keytab user permission

[citkorohr]

Hi folks,

I'm facing a really strange error right now.
In my testlab I created a new infrastructure with a new domain where mwg is a member of.
I created the keytab while stirctly following this document.

Afterwards I uploaded the file to my mwg.

My rules for AD authentication is the following:

Then I wanted to access a website e.g. google.com. But my mwg requested username and password.
The time on the AD-controller and on my mwg are correct.
My DNS works fine, too. Deleting my kerberos tickets and the dns cache didn't help.
The keytab is correct. I managed to decrypt the encrypted kerberos authentication via wireshark.

The mwg-core.errors.log gave the following output:

This is an odd behaviour and I don't understand it.
In our productive environment I created the keytab and everything else like this and didn't face the error. Has someone a good explanation for this?

[Former Member]

Weird... what MWG version are you on by chance?

Also, can you run this command?

# ll /etc/krb5.mwg.keytab
-rw-r--r-- 1 root root 977 Aug 28 17:49 /etc/krb5.mwg.keytab

[citkorohr]

Hi jscholte,

we're using MWG version 7.7.1. UI Version is 7.7.2.16.0 (26564).

The output ist

-rw------- 1 root root 392 Sep  4 14:11 krb5.mwg.keytab

[Former Member · Accepted solution]

I'm not sure why the permissions would be different, did you upload from the UI or the CLI?

Regardless, lets chmod the file to match mine:

chmod 644 /etc/krb5.mwg.keytab

[citkorohr]

Hi jscholte,

I uploaded the file via the GUI.

After changing the rights the authentication via kerberos was successful.

But it's still strange...

[Former Member]

You could try uploading it again and seeing what permissions you get. If its 600, then thats a problem, if you get 644, then I'd say we're safe.