3

I have successfully installed Kerberos on debian wheezy and can perform service authentication (Apache, ssh) with Kerberos tickets from kinit.

I would like to use certificates for kinit (pkinit) instead of passwords.

I have followed the steps describes here.

I am trying to authenticate with this command:

kinit -C FILE:client.pem,client.key client@MAYTACAPAC.INC

which returns password incorrect.

I am quite sure the trouble comes from the server and not the client. From wireshark, client sends its certificate when using pkinit. Because no AS-REP is provided from the kdc, maybe the client ends up with a "password incorrect" generic error message, meaning it can't decipher its ticket (as none is ent).

I have end up with this server /etc/krb5.conf configuration:

[realms]
 MAYTACAPAC.INC = { 
  kdc             = kerberos.maytacapac.inc
  admin_server    = kerberos.maytacapac.inc
  default_domain  = maytacapac.inc
  detabase_module = openldap_ldapconf

  kdc_tcp_ports   = 88
  allow_pkinit    = yes 
  pkinit_identity = FILE:/root/pkinit/kdc.pem,/root/pkinit_wiki/kdc.key
  pkinit_anchors  = FILE:/root/pkinit/ca.pem
  module          = pkinit:/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/pkinit.so
} 

Then I start krb5-kdc service, and there is this message in log file:

# systemctl -l status krb5-kdc
● krb5-kdc.service - Kerberos 5 Key Distribution Center
Loaded: loaded (/lib/systemd/system/krb5-kdc.service; enabled)
Drop-In: /lib/systemd/system/krb5-kdc.service.d
       └─slapd-before-kdc.conf
Active: active (running) since Fri 2016-04-29 14:59:57 CEST; 1min 3s ago
Process: 1042 ExecStart=/usr/sbin/krb5kdc -P /var/run/krb5-kdc.pid $DAEMON_ARGS (code=exited, status=0/SUCCESS)
Main PID: 1043 (krb5kdc)
CGroup: /system.slice/krb5-kdc.service
       └─1043 /usr/sbin/krb5kdc -P /var/run/krb5-kdc.pid
Apr 29 14:59:57 kerberos krb5kdc[1042]: preauth pkinit failed to initialize: No realms configured correctly for pkinit support
Apr 29 14:59:57 kerberos krb5kdc[1042]: setting up network...
Apr 29 14:59:57 kerberos krb5kdc[1042]: listening on fd 8: udp 0.0.0.0.88 (pktinfo)
Apr 29 14:59:57 kerberos krb5kdc[1043]: commencing operation

Which show that there is a problem on this side.

I have googled this error for a while without any success. kinit works still fine for password authentication.

UPDATE

I have put certificates in the default directory /var/lib/krb5kdc. The described error disappears from the logs when I restart the server.

However, now, there is an error when I attempt to get the TGT from the server on client side. I get in server logs:

preauth (pkinit) verify failure: Key parameter not accepted

I get this error message on client side:

kinit: krb5_get_init_creds: PREAUTH_FAILED

Wireshark show me this error as reply of the as-req:

KDC_ERR_KEY_TOO_WEAK

I have setup pkinit_dh_min_bits = 1024 in client /etc/krb5.conf. This is working now and I get my ticket \o/

However, I would prefer using an at least 2048 bits long key for dh exchange, which i can't now (same last error appears).

It seems that client wants to use 1024 bits dh parameters and then servers refuses and closes the connection. I don't know how to force the client to provide >=2048 bits dh parameters, as pkinit_dh_min_bits = 2048 in client /etc/krb5.conf does not have any effect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.