Mit krb5 server: where is kpasswd daemon? How the server can change user password?

0 votes

1 answer

22 views

kerberos

                          On Kerberos with have 3 "servers" kdc is the key distribution center, as name said provide "tickets", kadmin is for admin the server (add principals, keytabs, etc.), and finally kpasswdd is for permit the user to change his password from remote (using passwd+krb5_pam module).
I have configured a mit krb5 server, works all: keytab, principals, kinit, etc..the problem is when I change password from a client give me error, probably for the lack of kpasswd daemon

    dnf provides */kpasswdd
    Last metadata expiration check: 1:09:14 ago on Thu 13 Mar 2025 07:39:41 AM CET.
    heimdal-server-7.8.0-5.el9.x86_64 : Heimdal kerberos server
    Repo        : epel
    Matched from:
    Filename    : /usr/libexec/kpasswdd

Any idea?

This is the error as you can see authentication login works fine, but give error "cannot contact kdc" but I can resolve it using dig and nslookup

    debian login: pino
    Password: 
    Linux debian 6.1.0-30-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.124-1 (2025-01-12) x86_64
    
    The programs included with the Debian GNU/Linux system are free software;
    the exact distribution terms for each program are described in the
    individual files in /usr/share/doc/*/copyright.
    
    Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
    permitted by applicable law.
    Creazione della directory «/home/pino».
    pino@debian:~$ passwd 
    Current Kerberos password: 
    Enter new Kerberos password: 
    Retype new Kerberos password: 
    Cannot contact any KDC for requested realm
    password change failed: Invalid credentials
    passwd: Errore manipolazione token di autenticazione
    passwd: password unchanged

kdc seems can be resolved (otherwise even login will fail)

    nslookup -type=srv _kerberos._tcp.BLU.PRIV
    Server:		192.168.201.1
    Address:	192.168.201.1#53
    
    Non-authoritative answer:
    _kerberos._tcp.BLU.PRIV	service = 0 100 88 ldap1.blu.priv.
    
    Authoritative answers can be found from:

Even kpasswd fail

    kpasswd 
    Password for pino@BLU.PRIV: 
    Enter new password: 
    Enter it again: 
    kpasswd: Cannot contact any KDC for requested realm changing password


                        

Asked by elbarna (13690 rep)

Mar 13, 2025, 08:01 AM
Last activity: Mar 13, 2025, 12:34 PM

Mit krb5 server: where is kpasswd daemon? How the server can change user password?

Related Questions