Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

Fascinating is a word I use for the unexpected. -- Spock, "The Squire of Gothos", stardate 2124.5


devel / comp.protocols.kerberos / Re: Debugging why KRB5_KTNAME isn't working

SubjectAuthor
o Re: Debugging why KRB5_KTNAME isn't workingJochen Kellner

1
Re: Debugging why KRB5_KTNAME isn't working

<mailman.17.1643312765.8148.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=206&group=comp.protocols.kerberos#206

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: joc...@jochen.org (Jochen Kellner)
Newsgroups: comp.protocols.kerberos
Subject: Re: Debugging why KRB5_KTNAME isn't working
Date: Thu, 27 Jan 2022 20:31:25 +0100
Organization: TNet Consulting
Lines: 26
Message-ID: <mailman.17.1643312765.8148.kerberos@mit.edu>
References: <4f4a71e295df1a7aa4e53475af50164af7cbe86a.camel@interlinx.bc.ca>
<786a0a7b-2d3c-f016-a32c-c8e8c21f7a6c@mit.edu>
<83zgnh2cxe.fsf@jochen.org>
Mime-Version: 1.0
Content-Type: text/plain
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="29665"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
Cc: "Brian J. Murrell" <brian@interlinx.bc.ca>, <kerberos@mit.edu>
To: Greg Hudson <ghudson@mit.edu>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=a1Vbbq767EXIZupukwbXx50lKSDtgRM7gft+T0y03tAOvxLamELLPZviSt/Ta/QRJhJSZMoALbNBtj0bu5c1bxqZR0cSiuzvkRHBMOdKBXG7EOCkxRNwTtVLx8dQYBwZLyI/3UJNKLMNs1h1D7ho/0MS5oTEwef+5H5m8APvE5TtS4wnBZV394c+QFA3pOBEL0dU/ZfU927wGRIYPC1Sf15vyqbjyEAh9QQVg1uThKHzIhGQyx/6D0XGODw7TwfeSU8o3PCQ/3d0rkChWvep4TfY8RHE+Nqv2SAZEMcBaf+OKdUClx9zZ2Va90VcDZ6qntBkYIfa+CQQLITlke/PMQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=S6XmJyB6VjosL6gc3U2Yn1hlF/pdBYyBiDSRJK2YqLw=;
b=YmZ0DbuhR6maubSJv98XyyzDxfplk3Zbpcc1RzH1+R6S2hNlPPdfvsBBRA+t8YXuO3OUWCzBpBdBM4UWUvXCO+tKGyi2Q87eRw99sjLyS9tZCyGNY6DGmvgM7IwCJHSXzxmH60j3cW+eTdw3OFzZOWU0wbAzf9Kl0nLKt4arnAsy7H1+QzwhpSsPtHov5jcocyai0is31z7/fyGUKgl0U29gukQJdzKMbaalo3QYPF2xJAsYJGkzZKVo/lWlmof1jW1lafTZD7XXNNOCrcvO50FiSkqtOCAHyPNzujHWn23edeG84pU4nzZ0s7UmUGaW+oSD+Jgmk1ODcDwFyV0k7A==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is
89.1.8.211) smtp.rcpttodomain=mit.edu smtp.mailfrom=jochen.org; dmarc=none
action=none header.from=jochen.org; dkim=none (message not signed); arc=none
(0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=S6XmJyB6VjosL6gc3U2Yn1hlF/pdBYyBiDSRJK2YqLw=;
b=CDqtFrVAbhcApHWGTR+ISkRX4EL50oHintzdjdWx3htx7gdyHie52tW+ZMK8vcRKtfCrLM0NyA+Co2ZKZslqn99PiujKKuKut5vxTYj6RNZvydCoDKw4K+59uaVUG6KF4IsZDW88hssQdAhTJlrIctVtQJ1s2I5syXlrS2Pj/Vo=
Authentication-Results: spf=none (sender IP is 89.1.8.211)
smtp.mailfrom=jochen.org; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=jochen.org;
Received-SPF: None (protection.outlook.com: jochen.org does not designate
permitted sender hosts)
In-Reply-To: <786a0a7b-2d3c-f016-a32c-c8e8c21f7a6c@mit.edu> (Greg Hudson's
message of "Thu, 27 Jan 2022 13:41:38 -0500")
X-NetCologne-Spam: L
X-Rspamd-Queue-Id: BEAFC11D8C
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 7cedcdf1-2d2c-45db-7763-08d9e1cba404
X-MS-TrafficTypeDiagnostic: SN6PR0102MB3472:EE_
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <SN6PR0102MB3472FA16A5A306A36C509F65AE219@SN6PR0102MB3472.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:8882;
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: pBAYHwfYQlu8MTxnG5QiIVkvU3G1j29SxzCzntPPCeYDddcXddW4wKHHHKzW5Qzsk8TEvWk38B5uoYzh9EEBGfThwD17iBt52lqsz/e18wbvZ/x3DKNnVvStGupgEQSCSsskkvfp3n8Q/6hi26e39aBXPhu8cSRyIx45WKFuox1BjBCvCKDEybKdZ6LkFhXumDdn6uIxjMvUU95rut2U4kNYFoHjoVdJNRvTM1PdKbT1rC1P5swLJlKB6Rrgdcki8bIL8wrMUNk0poj3nb46NHq3zuqd7VM4yyN1NY9exsjBjYFUG/mDIXEkgWJmqllDWHNsib8kGMOCeO7wcQ1o9CIsma7DfiK+TOiz+2gs+qRK1UNFlRZGWRwc/3oC7G40oSg/OO6Cbya2MmSYieCj/FIZaeamNTjwRzWZrtvy+Hi0iO28iMPG5kze6m6yr1v1Nwrowq0t+Czzf2A+D0UW+1KMca0TqAx1bHuFkyzCKGjHQGzAJLKD2ZOYwyYkw93GdumHulgCe7rjnw/M8qKOjNyxctQohZbXxd1CQ9EI3uyTh96vraBW6Qrh1fsqZ0yeZ+x1MwrknEyO8VWqb6SO0WRrS9JFKP3QpeEeh/QXoTQ=
X-Forefront-Antispam-Report: CIP:89.1.8.211; CTRY:DE; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:cc-smtpout1.netcologne.de; PTR:cc-smtpout1.netcologne.de;
CAT:NONE;
SFS:(13230001)(4636009)(6966003)(316002)(54906003)(786003)(5660300002)(86362001)(8676002)(4744005)(4326008)(6862004)(68406010)(70586007)(2616005)(36756003)(426003)(336012)(26005)(83380400001)(6266002)(7596003)(7636003)(356005)(7696005)(508600001)(2906002)(6666004)(20210929001);
DIR:OUT; SFP:1022;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jan 2022 19:31:39.3658 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 7cedcdf1-2d2c-45db-7763-08d9e1cba404
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT064.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR0102MB3472
X-OriginatorOrg: mitprod.onmicrosoft.com
X-Mailman-Approved-At: Thu, 27 Jan 2022 14:46:04 -0500
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <83zgnh2cxe.fsf@jochen.org>
X-Mailman-Original-References: <4f4a71e295df1a7aa4e53475af50164af7cbe86a.camel@interlinx.bc.ca>
<786a0a7b-2d3c-f016-a32c-c8e8c21f7a6c@mit.edu>
 by: Jochen Kellner - Thu, 27 Jan 2022 19:31 UTC

Greg Hudson <ghudson@mit.edu> writes:

> Of course, the program itself can provide configuration for the keytab
> file. I couldn't find any gss_ or krb5_ calls in the Postfix source
> code (looking at Viktor Dukhovni's git mirror), so I don't have any
> immediate insight as to whether that's currently possible or what would
> need to change.

I once configured postfix to uses sasl:

main.cf:83:smtpd_sasl_auth_enable = yes

And in /etc/postfix/sasl/smtpd.conf:

pwcheck_method: auxprop saslauthd
#pwcheck_method: saslauthd
mech_list: plain login gssapi
log_level: 0
keytab: /etc/smtp.keytab

That at least worked some time ago...

Jochen

--
This space is intentionally left blank.


devel / comp.protocols.kerberos / Re: Debugging why KRB5_KTNAME isn't working

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor