1

Someone asked a question on Server Fault about a problem which I'm also having but no one has answered it so I'm posing a slightly different question to try and figure it out myself.

I've configured PAM on my Arch Linux server to use pam_krb5 and it works.

login as: Username
Username@server.ad.example.com's password:
Warning: Your password will expire in 32 days on Tue Apr  1 22:24:58 2014
Last login: Fri Feb 28 09:46:58 2014 from pc.ad.example.com
Could not chdir to home directory /home/AD/Username: No such file or directory
[AD\Username@server /]$ echo $KRB5CCNAME
FILE:/tmp/krb5cc_3000019_DF0uwI
[AD\Username@server /]$ klist
Ticket cache: FILE:/tmp/krb5cc_3000019_DF0uwI
Default principal: Username@AD.EXAMPLE.COM

Valid starting     Expires            Service principal
28/02/14 10:03:43  28/02/14 20:03:43  krbtgt/AD.EXAMPLE.COM@AD.EXAMPLE.COM
        renew until 01/03/14 10:03:43

I haven't created the home directory yet so I think that error can be ignored for the time being.

And the logs show the following.

sshd[10567]: pam_krb5(sshd:auth): pam_sm_authenticate: entry (nonull)
sshd[10567]: pam_krb5(sshd:auth): (user Username) attempting authentication as Username@AD.EXAMPLE.COM
sshd[10567]: pam_krb5(sshd:auth): user Username authenticated as Username@AD.EXAMPLE.COM
sshd[10567]: pam_krb5(sshd:auth): (user Username) temporarily storing credentials in /tmp/krb5cc_pam_7mIl6Q
sshd[10567]: pam_krb5(sshd:auth): pam_sm_authenticate: exit (success)
sshd[10567]: pam_krb5(sshd:account): pam_sm_acct_mgmt: entry
sshd[10567]: pam_krb5(sshd:account): (user Username) retrieving principal from cache
sshd[10567]: pam_krb5(sshd:account): pam_sm_acct_mgmt: exit (success)
sshd[10567]: Accepted password for Username from 192.168.1.10 port 50653 ssh2
sshd[10567]: pam_krb5(sshd:setcred): pam_sm_setcred: entry (establish)
sshd[10567]: pam_krb5(sshd:setcred): (user Username) initializing ticket cache FILE:/tmp/krb5cc_3000019_CgGnZS
sshd[10567]: pam_krb5(sshd:setcred): pam_sm_setcred: exit (success)
kernel: type=1006 audit(1393584192.561:70): pid=10567 uid=0 old auid=4294967295 new auid=3000019 old ses=4294967295 new ses=69 res=1
sshd[10567]: pam_krb5(sshd:session): pam_sm_open_session: entry
sshd[10567]: pam_krb5(sshd:session): pam_sm_open_session: exit (success)
sshd[10569]: pam_krb5(sshd:setcred): pam_sm_setcred: entry (establish)
sshd[10569]: pam_krb5(sshd:setcred): pam_sm_setcred: exit (success)

Great.

When I try kinit it detects the principal correctly.

[AD\Username@server /]$ kinit
Password for Username@AD.EXAMPLE.COM:
Warning: Your password will expire in 32 days on Tue 01 Apr 2014 22:24:58 BST

However, when I try to use sudo it interprets the username as the principal.

[AD\Username@server /]$ sudo -i
[sudo] password for AD\Username:
sudo: 1 incorrect password attempt

And the log shows the following.

sudo[10564]: pam_krb5(sudo:auth): pam_sm_authenticate: entry (silent)
sudo[10564]: pam_krb5(sudo:auth): (user AD\Username) attempting authentication as ADUsername@AD.EXAMPLE.COM
sudo[10564]: pam_krb5(sudo:auth): (user AD\Username) krb5_get_init_creds_password: Client 'ADUsername@AD.EXAMPLE.COM' not found in Kerberos database
sudo[10564]: pam_krb5(sudo:auth): authentication failure; logname=AD\Username uid=3000019 euid=0 tty=/dev/pts/0 ruser=AD\Username rhost=
sudo[10564]: pam_krb5(sudo:auth): pam_sm_authenticate: exit (failure)
sudo[10564]: pam_unix(sudo:auth): authentication failure; logname=AD\Username uid=3000019 euid=0 tty=/dev/pts/0 ruser=AD\Username rhost=  user=AD\Username
sudo[10564]: pam_krb5(sudo:auth): pam_sm_authenticate: entry (silent)
sudo[10564]: pam_krb5(sudo:auth): (user AD\Username) error getting password: Authentication failure
sudo[10564]: pam_krb5(sudo:auth): authentication failure; logname=AD\Username uid=3000019 euid=0 tty=/dev/pts/0 ruser=AD\Username rhost=
sudo[10564]: pam_krb5(sudo:auth): pam_sm_authenticate: exit (failure)

I have winbind configured in nsswitch.conf and I presume it is this which decides the username should be "AD\Username" rather than just "Username". So firstly am I right in thinking it is up to the winbind library what the user's name appears to be?

And secondly, how can I configure winbind so that if the user is in the default Kerberos realm (as defined by /etc/krb5.conf) then their username should not be prefixed with the short domain name for that realm?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.