I've set up a kerberos server with following configuration


default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
  default_realm = DOMAIN.NET
  dns_lookup_realm = true
  dns_lookup_kdc = true
  ticket_lifetime = 24h
  renew_lifetime = 7d
  forwardable = true
  kdc = server.priv.domain.net
  admin_server = server.priv.domain.net

 .domain.net = DOMAIN.NET
  domain.net = DOMAIN.NET


kdc_listen = 88
kdc_tcp_listen = 88

    database_name = /usr/local/var/krb5kdc/principal
    acl_file = /usr/local/var/krb5kdc/kadm5.acl
    key_stash_file = /usr/local/var/krb5kdc/.k5.DOMAIN.NET
    kdc_listen = 88
    kdc_tcp_listen = 88
    max_life = 10h 0m 0s
    max_renewable_life = 7d 0h 0m 0s

I thought that, kerberos accepts authentication request from host, which has keytab issued from kerberos server. But it seems to me, it serve authentication from everywhere even, there is no host principal and keytab have been set up. Could somebody please advise?




Assuming that the principal for your host has been created on the server, one needs to run ktadd from kadmin shell

ktadd -k /etc/krb5.keytab host/blah.DOMAIN.NET

Exit the kadmin shell and run klist to verify that you have obtained a Kerberos ticket.

[1] - https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/Configuring_a_Kerberos_5_Client.html

  • Hi NOLFXceptMe, it seems my server serves every host even the client host principal hasn't been created nor added keytab. So, the question is, why does the server serve authentication for clients without client principals and keytab? – peep Apr 13 '17 at 16:29
  • Only a secure service would request for Kerberos based authentication and deny unauthenticated requests. I'm not sure what service is being served to the client. Do you mean LDAP authentication? – NOLFXceptMe Apr 13 '17 at 16:36
  • Hi, I'm able to authenticate user, using kinit on any host, just simply set up krb5.conf without host principal or deploy keytab. I expected that​ the krb server reject any authentication from everywhere without host principal and keytab. But my server still does authenticate... – peep Apr 13 '17 at 16:45
  • Hi, what is the output of klist? If you have a valid output, I think we can be sure of a keytab existing on the host. – NOLFXceptMe Apr 14 '17 at 9:20
  • Well, If I didn't created ANY host principal and generated keytab(thisis the case), but I'm still able to use this kerberos server to authenticate via SSH and NIS(with krb_pam modul) means to me, my kerberos server authenticate without host principal and keytab. Again, I expected to kerberos server only authenticates IF host principal present and keytab in the client host has been deployed. Non of these requirements are present on the client, SSH login still work..why? – peep Apr 18 '17 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.