Re: [SOLVED] login into workstation impossible

Hi,

Frans Spiesschaert schreef op vr 20-12-2024 om 00:05 [+0100]:
> Hi,
> 
> Some more details below (sorry for the fuss)
> 
> Frans Spiesschaert schreef op do 19-12-2024 om 23:27 [+0100]:
> > Hi,
> > 
> > Some additional information below
> > 
> > Frans Spiesschaert schreef op do 19-12-2024 om 17:39 [+0100]:
> > > Hi,
> > > 
> > > After I changed a diskless workstation into a workstation, users
> > > are
> > > no
> > > longer able to log into it.
> > > I installed the system via the servers PXE menu.
> > > I added it to Gosa with sitesummary2ldapdhcp.
> > > I made the system a member of the NIS Netgroups all-hosts,
> > > fsautoresize-hosts, printer-hosts, workstation-hosts.
> > > I rebooted the system, logged into it as root and did run
> > > /usr/share/debian-edu-config/tools/copy-host-keytab.
> > > 
> > > So far so good, but after I rebooted the system again, still only
> > > root
> > > is able to log into it.
> > > 
> > > /var/log/auth.log reads as follows:
> > > 
> > > 2024-12-19T16:58:06.101160+01:00 Joy-it lightdm:
> > > pam_krb5(lightdm:auth): (user lieve) credential verification
> > > failed:
> > > Cannot find key for host/Joy-it.intern@INTERN kvno 3 in keytab
> > 
> > This entry shows that lightdm is looking for a key with a kvno
> > value
> > of
> > 3 in the keytab file, but this value is set to 2 in the host
> > keytab:
> > 
> > ktutil:  read_kt /etc/krb5.keytab
> > ktutil:  list
> > slot KVNO Principal
> > ---- ---- ---------------------------------------------------------
> > --
> > --
> >    1    2                host/Joy-it.intern@INTERN
> >    2    2                host/Joy-it.intern@INTERN
> >    3    2                 nfs/Joy-it.intern@INTERN
> >    4    2                 nfs/Joy-it.intern@INTERN
> > 
> > I have no clue how to lower the kvno value in the lightdm request
> > or
> > how to increase that value in /etc/krb5.keytab.
> 
> Both on tjener and on Joy-it kvno is reporting a value of 3 for
> host/Joy-it.intern (in contrast to the value in the keytab file):
> 
> frans@tjener:~$ sudo kvno host/Joy-it.intern
> host/Joy-it.intern@INTERN: kvno = 3
> 
> root@Joy-it:~# kvno host/Joy-it.intern
> host/Joy-it.intern@INTERN: kvno = 3
> 
> 
> 
On tjener as root I just had to reset the kvno values with
kadmin.local  -q "modify_principal -kvno 2 host/Joy-it.intern@INTERN"
kadmin.local  -q "modify_principal -kvno 2 nfs/Joy-it.intern@INTERN"

After a reboot of the Joy-it system, normal users were able to log into
it.

So problem solved, though I can't tell what caused it to appear.
And from now on I am a happy user of DebianEdu 12.

Cheers,
Frans Spiesschaert

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEESWHbdE9wBkqZp7Tz9W2dnhFW0dQFAmdl7t0ACgkQ9W2dnhFW
0dSp4xAAtPNJvuIzLyqJnllpDs8KwA574slZmJP3q4AebrJaMxVmsd10PKG7HzNE
m59qOokDRyZtpNHfpz327Sh8qd5WLkpIRWHSAAz4mhzl+9CLf/n3hBqb88N1z30a
J9YRkjVpy+t9xzwvoLhCDcHiF7GfL/emDrzEE1S6AMf6aQNHPg4Q3al+mJ6rx3V/
cAY7TWTHuhiiTijohRqGKzBl7Vkbfjl0qkafFtzWjrn2dnBYrs5rXDexZQokQORd
0pTevWMuoPLmZYDo1CB1eD1pyeuZYfWdi+Yua7IKiGKcE7CxBsGko7QgkHkaLziq
XYfeInFrIfIsG4NH2Pcj3MPZnF3jk7jwp7hDcqQ+PIIOtlqvX08zQ7wabOM3N3sD
NPBEdsk1Qa4VzJv7ywcgrp6rh6nhNhJg/VH5Tfcmc2WOC3u2NQR5q/lwCUmmPkKf
f3n+31jDxuM1ZQY1kmCOQ2DBuYswtHtfnvfi7qdyQN4otBqoChrWecy6OSWXDZ39
D543dQAlVlU3t8t76zsKGkJHoMP8BU9S/H2kbJQvSyiLOunV28g5cen8XpVs3gqx
qV2mPjvfSSkBn8gg2KrPu6Oz0KS7d/38XQAjasDLrFC599aBW0OksyLSDZBdt4iP
oXA2qTO4iXjm4k5IBWagEGUF7SStAl5HIPFffKrk3NHgSZVBYfY=
=zgkS
-----END PGP SIGNATURE-----