation: Disabled
ok, thanks for this...this fixed kinit

Getent testing works too

What doesn't work is authentication to login to the linux box from Windows server 2008

As stated, kinit works wuth the uppercase, the krb5.conf file is set as shown here. Getent returns the passwd 'line' from the windows server. The windows server does have the lower cryptography group policy.

I've gotten this to work before, but for this domain, it just hangs and says (in putty) "authentication failed"

Is there a log somewhere on the win box to see what is failing? As I said kinit and getent tests work fine now.

Here is the 'tests' working:
[root@xxxdevemp01 etc]# kinit philh@XXX.SAAS
Password for philh@XXX.SAAS:
[root@xxxdevemp01 etc]# getent passwd philh
philh:*:10007:501:Phil H:/home/philh:/bin/bash
[root@xxxdevemp01 etc]#

It returns the group, user id etc just fine. All set on the Windows server.......It must be something very fundamental...Thanks for looking...

Here is my ldap.conf:
base XXX,dc=saas
uri ldap://xxxadc01.xxx.saas/
binddn ldapbind@xxx.saas
bindpw XXXpass
scope sub
ssl no
#tls_checkpeer no
nss_base_passwd dc=xxx,dc=saas?sub
nss_base_shadow dc=xxx,dc=saas?sub
nss_base_group dc=xxx,dc=saas?sub?&(objectCategory=group)(gidnumber=*)
nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,orion
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_objectclass posixGroup group
nss_map_attribute gecos cn
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute uniqueMember member
tls_cacertdir /etc/openldap/cacerts
pam_password md5
#pam_password ad

And my krb5.conf:
[root@xxxdevemp01 etc]# cat krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = XXX.SAAS
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes
verify_ap_req_nofail = false

[realms]
XXX.SAAS = {
kdc = XXXDEVADC01.XXX.SAAS:88
admin_server = XXXDEVADC01.XXX.SAAS:749
default_domain = XXX.SAAS
}

[domain_realms]
.xxx.saas = XXX.SAAS
xxx.saas = XXX.SAAS

[login]
krb4_convert=false
krb4_get_tickets=false

[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
[root@xxxdevemp01 etc]#

Last edited by philhu; 10-23-2012 at 09:30 PM.
 
Old 11-01-2011, 04:41 AM   #15
Mohammed Moufakkir
LQ Newbie
 
Registered: Nov 2011
Posts: 1

Rep: Reputation: Disabled
thanks guys that was helpfull
 
  


Reply

Tags
kerberos


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Quick Reply "post reply" button. IsaacKuo LQ Suggestions & Feedback 9 12-04-2005 03:41 PM
Adding a "Subscribe" button next to "Reply"? pnellesen LQ Suggestions & Feedback 2 06-21-2005 09:12 PM
Take all posts from "Website Suggestions & Feedback" out of the "0 Reply Thread&q t3gah LQ Suggestions & Feedback 7 03-21-2005 07:27 PM
whys is that "df" and "du" dont match? jaredth Linux - Software 2 07-29-2004 01:23 AM
kinit missing from kerberos 5 installation aschmidt Linux - Newbie 1 06-17-2004 10:48 AM


All times are GMT -5. The time now is 11:45 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration