Kerberos: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
No edit summary |
||
| Line 1: | Line 1: | ||
We use [http://web.mit.edu/Kerberos/ MIT Kerberos 5] for authentication. Our kerberos realm is CSCLUB.UWATERLOO.CA. KDCs run on [[Machine_List# |
We use [http://web.mit.edu/Kerberos/ MIT Kerberos 5] for authentication. Our kerberos realm is CSCLUB.UWATERLOO.CA. KDCs run on [[Machine_List#auth1|auth1]] (kdc1) and [[Machine_List#artificial-flavours|artificial-flavours]] (kdc2). |
||
=== Password Resets === |
=== Password Resets === |
||
| Line 5: | Line 5: | ||
Changing other users' passwords |
Changing other users' passwords |
||
* ssh |
* ssh auth1 |
||
* sudo kadmin.local |
* sudo kadmin.local |
||
* cpw username |
* cpw username |
||
| Line 17: | Line 17: | ||
If you are on syscom, you can force a user to change their password by doing this: |
If you are on syscom, you can force a user to change their password by doing this: |
||
* ssh |
* ssh auth1 |
||
* sudo kadmin.local |
* sudo kadmin.local |
||
* modify_principal +needchange [username] |
* modify_principal +needchange [username] |
||
Revision as of 16:18, 3 October 2013
We use MIT Kerberos 5 for authentication. Our kerberos realm is CSCLUB.UWATERLOO.CA. KDCs run on auth1 (kdc1) and artificial-flavours (kdc2).
Password Resets
To change your own password you can run passwd on any of the club's machines.
Changing other users' passwords
- ssh auth1
- sudo kadmin.local
- cpw username
- Enter new password and confirm
API Documentation. While not even close to enough to let you do most things that you'd want to do with Kerberos (and also being somewhat woefully out-of-date, considering it's from 1996), it's at least a start.
Expiring Passwords
If you are on syscom, you can force a user to change their password by doing this:
- ssh auth1
- sudo kadmin.local
- modify_principal +needchange [username]
bofh's Kerberos5 cheat sheet, or "what the fuck does *that* error message mean, exactly?"
- If GSSAPI complains about "Wrong Principal in Request", make sure there's no clockskew on the machine trying to get the service ticket and the machine running the service that you are trying to get a GSS token to. This will cause this error for some insane reason, despite there being ANOTHER message for clockskew that specifically says "your clocks are off, dumbass" - it just never seems to be used in the source code anywhere (as of MIT-KRB5 1.9, at least).
- There are some "generic" errors that are hard to debug. A few possible causes: unreadable krb5.keytab, reverse resolution of a host does not match its principal.