The command
sudo kprop -r MY.DOMAIN -f /var/lib/krb5kdc/slave_datatrans slave_kdc.my.domain
returns
kprop: Key table entry not found while getting initial credentials
This is a new installation on two linux debian servers. The master_kdc seems to work, but I cannot get the database to propagate. I manually copied the database dump and loaded it onto the slave_kdc, but the propagation still does not work.
/etc/krb5.conf
[libdefaults]
default_realm = MY.DOMAIN
# The following krb5.conf variables are only for MIT Kerberos.
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
[realms]
MY.DOMAIN = {
kdc = master_kdc.my.domain
kdc = slave_kdc.my.domain
admin_server = master_kdc.my.domain
}
[domain_realm]
.my.domain = MY.DOMAIN
my.domain = MY.DOMAIN
/etc/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 750,88
[realms]
MY.DOMAIN = {
database_name = /var/lib/krb5kdc/principal
admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
acl_file = /etc/krb5kdc/kadm5.acl
key_stash_file = /etc/krb5kdc/stash
kdc_ports = 750,88
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
master_key_type = des3-hmac-sha1
#supported_enctypes = aes256-cts:normal aes128-cts:normal
default_principal_flags = +preauth
}
[logging]
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log
/etc/krb6kdc/kadm5/acl
john/admin@MY.DOMAIN *
/etc/krb5kdc/kpropd.acl
host/master_kdc.my.domain@MY.DOMAIN
host/slave_kdc.my.domain@MY.DOMAIN
I installed xinetd and created the following file and enabled and started the xinetd service.
/etc/xinetd.d/krb5_prop
service krb5_prop
{
disable = no
socket_type = stream
protocol = tcp
wait = no
user = root
server = /usr/sbin/kpropd
}
result of sudo cat /etc/services | grep krb5
kerberos 88/tcp kerberos5 krb5 kerberos-sec # Kerberos v5
kerberos 88/udp kerberos5 krb5 kerberos-sec # Kerberos v5
krb5_prop 754/tcp krb-prop krb_prop hprop # Kerberos slave propagation
I generated the /etc/krb5.keytab file on master_kdc and on slave_kdc after copying over the database.
kadmin: ktadd host/slave_kdc.my.domain
Nothing is being logged (I don't know why).
/etc/bind/zones/db.my.domain
$TTL 604800
@ IN SOA master_kdc.my.domain. john.my.domain. (
5 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
; Name servers - NS records
@ IN NS master_kdc.my.domain.
@ IN NS slave_kdc.my.domain.
; Name servers - A records
master_kdc IN A AAA.BBB.CCC.DD1
slave_kdc IN A AAA.BBB.CCC.DD2
; Kerberos services
_kerberos._udp.MY.DOMAIN. IN SRV 1 0 88 master_kdc.my.domain.
_kerberos._tcp.MY.DOMAIN. IN SRV 1 0 88 master_kdc.my.domain.
_kerberos._udp.MY.DOMAIN. IN SRV 10 0 88 slave_kdc.my.domain.
_kerberos._tcp.MY.DOMAIN. IN SRV 10 0 88 slave_kdc.my.domain.
_kerberos-adm._tcp.MY.DOMAIN. IN SRV 1 0 749 master_kdc.my.domain.
_kpasswd._udp.MY.DOMAIN. IN SRV 1 0 464 master_kdc.my.domain.
/etc/bind/zones/db.AAA
$TTL 604800
@ IN SOA master_kdc.my.domain. john.my.domain. (
5 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
; Name servers - NS records
@ IN NS master_kdc.my.domain.
@ IN NS slave_kdc.my.domain.
master_kdc IN A AAA.BBB.CCC.DD1
slave_kdc IN A AAA.BBB.CCC.DD2
; Name servers - PTR records
DD1 IN PTR master_kdc.my.domain.
DD2 IN PTR slave_kdc.my.domain.
Best Answer
I spent few hours to resolve this exact same issue. Finally it was solved by this steps:
Apparently kprop use "kinit -k" to get a ticket and this only work when you have your master host entry in keytab.