Re: kpasswd (changing password from behind NAT)

> I send you a patch that tried to solve this some time ago, you had a chance to test it ?

I am currently testing your patch and I am seeing another problem with
kpasswd/kpasswdd and a standard KDC setup out of the box:

On the client:

$ kpasswd
[email protected]'s Password: foo12345
New password: foo123456
Verifying - New password: foo123456
kpasswd: krb5_set_password_using_ccache: Unable to reach any changepw server  in realm TEST.PDC.KTH.SE
(FAIL)
$ kinit 
[email protected]'s Password: foo123456
$ 
(SUCCESS)

In spite of the error message, the password was actually changed on the KDC. Not good.

From the log on the server:


2011-12-08T17:50:57 Changing password for [email protected]
2011-12-08T17:50:57 Changing password for [email protected]
2011-12-08T17:50:57 kadm5_s_chpass_principal_cond: Password reuse forbidden
2011-12-08T17:50:57 Changing password for [email protected]
2011-12-08T17:50:57 kadm5_s_chpass_principal_cond: Password reuse forbidden
2011-12-08T17:50:57 Changing password for [email protected]
2011-12-08T17:50:57 kadm5_s_chpass_principal_cond: Password reuse forbidden
2011-12-08T17:50:57 Changing password for [email protected]
2011-12-08T17:50:57 kadm5_s_chpass_principal_cond: Password reuse forbidden
2011-12-08T17:50:57 Changing password for [email protected]
2011-12-08T17:50:57 kadm5_s_chpass_principal_cond: Password reuse forbidden
2011-12-08T17:50:57 Changing password for [email protected]
2011-12-08T17:50:57 kadm5_s_chpass_principal_cond: Password reuse forbidden
2011-12-08T17:50:57 Changing password for [email protected]
2011-12-08T17:50:57 kadm5_s_chpass_principal_cond: Password reuse forbidden
2011-12-08T17:50:57 Changing password for [email protected]
2011-12-08T17:50:57 kadm5_s_chpass_principal_cond: Password reuse forbidden
2011-12-08T17:50:57 Changing password for [email protected]
2011-12-08T17:50:57 kadm5_s_chpass_principal_cond: Password reuse forbidden

I guess that the client library is sending a bunch of password change
requests (several a second?) to the server faster than it can respond
and the first one succeeds and the following ones are denied because
the request is for a password change of the exactly same password
again. Then the client reports the failure instead of the success.

Client is heimdal 1.3.3.
Server is heimdal 1.5.1.

So the kadm5_s_chpass_principal_cond is not usable if you want your users
to trust the error messages they get, isn't it?

Password changing test from behind NAT will be resumed when I get my
NAT setup done, normally I don't use NAT :-)

Harald.