Cannot bind clients to Open Directory with Kerberos-based security enabled

This topic has 1 reply, 1 voice, and was last updated 18 years, 1 month ago by natekruser.

Viewing 2 posts - 1 through 2 (of 2 total)

Author

Posts

October 2, 2008 at 5:04 pm #374324

Participant

I’m new to Mac, OD and Kerberos; please forgive me if I’m using terminology incorrectly or providing useless information (and please let me know!).

Issue:

I have encountered a problem with setting up Open Directory and Kerberos.

I cannot bind a client computer to the OD Master if any of the Security checkboxes that require Kerberos are checked in Server Admin->OD->Policy->Binding (Digitally sign all packets, Encrypt all packets, and Block man-in-the-middle attacks).

Overview:

I am attempting to set up OS X 10.5 Server to provide single-sign-on access to several servers for ~75 Mac clients. I am configuring a brand new system for this purpose.

I work in an environment where our network is controlled by our parent organization, and I have no direct access to the equipment. My new server has been given a DNS entry on the parent organization’s servers.

I have enabled the Open Directory service on the new server, and set it up to be an OD Master. Server Admin shows the LDAP Server, Password Server, and Kerberos as Running.

If I disable the Kerberos-based security options in Server Admin, I can bind a client to the OD Master. If I re-enable the Kerberos-based security options, the client remains able to log-in and access resources.

In Server Admin there is a recurring message in the Kerberos Administration Log:

Oct 02 10:14:35 MY_SERVER_FQDN kadmin.local[14600](info): No dictionary file specified, continuing without one.

Details:

I have looked through these forums, and others to look for information that is often requested when debugging OD/Kerberos issues, and the following is an attempt to provide that information.

On the server:

$ hostname
MY_SERVER_FQDN

$ host MY_SERVER_FQDN
MY_SERVER_FQDN has address MY_SERVER_IP

$ host MY_SERVER_IP
MY_SERVER_IP.in-addr.arpa domain name pointer MY_SERVER_FQDN

$ changeip -checkhostname
Primary address     = MY_SERVER_IP

Current HostName    = MY_SERVER_FQDN
DNS HostName        = MY_SERVER_FQDN

The names match. There is nothing to change.

$ sudo sso_util info -r /LDAPv3/127.0.0.1
The Local realm name is:MY_SERVER_FQDN_IN_CAPS

$ kinit TEST_USERNAME
$ klist
Kerberos 5 ticket cache: 'API:1'
Default principal: TEST_USERNAME@MY_SERVER_FQDN_IN_CAPS

Valid Starting     Expires            Service Principal
10/02/08 12:31:38  10/02/08 22:31:38  krbtgt/MY_SERVER_FQDN_IN_CAPS@MY_SERVER_FQDN_IN_CAPS
	renew until 10/09/08 12:31:38

When the Kerberos-based security options are disabled, and the attempt to bind a client is successful, there is an edu.mit.Kerberos file at /Library/Preferences on the client.

The client edu.mit.Kerberos file contains:

# WARNING This file is automatically created, if you wish to make changes
# delete the next two lines
# autogenerated from : /LDAPv3/MY_SERVER_FQDN
# generation_id : 565311167
[libdefaults]
	default_realm = MY_SERVER_FQDN_IN_CAPS
[realms]
	MY_SERVER_FQDN_IN_CAPS = {
		admin_server = MY_SERVER_FQDN
		kdc = MY_SERVER_FQDN
	}
[domain_realm]
	MY_PARENT_DOMAIN = MY_SERVER_FQDN_IN_CAPS
	.MY_PARENT_DOMAIN = MY_SERVER_FQDN_IN_CAPS
[logging]
	admin_server = FILE:/var/log/krb5kdc/kadmin.log
	kdc = FILE:/var/log/krb5kdc/kdc.log

On the client:

$ kinit TEST_USERNAME
$ klist
Kerberos 5 ticket cache: 'API:1'
Default principal: TEST_USERNAME@MY_SERVER_FQDN_IN_CAPS

Valid Starting     Expires            Service Principal
10/02/08 08:36:07  10/02/08 18:36:07  krbtgt/MY_SERVER_FQDN_IN_CAPS@MY_SERVER_FQDN_IN_CAPS
	renew until 10/09/08 08:36:07

Also, using Network Utility, I ran a Port Scan on the server from the client.

Port Scan has started ...

Port Scanning host: MY_SERVER_IP

	 Open TCP Port: 	22     		ssh
	 Open TCP Port: 	88     		kerberos
	 Open TCP Port: 	106    		3com-tsmux
	 Open TCP Port: 	311    		asip-webadmin
	 Open TCP Port: 	389    		ldap
	 Open TCP Port: 	548    		afpovertcp
	 Open TCP Port: 	625    		dec_dlm
	 Open TCP Port: 	749    		kerberos-adm
	 Open TCP Port: 	2336   		appleugcontrol
	 Open TCP Port: 	3659   		apple-sasl
	 Open TCP Port: 	5900   		vnc-server
Port Scan has completed ...

Please forgive the gigantic post, I’m just hoping that something here will provide enough information to help figure out where I went wrong in my setup. Any help or advice is greatly appreciated!

October 13, 2008 at 3:02 pm #374443

natekruser

Participant

Additional information:

I have a web server running OS X 10.5 that I have configured under Server Admin as “Connected to a Directory System.” I added the OD Server to the web server using “Add a new Directory Server” within Directory Utility.

I then attempted to use the “Kerberize Services” option within Server Admin on the web server, and received an error message:

Unexpected error.
An unexpected error of type 13 occurred.

Also, on the web server I tried to get more information using ‘dig’:

$ dig myservername.myparentdomain.edu

; <<>> DiG 9.4.2-P2 <<>> myservername.myparentdomain.edu
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28686
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3

;; QUESTION SECTION:
;myservername.myparentdomain.edu.	IN	A

;; ANSWER SECTION:
myservername.myparentdomain.edu. 300	IN	A	myserverip

;; AUTHORITY SECTION:
myparentdomain.edu.		300	IN	NS	parentdnsserver1.myparentdomain.edu.
myparentdomain.edu.		300	IN	NS	parentdnsserver2.myparentdomain.edu.
myparentdomain.edu.		300	IN	NS	parentdnsserver3.myparentdomain.edu.

;; ADDITIONAL SECTION:
parentdnsserver1.myparentdomain.edu. 43200 IN	A	parentdnsserver1ip
parentdnsserver2.myparentdomain.edu. 43200 IN	A	parentdnsserver2ip
parentdnsserver3.myparentdomain.edu. 43200 IN	A	parentdnsserver3ip

;; Query time: 5 msec
;; SERVER: parentdnsserver1ip#53(parentdnsserver1ip)
;; WHEN: Mon Oct 13 09:28:55 2008
;; MSG SIZE  rcvd: 178

On the OD server I used dscl for additional information:

$ dscl . -readall Config
AppleMetaNodeLocation: /Local/Default
RecordName: dhcp
RecordType: dsRecTypeStandard:Config
-
AppleMetaNodeLocation: /Local/Default
GeneratedUID: C56ACC6A-3019-48FF-825F-B2D3B2B613E8
RecordName: Kerberos:myservername.myparentdomain.edu
RecordType: dsRecTypeStandard:Config
XMLPlist:
 <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>KADM_List</key>
	<array>
		<string>myservername.myparentdomain.edu</string>
	</array>
	<key>KDC_List</key>
	<array>
		<string>myservername.myparentdomain.edu</string>
	</array>
</dict>
</plist>

-
AppleMetaNodeLocation: /Local/Default
KDCConfigData:
 [libdefaults]
	default_realm = LKDC:SHA1.A780EC3ABD99059A74AECBFAB50F81270B8F13F9

[kdcdefaults]
	kdc_ports = 88
	kdc_tcp_ports = 88

[realms]
	LKDC:SHA1.A780EC3ABD99059A74AECBFAB50F81270B8F13F9 = {
		kadmind_port = 749
		max_life = 10h 0m 0s
		max_renewable_life = 7d 0h 0m 0s
		master_key_type = des3-hmac-sha1
		supported_enctypes = des3-hmac-sha1:normal arcfour-hmac-md5:normal des-cbc-crc:normal des-cbc-crc:v4
		acl_file = /var/db/krb5kdc/kadm5.acl
		admin_keytab = /var/db/krb5kdc/kadm5.keytab
		database_name = /var/db/krb5kdc/principal.LKDC:SHA1.A780EC3ABD99059A74AECBFAB50F81270B8F13F9
		key_stash_file = /var/db/krb5kdc/.k5.LKDC:SHA1.A780EC3ABD99059A74AECBFAB50F81270B8F13F9
	}
[logging]
	kdc = FILE:/var/log/krb5kdc/kdc.log
	admin_server = FILE:/var/log/krb5kdc/kadmin.log

RealName: LKDC:SHA1.A780EC3ABD99059A74AECBFAB50F81270B8F13F9
RecordName: KerberosKDC
RecordType: dsRecTypeStandard:Config
-
dsAttrTypeNative:MaxIdleThreads: 4
dsAttrTypeNative:MaxThreads: 128
AppleMetaNodeLocation: /Local/Default
RecordName: lookupd
RecordType: dsRecTypeStandard:Config
-
AppleMetaNodeLocation: /Local/Default
RecordName: NetBootServer
RecordType: dsRecTypeStandard:Config
-
AppleMetaNodeLocation: /Local/Default
PasswordServerLocation: myserverip
RecordName: passwordserver
RecordType: dsRecTypeStandard:Config
-
dsAttrTypeNative:apple-serviceinfo:
 <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.macosxserver.host</key>
	<array>
		<string>myservername.myparentdomain.edu</string>
	</array>
	<key>com.apple.macosxserver.virtualhosts</key>
	<dict>
		<key>27FBC74D-36DA-47F5-BE9E-F7CADB437DF2</key>
		<dict>
			<key>hostDetails</key>
			<dict>
				<key>http</key>
				<dict>
					<key>enabled</key>
					<true/>
					<key>port</key>
					<integer>8008</integer>
				</dict>
				<key>https</key>
				<dict>
					<key>enabled</key>
					<false/>
					<key>port</key>
					<integer>0</integer>
				</dict>
			</dict>
			<key>hostname</key>
			<string>myservername.myparentdomain.edu</string>
			<key>serviceInfo</key>
			<dict>
				<key>calendar</key>
				<dict>
					<key>enabled</key>
					<false/>
					<key>templates</key>
					<dict>
						<key>calendarUserAddresses</key>
						<array>
							<string>%(principaluri)s</string>
							<string>mailto:%(email)s</string>
							<string>urn:uuid:%(guid)s</string>
						</array>
						<key>principalPath</key>
						<string>/principals/__uids__/%(guid)s/</string>
					</dict>
				</dict>
			</dict>
			<key>serviceType</key>
			<array>
				<string>calendar</string>
			</array>
		</dict>
		<key>DC49FF1B-2875-46C0-9A0F-7AE3F1DCCE76</key>
		<dict>
			<key>hostDescription</key>
			<string>Default web site of myservername.myparentdomain.edu</string>
			<key>hostDetails</key>
			<dict>
				<key>http</key>
				<dict>
					<key>enabled</key>
					<true/>
					<key>port</key>
					<integer>80</integer>
				</dict>
				<key>https</key>
				<dict>
					<key>enabled</key>
					<false/>
				</dict>
			</dict>
			<key>hostname</key>
			<string>*</string>
			<key>serviceInfo</key>
			<dict>
				<key>blog</key>
				<dict>
					<key>enabled</key>
					<false/>
				</dict>
				<key>webCalendar</key>
				<dict>
					<key>enabled</key>
					<false/>
				</dict>
				<key>webMailingListArchive</key>
				<dict>
					<key>enabled</key>
					<false/>
				</dict>
				<key>wiki</key>
				<dict>
					<key>enabled</key>
					<false/>
				</dict>
			</dict>
			<key>serviceType</key>
			<array>
				<string>webMailingListArchive</string>
				<string>webCalendar</string>
				<string>blog</string>
				<string>wiki</string>
			</array>
		</dict>
	</dict>
	<key>com.apple.macosxserver.webServiceModGUID</key>
	<string>20081001120045Z</string>
</dict>
</plist>

dsAttrTypeNative:apple-serviceslocator: ::anyservice
AppleMetaNodeLocation: /Local/Default
GeneratedUID: 50317EA2-414E-4EFA-B4D7-D233A2CF019A
RecordName: ServicesInformation
RecordType: dsRecTypeStandard:Config
-
AppleMetaNodeLocation: /Local/Default
RecordName: SharePoints
RecordType: dsRecTypeStandard:Config
-
dsAttrTypeNative:code_page: 437
AppleMetaNodeLocation: /Local/Default
RecordName: SMBServer
RecordType: dsRecTypeStandard:Config

Author

Posts

Viewing 2 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.