Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

It's not hard to admit errors that are [only] cosmetically wrong. -- J. K. Galbraith


devel / comp.protocols.kerberos / Re: How to rekey kadmin/history

SubjectAuthor
o Re: How to rekey kadmin/historyMike

1
Re: How to rekey kadmin/history

<mailman.8.1696890732.2263420.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=384&group=comp.protocols.kerberos#384

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: kerbe...@norgie.net (Mike)
Newsgroups: comp.protocols.kerberos
Subject: Re: How to rekey kadmin/history
Date: Mon, 9 Oct 2023 23:30:32 +0100
Organization: TNet Consulting
Lines: 32
Message-ID: <mailman.8.1696890732.2263420.kerberos@mit.edu>
References: <ZSExJFGjyAMYAGGw@lightning.iz.norgie.net>
<202310071703.397H32cD031876@hedwig.cmf.nrl.navy.mil>
<55ca3c6f-e1b1-26c4-c4e7-af09fba8fe22@csits.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="6601"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Thunderbird/102.14.0
Cc: kerberos@mit.edu
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>
Authentication-Results: mit.edu;
dmarc=pass (p=reject dis=none) header.from=norgie.net
Authentication-Results: mit.edu; arc=pass smtp.remote-ip=18.9.3.18
ARC-Seal: i=2; a=rsa-sha256; d=mit.edu; s=arc; t=1696890725; cv=pass;
b=IaapyNo2DfLWJ5TDJz6hbA5M6YvyT/IxrZoqzNlZs3OjQDXDYxjTTroRFu03ewfF0o2o3nRapu7JSFdjiEANJFEtYiVSFC9z2bug+bd3Dqtdp9ySShek3cl8LLzBrVANch/Pk0JZUQTYIYwEU9k/E/yvv+8ppXNypM6beXd2V91Mpe4ikJAU7pXVp9URDpV57f56IxWduvjVGI+j+sez6c0h2jL+v2MoVvCJn4xHSTA7a8PC0gG7IGgM9zt45re8HYm114oM2+SmZxxyg/Os14Kadeqy/dt+c0LekhgEpFx3OnmuZt1fqIspwabX0Wyl6Q/hqC00IaWto3ib7i6Wjw==
ARC-Message-Signature: i=2; a=rsa-sha256; d=mit.edu; s=arc; t=1696890725;
c=relaxed/relaxed; bh=DEvSKL8SBZbmVYTr5Jh7TPQMAbuz0QKA6zMsdakHRLs=;
h=Message-ID:Date:MIME-Version:Subject:From:Content-Type;
b=jbVsBl2UfrTUmy/QAYd3FY3GM4FNfSUccbwZ6EVVsHS1OLPATJFS666eBM6TLX2ucS2p9dkL8HY3Pg5Dm23mpOhA+m/ZhVvDqCPyJ3NaEslyq749zGrdMocUa+mr/Dr+LzRW9LOCCvvMw7jFQuS/NJWIUeOEi1yINM3MwPf/iPR5XgQjE0s+orDztxOa5Wnko8Urv8Dh3tAsMsFMTdGy4BGM9T65m606l7KC2gtGy3vQ2UqAKiPRbXnC/Psy6ZEoCHUfEoig1vW4WwMuQilSwK/gHWR6r373R0e7/1xjKluY3EdYIFRvio+xvVBrOF+F9YBa17/ZIA1qtTLifv2XyA==
ARC-Authentication-Results: i=2; mit.edu; dkim=pass (1024-bit key;
unprotected) header.d=mitprod.onmicrosoft.com
header.i=@mitprod.onmicrosoft.com header.a=rsa-sha256
header.s=selector2-mitprod-onmicrosoft-com header.b=VOOGQJ9L;
dkim=pass (4096-bit key;
unprotected) header.d=norgie.net header.i=@norgie.net header.a=rsa-sha256
header.s=default header.b=VAY5bpzu
Authentication-Results: mit.edu; dkim=pass (1024-bit key;
unprotected) header.d=mitprod.onmicrosoft.com
header.i=@mitprod.onmicrosoft.com header.a=rsa-sha256
header.s=selector2-mitprod-onmicrosoft-com header.b=VOOGQJ9L;
dkim=pass (4096-bit key;
unprotected) header.d=norgie.net header.i=@norgie.net header.a=rsa-sha256
header.s=default header.b=VAY5bpzu
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=dqvDI9Jan7UfoKwREfjqiX4I7ITNbPqvob9NdgBj72drz1HudL5HAAHHX+J+fcS3jgJXJqK9VdtjzTZlCdTfg17sG8nWm6UWj4yGJBY3HiqoGeYyaMjocvIYrrR5aQnkqBdF8t5GcVTIU71+Q9cWq8ADCBy49nYizJYWX4IUxEl8stnsK1uHsprbdsJ3np0x5RSvGnSk2juG0ul//c91lmRibS+O8ijGrjvDnJ0hPTAtDhK/+4fJXQlArh4iGT85N9m7ilm+sBZhaX6kQKtLmYCxe7ohMUO8flcy7tGgJNGmz3iQ0N5DA6KOT8e0vOwlPz+KU5NTnc/MnlZNSuFrBQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=DEvSKL8SBZbmVYTr5Jh7TPQMAbuz0QKA6zMsdakHRLs=;
b=FyIIFqIDx7MfZ8n1bMgkFsfM7HICgroRfEzs88Yc2astO7p7OCtMXP0rBukTnzZRYOxFks0M7roHhRUm9R8EIUEGvIMv37dx4m3w1jX/0Da1LzZhKm/tfIN9NNKWtLAKonmGsIw0tUaXma3zwSrLrtBzQemTHTbo2UEJKxfjI9C/ZxBUCFaBGfYLlsUShOqmxbDNLN1CbfjdiFnI/VG4fshyTh7xDKtsXdu68Y/ga9hDmQfFOqni3RTN/Q1/ipqH6fBOxlAVCTzjdCWTfpg06cI/T9SdOi7PbV2hj9O9pqA9EgOSdJmqvgw1J2dR50Ih8Xu33zhW7LzqQitz3+Kjzw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
81.187.90.236) smtp.rcpttodomain=mit.edu smtp.mailfrom=norgie.net; dmarc=pass
(p=reject sp=reject pct=100) action=none header.from=norgie.net; dkim=pass
(signature was verified) header.d=norgie.net; arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=DEvSKL8SBZbmVYTr5Jh7TPQMAbuz0QKA6zMsdakHRLs=;
b=VOOGQJ9LcfvaVrJr3ChisVr9QbZkZSxiqnTMsQCbbFz4aHPbWYw8MkS5slGhc9vrsZlPWoHEmjayXAelJV32Dxb7V6DzOks3j3U7nnccbefTC2s4Wd7Jxex/I288KWRdB2TfZA2Iiqe+llTVFmaXsoLo6CEx+rKNqbsE2c0oK0c=
Authentication-Results: spf=pass (sender IP is 81.187.90.236)
smtp.mailfrom=norgie.net; dkim=pass (signature was verified)
header.d=norgie.net;dmarc=pass action=none header.from=norgie.net;
Received-SPF: Pass (protection.outlook.com: domain of norgie.net designates
81.187.90.236 as permitted sender) receiver=protection.outlook.com;
client-ip=81.187.90.236; helo=javelin.dmz.norgie.net; pr=C
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=norgie.net; s=default;
t=1696890632; bh=wMA7qPO+wzIlqn6HEHomRcvAvJEoi6gN/Vbibr7z1zo=;
h=Date:Subject:To:Cc:References:From:In-Reply-To:From;
b=VAY5bpzu9mzC2Nz6dqWTchuZa8VP97q+pMVz/EXUPvxDxdY1VqaQGttl2kfbZIPCE
ehmDCOLBkZKUkXVtGRzwYt/CFGHeIiPOWZeF2/wAAQfylPj9c0rGkTcWS2B0Q8Pkoe
UjAZMnLi6HqS7TwPLxzOlChUWnabe+9HfCdOcakRwrjny/PNa4gdkRFb8bssjXlgYG
Qr1Az/RZzMhFPnUwMqiREemJ5paBrL2BDCb75NlfxEQbbJ5al2ElbON7LbGGF5kpTx
2y8zGQT+ezC59z6SyZf5UHmB5I9lgGzRYweu4oeyyEP+LVY9nKMi1QaqpvzWEvROgI
fcEJa5+uQrtjohfuGBiaSgAWft8vFFEmhnwT+D2aQMYfQtp2CKEJhwzByzJqWERexu
9V/HVWWaE4LrR0MXuaLn9bUtAVIrLTm1spvNS5mVr+gVRVbWTKgnXfFGJMixALRpjZ
l6SlsNDNO75ZdUlosdewbHgNj9+ttoO9dqeD2NCCCF7NugkYHkbZyFlM3Lyz00GB56
2DfclsQCqXNp9GsfzYnZIjmezQvRguRobKWAhUucJ9jcBM4PVgPGIp5LQiBiNKzGNl
R6NtQTc+X7a+zA2zyUcEIOvuYKUy5eSoGMA8XEVyU9l0e0hcU9dmSYCpWOBGo7Or1e
H35doeFhyd0k7NnNcvd8n2zw=
Content-Language: en-GB
X-Clacks-Overhead: GNU Terry Pratchett
In-Reply-To: <202310071703.397H32cD031876@hedwig.cmf.nrl.navy.mil>
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DS1PEPF0001709B:EE_|SN4PR01MB7469:EE_
X-MS-Office365-Filtering-Correlation-Id: 172bb819-82c8-4b04-2971-08dbc9175a39
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: qTWB5ljDB/hM/O7oT7YidWBFPpUJgj+csTbfOSD/LJqapQu4qoU8fgcNC3+GZZfKvI+4nkI61gZBLvSJiYOrMrC+Ut8gOlxCSXQm6FB7JBT8QoSmrfUk7ctyojHJQtRyRVdT+vFLX0XoFwkirKPERqTneryZwcdJfoZX+K6K4f3Mlnuyl1NwPdD0e2/vN310/m37aVPoe0MPmYw9FbrTfzI6mplgqxUYYBmghKgzfBGS7X6nNs+SSlA8m2Son81SrcVqJG9DhBbIfSHRBu1W+v2nBhVfXtIl+8VLrxmygEQ/nhncH7VM4QzyYvRObE8jxhMYHS3CSs7Q6xMBSQpmAaXrknN7jLnuLiSka9JXtvBRzhPj8lzBPixZYbqL037QB0QuVXg4ib4b+qB6GIvcMBDxQPZFclnHQHFW91gDBTDPD5uTe2bqBuTUe9AhozfOXoh0eQk5C4ZiBZm8m0EzUm5rqHZ2uoMvolWj5lczmU2Eo/5t9ng2X/MkObF07it48wrSx2qkBbAU0/yaSUz/E9xUveRL/TkSdcvwg6EjuWHxrhtMiUHG+hVZ19RawRmt0PXOqTm5Nn+pApmurMmQP9mmSCZcoUWBATETth3zFINrU4vKkT8YfC1N2qFFRSCippiAfekGSycdK/aHk1uuQiv6o7+f+4DsQgNxT+uDUU07Ej1bziUB010+pzvtjHd7xwTCBw+OMNxO7BgTdpnVaSbOGh79feWjWlZIchTO7Ddp8RQW7WDKrMZhDlgdDlxHRFSCfgBcutSWojKotmHRVA==
X-Forefront-Antispam-Report: CIP:81.187.90.236; CTRY:GB; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:javelin.dmz.norgie.net; PTR:javelin.dmz.norgie.net;
CAT:NONE;
SFS:(13230031)(4636009)(376002)(136003)(396003)(39860400002)(346002)(61400799006)(48200799006)(64100799003)(451199024)(31696002)(356005)(86362001)(7636003)(7596003)(36756003)(31686004)(9686003)(53546011)(2906002)(498600001)(966005)(6862004)(4326008)(8676002)(5660300002)(6966003)(336012)(6266002)(83380400001)(426003)(316002)(68406010)(786003)(70586007)(26005)(90184004)(42696004)(43740500002);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Oct 2023 22:30:33.5527 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 172bb819-82c8-4b04-2971-08dbc9175a39
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: DS1PEPF0001709B.namprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN4PR01MB7469
X-OriginatorOrg: mitprod.onmicrosoft.com
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <55ca3c6f-e1b1-26c4-c4e7-af09fba8fe22@csits.net>
X-Mailman-Original-References: <ZSExJFGjyAMYAGGw@lightning.iz.norgie.net>
<202310071703.397H32cD031876@hedwig.cmf.nrl.navy.mil>
 by: Mike - Mon, 9 Oct 2023 22:30 UTC

On 07/10/2023 18:03, Ken Hornstein wrote:
>> In a similar vien to my previous communication, I've found myself trying
>> to update my principles from 3DES to AES. While this was successful for
>> the most part, one of the issues that evades me is the correct way to
>> rekey kadmin/history, as it seems the usual process doesn't work.
>> Please could someone advise, as I haven't been able to find the Google
>> foo.
>
> The official documentation has the answer:
>
> https://web.mit.edu/kerberos/krb5-latest/doc/admin/database.html#updating-history-key
>
> Basically you run "cpw -randkey kadmin/history". There's no proper
> rollover support, unfortunately; all stored old keys get invalidated.
> My memory of the code is that the old keys will stick around in the
> database until the principal changes it's password.
>
> --Ken

Thanks Ken,

That did it. Basically I was missing out -randkey and getting:

"change_password: Cannot change protected principal while changing
password for "kadmin/history"

Now I get it!

Thanks again,
Mike.

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor