topic Re: kinit: Can't open/find configuration file (dce / krb) when parsing name in Operating System - HP-UX

kinit: Can't open/find configuration file (dce / krb) when parsing name

Skwar — Wed, 15 Oct 2003 04:35:14 GMT

Hello.

I'm trying to authenticate against an Active Directory Domain Controller with kinit of the J5849AA B11.00.14 depot.

When I run kinit as a user, I get this error message:

vz6tml_tc51:/u/vz6tml/ > kinit
kinit: Can't open/find configuration file (dce / krb) when parsing name vz6tml

Judging from krb5.conf(4), I'd assume that it reads /etc/krb5.conf. This file contains:

root_tc51:// > cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
ticket_lifetime = 24000
default_realm = EUROPE.DELPHIAUTO.NET
dns_lookup_realm = false
dns_lookup_kdc = false

[realms]
EUROPE.DELPHIAUTO.NET = {
kdc = dewup-dc01.europe.delphiauto.net:88
admin_server = dewup-dc01.europe.delphiauto.net:749
default_domain = europe.delphiauto.net
}

[domain_realm]
.europe.delphiauto.net = EUROPE.DELPHIAUTO.NET
europe.delphiauto.net = EUROPE.DELPHIAUTO.NET

[appdefaults]
pam = {
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
}

Why do I get the error message "kinit: Can't open/find configuration file (dce / krb) when parsing name vz6tml"?

Thanks a lot,
Alexander

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Bruno Ganino — Wed, 15 Oct 2003 05:07:26 GMT

Have you Kerberos 5 (NCSA) installed in your system? If yes:

Some UNIX systems come with (unconfigured) kerberos 4 or DCE clients on them (HP and Solaris are two that do). What the error means is that you are running the kinit that came on the system and not the Kerberos 5 kinit you got from NCSA.
Check the instructions on the download page to set your path correctly
Bye
Bruno

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Bruno Ganino — Wed, 15 Oct 2003 05:10:21 GMT

This is link for you! See
http://www.ncsa.uiuc.edu/UserInfo/Resources/Software/kerberos/unix_install_remote.html

Good luck
Bruno

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Skwar — Wed, 15 Oct 2003 05:30:34 GMT

Hi.

Uhm, I'm using the Kerberos V5 Client v1.10 from HP from the depot J5849AA B11.00.14 => http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=J5849AA

This depot installs a /usr/bin/kinit binary, which is executed when entering "kinit".

vz6tml_tc51:/u/vz6tml/ > which kinit
/usr/bin/kinit

Even when I specify the complete path, I get the error message:

vz6tml_tc51:/u/vz6tml/ > /usr/bin/kinit
kinit: Can't open/find configuration file (dce / krb) when parsing name vz6tml

The link that you posted suggested to set the $PATH correctly so that this NCSA kerberos 5 is executed and not some kerberos 4 kinit. I don't think that /usr/bin/kinit from the Kerberos 5 package of HP is a kerberos 4 kinit, is it?

I just "found" the program /usr/sbin/pamkrbval which is part of the Kerberos depot. When I execute it, I see that it seems to read /etc/krb5.conf, because it connects to the server I configured in this file:

root_tc51:// > /usr/sbin/pamkrbval -v

Validating the pam configuration files
---------- --- --- ------------- -----

Validating the /etc/pam.conf file
[LOG] : The /etc/pam.conf files permissions are fine
[LOG] : Opened : /etc/pam.conf

[PASS] : The validation of config file: /etc/pam.conf passed

[NOTICE] : The validation of config file: /etc/pam_user.conf is not done
as libpam_updbe library is not configured

Validating the kerberos config file
---------- --- -------- ------ -----
[PASS] : Initialization of kerberos passed

Connecting to default Realm
---------- -- ------- -----
[LOG] : The default realm is : EUROPE.DELPHIAUTO.NET
[LOG] : KDC hosts for realm EUROPE.DELPHIAUTO.NET :dewup-dc01.europe.delphiauto.net
[LOG] : Trying to contact KDC for realm EUROPE.DELPHIAUTO.NET...
[LOG] : Realm EUROPE.DELPHIAUTO.NET is answering ticket requests
[PASS] : Default Realm is issuing tickets

Validating the keytab entry for the host service principal
---------- --- ------ ----- --- --- ---- ------- ---------
[LOG] : Host tc51, aka tc51.
[LOG] : The default keytab name is : /etc/krb5.keytab
[LOG] : Keytab file /etc/krb5.keytab is not present So assuming Success
[IGNORE] : The keytab validation is ignored and Assuming Success

Q: Which configuration file does kinit try to read?

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Bruno Ganino — Wed, 15 Oct 2003 10:28:57 GMT

I have only documentation PAM in Italian language, I hope of have translate well. If it can be useful, see the attached one.
HTH

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Skwar — Thu, 16 Oct 2003 01:07:15 GMT

Hello again!

Uh, what does PAM have to do with all of this? To my understanding, I'd use PAM if I wanted to enable (let's say) ftp to use Kerberos. kinit, on the other hand, is independant of PAM, no?

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Bruno Ganino — Thu, 16 Oct 2003 04:23:51 GMT

Verify if exist krb5.conf in others path.
Yes ? What contains?

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Skwar — Thu, 16 Oct 2003 04:45:55 GMT

Hi!

/etc/krb5.conf exists and contains:

vz6tml_tc51:/u/vz6tml/ > cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
ticket_lifetime = 24000
default_realm = EUROPE.DELPHIAUTO.NET
dns_lookup_realm = false
dns_lookup_kdc = false

[realms]
EUROPE.DELPHIAUTO.NET = {
kdc = dewup-dc01.europe.delphiauto.net:88
admin_server = dewup-dc01.europe.delphiauto.net:749
default_domain = europe.delphiauto.net
}

[domain_realm]
.europe.delphiauto.net = EUROPE.DELPHIAUTO.NET
europe.delphiauto.net = EUROPE.DELPHIAUTO.NET

[appdefaults]
pam = {
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
}

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Skwar — Thu, 16 Oct 2003 05:22:56 GMT

I suppose that krb5.conf should be in /etc, because there's an /etc/krb5.conf.sample file. I also did a "find / -type f -name krb5.conf", and the only file I found was the one in /etc.

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Bruno Ganino — Thu, 16 Oct 2003 05:26:42 GMT

Alexander,
my question is if exist other krb5.conf in other path. Example in /usr/local/krb5/..(etc. etc.)

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Bruno Ganino — Thu, 16 Oct 2003 05:32:20 GMT

What is vz6tml ?

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Skwar — Thu, 16 Oct 2003 05:34:15 GMT

"vz6tml" is my username. I ran the "cat /etc/krb5.conf" as this user, to show that even normal users have read access to this file.

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Bruno Ganino — Thu, 16 Oct 2003 05:37:35 GMT

Excuse me for repetition, but
I have display problem, not see right in my machine with IE!

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Bruno Ganino — Thu, 16 Oct 2003 05:39:45 GMT

With SuperUser it works ?

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Bruno Ganino — Thu, 16 Oct 2003 05:51:25 GMT

I not see your answers... Verify also permission on Directory.

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Skwar — Thu, 16 Oct 2003 06:56:23 GMT

No, when I run "kinit" as root, I get the same error message. What do you mean with "permissions on directory"? Which directory? ~vz6tml? User vz6tml has write permissions in ~vz6tml. /etc? It is 555 - but what does it matter? /etc/krb5.conf is readable by normal users.

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Bruno Ganino — Thu, 16 Oct 2003 12:26:00 GMT

I have found documentation for your message, i read that it is an error of DCE in Component krb, but nothing notice on Explanation and Action.
Code error 0x14129087 KRB5_CONFIG_CANTOPEN.

The message number itself begins with the hex identifier 0x1. The next four digits are unique for the component generating it. The final three digits are unique for each message number.

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Skwar — Thu, 16 Oct 2003 13:15:52 GMT

Hello!

That sounds interesting - where did you find this documentation? And what can I do to fix it - or is it just plain broken in HP-UX with nobody knowing how to fix it and thus no available Explanation and Action?

Thanks a lot for all the time that you already spent,
Alexander

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Bruno Ganino — Fri, 17 Oct 2003 03:22:52 GMT

I would watch the configurations of PAM, DCE, KRB. Verify the qualifications reported to the username that you use, vz6tml.
For documentation you go on:
http://zivunix.uni-muenster.de/DCEdoc/PDG/PDG04.HTM

Attachments of littles guides (generics) PAM and Kerberos.
HTH

P.S. I am an user of ITRC like you, Not HP-Stuff.
Thank you for points.
Bruno

Re: kinit: Can't open/find configuration file (dce / krb) when parsing name

Bruno Ganino — Fri, 17 Oct 2003 03:25:54 GMT

PAM attachment