Hi guys,
This problem has taken me the whole Sunday and the only thing I've got left before start kicking my computer equipment is to ask you guys for help.
I have a problem on my client side of Kerberos. Basically, none of my clients is able to make a connection to kadmin using DNS SRV-records. Only if I use the relevant directives in the krb5.conf files - it works.
The Kerberos-related part of my DNS zone looks like this:
Code:
Please note, the $ORIGIN is my-domain.xx
_kerberos._udp.MY-DOMAIN.XX. IN SRV 1 0 88 server
_kerberos._tcp.MY-DOMAIN.XX. IN SRV 1 0 88 server
_kerberos-adm_tcp.MY-DOMAIN.XX. IN SRV 1 0 749 server
_kpasswd._udp.MY-DOMAIN.XX. IN SRV 1 0 464 server
_kerberos IN TXT "MY-DOMAIN.XX"
As far as I can see there is no misconfiguration and the Bind doesn't complain either.
If I configure the basic krb5.conf file on one of my clients, containing only:
Code:
[libdefaults]
default_realm = MY-DOMAIN.XX
I was hoping that the client would look for KDC via DNS. And initally, when I try to login as a user principal, it appears to be working.
When writing the command:
kinit mhead/admin
It finds the KDC server. After typing in the password, after the successful authentication, I write:
kadmin
and get the following error:
Code:
Authenticating as principal mhead/admin@MY-DOMAIN.XX with password.
kadmin: Missing parameters in krb5.conf required for kadmin client while initializing kadmin interface
What parameters? [libdefaults] is the only required parameter by Kerberos for a minimal configuration, and the Kerberos libraries would automatically use the DNS for lookup of the KDC / adm server etc.
If I add the [realm] stanza in the krb5.conf file containing
Code:
[realms]
MY-DOMAIN.XX = {
kdc = server.my-domain.xx:88
admin_server = server.my-domain.xx:749
default_domain = my-domain.xx
}
Then everything is works, I'm able to access administration server with no problems whatsoever.
The same problem happens on both virtual machines that I'm using as clients - a Debian and a CentOS, so it's not 'one-machine-problem-only'.
Something is weird regarding the adm server. I mean, without [realms] stanza, the client does query the DNS properly for the KDC master - it can be tracked in the DNS logs and I mean, even logically - with no [realms] stanza - there is no other place than DNS where it can find this information. So, the actual authentication of the principal works. It's the kadmin-part that exits with the error message above.
According to all manuals, books, guides I've read - this shouldn't be happening. The [libdefaults] with default_realm defined in krb5.conf in combination with proper DNS records, should be everything kerberos client needs. But apparently not.
I don't remember having any problems like this before. This is the first time in several months a freshly install a KDC. I believe Kerberos packages did get updated few times since then. Could this be a bug of some kind introduced in never version of libs? I have the latest packages on centos 5.3.
Thanks in advance.
