Date: Fri, 31 May 2013 08:46:48 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Josh Tanski <mortonjt@rochester.rr.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: 8.4 to 9.1 Upgrade Kerberos Auth Stops Working "Wrong
	principal in request"
Message-ID: <20130531124648.GW6434@tamriel.snowman.net>
References: <51A89A1A.8040405@rochester.rr.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="UEYxRAcbr7cS1UOX"
Content-Disposition: inline
In-Reply-To: <51A89A1A.8040405@rochester.rr.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org


--UEYxRAcbr7cS1UOX
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Josh,

  That key type (des-cbc-md5) has looonngggg been deprecated and has
  been actively disabled and disallowed from use in modern Kerberos
  libraries.

  Please go get an AES256 key and install that instead.

  	Thanks,

		Stephen

* Josh Tanski (mortonjt@rochester.rr.com) wrote:
> I have Kerberos Authentication working for PostgreSQL 8.4 on Debian
> Squeeze, against a Windows 2000 Server Domain.  I tried upgrading
> some test servers to Debian Wheezy which upgrades PostgreSQL to 9.1,
> but Kerberos authentication breaks with the "Wrong principal in
> request" error.
>=20
> These servers ultimately use Apache2/mod-auth-kerb/php5-cgi to do
> SSO in a Windows web browser and that gets passed to PostgreSQL, but
> I have the issue with psql as well and that is where I normally
> start troubleshooting.  Mod-Auth-Kerb in Apache2 continues to
> authenticate and work after the upgrade, only PostgreSQL stops
> working.
>=20
> Here is everything I've looked at and the results I get - I am
> baffled on why this stopped working with 9.1, my config is the same,
> hostnames, DNS, clocks, etc. look good and nothing changed there.
> Below is from a fresh, clean install of Debian Wheezy/ PostgreSQL
> 9.1 on a new test VM and I still get the error.  If anyone sees
> something I am doing wrong or something I missed and should be
> looking into, your advice would be greatly appreciated.
>=20
> Thanks,
> Josh
>=20
> IN /etc/postgresql/9.1/main/postgresql.conf
> krb_server_keyfile =3D '/etc/postgresql/9.1/main/ss-sv-tmp40_pg.keytab'
>=20
> IN /etc/postgresql/9.1/main/pg_hba.conf
> host     all             all         10.203.105.96 255.255.255.255
> krb5 krb_server_hostname=3Dss-sv-tmp40.mydomain.local
>=20
> root@ss-sv-tmp40:~# hostname --fqdn
> ss-sv-tmp40.mydomain.local
>=20
> root@ss-sv-tmp40:~# cat /etc/hosts
> 127.0.0.1       localhost
> 10.203.105.96   ss-sv-tmp40.mydomain.local   ss-sv-tmp40
>=20
>=20
> root@ss-sv-tmp40:~# klist -ek /etc/postgresql/9.1/main/ss-sv-tmp40_pg.key=
tab
> Keytab name: FILE:/etc/postgresql/9.1/main/ss-sv-tmp40_pg.keytab
> KVNO Principal
> ---- --------------------------------------------------------------------=
------
>    1 postgres/ss-sv-tmp40.mydomain.local@MYDOMAIN.LOCAL (des-cbc-md5)
>=20
>=20
> jdt@ss-sv-tmp40:~$ kinit jdt@MYDOMAIN.LOCAL
> Password for jdt@MYDOMAIN.LOCAL:
> jdt@ss-sv-tmp40:~$ klist -e
> Ticket cache: FILE:/tmp/krb5cc_1000
> Default principal: jdt@MYDOMAIN.LOCAL
>=20
> Valid starting    Expires           Service principal
> 31/05/2013 07:36  31/05/2013 15:36  krbtgt/MYDOMAIN.LOCAL@MYDOMAIN.LOCAL
>         renew until 31/05/2013 15:36, Etype (skey, tkt):
> arcfour-hmac, arcfour-hmac
>=20
> jdt@ss-sv-tmp40:~$ psql -h ss-sv-tmp40.mydomain.local -U jdt
> psql: Kerberos 5 authentication rejected:  Wrong principal in request
> jdt@ss-sv-tmp40:~$ klist -e
> Ticket cache: FILE:/tmp/krb5cc_1000
> Default principal: jdt@MYDOMAIN.LOCAL
>=20
> Valid starting    Expires           Service principal
> 31/05/2013 07:36  31/05/2013 15:36  krbtgt/MYDOMAIN.LOCAL@MYDOMAIN.LOCAL
>         renew until 31/05/2013 15:36, Etype (skey, tkt):
> arcfour-hmac, arcfour-hmac
> 31/05/2013 07:38  31/05/2013 15:36  postgres/ss-sv-tmp40.mydomain.local@
>         renew until 31/05/2013 15:36, Etype (skey, tkt):
> des-cbc-crc, des-cbc-crc
> 31/05/2013 07:38  31/05/2013 15:36
> postgres/ss-sv-tmp40.mydomain.local@MYDOMAIN.LOCAL
>         renew until 31/05/2013 15:36, Etype (skey, tkt):
> des-cbc-crc, des-cbc-crc
>=20
>=20
> root@ss-sv-tmp40:~# tail /var/log/postgresql/postgresql-9.1-main.log
> 2013-05-31 07:38:07 EDT LOG:  Kerberos recvauth returned error -1765328240
> postgres: Wrong principal in request from krb5_recvauth
> 2013-05-31 07:38:07 EDT FATAL:  Kerberos 5 authentication failed for
> user "jdt"
>=20
>=20
> root@ss-sv-tmp40:~# cat /etc/krb5.conf
> [libdefaults]
>         default_realm =3D MYDOMAIN.LOCAL
>         allow_weak_crypto =3D true
> <snip>
>=20
>=20
> --=20
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-admin

--UEYxRAcbr7cS1UOX
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlGom7gACgkQrzgMPqB3kihLngCgl92uPws9p70BJRsbxKyX4JoO
62gAoJXicARc9/e5wKoJRu0/u/oIw+tD
=e4BQ
-----END PGP SIGNATURE-----

--UEYxRAcbr7cS1UOX--