Re: Compiling rdesktop 1.8 on Solaris

On 8/25/2013 5:25 PM, Roland Soderstrom wrote:
> Hi Henrik,
>
> I'm sort of out on thin ice here..
>
> I managed to convince the Windows guy to fix so that I could get Kerberos tickets.
> He didn't really know how this works, so it is sort of a trial and error.
> I've run ktpass and got a krb5.keytab which I copied to /etc
> root@sunws1: # /usr/local/bin/klist -e -k
> Keytab name: WRFILE:/etc/krb5.keytab
> KVNO Principal

This may not be your problem, but the principal names below don't look correct.
They should have a forward slash,
and normally Kerberos host principals have lower case host/ not uppercase,
and the hoist name id the FQDN of the host. Realm names are upper case.

So in your case, a normal Kerberos host principal would look more like:
host/[email protected]

(Kerberos is case sensitive, AD is case insensitive, which can cause confusion.)

Samba or msktutil can be used in place of ktpass for registering hosts too.


(Also DES should not be used any more...)
> ---- --------------------------------------------------------------------------
>     6 HOST\\[email protected] (DES cbc mode with CRC-32)
>     6 HOST\\[email protected] (DES cbc mode with RSA-MD5)
>     6 HOST\\[email protected] (ArcFour with HMAC/md5)
>     6 HOST\\[email protected] (AES-256 CTS mode with 96-bit SHA-1 HMAC)
>     6 HOST\\[email protected] (AES-128 CTS mode with 96-bit SHA-1 HMAC)
> root@sunws1: # ls -la /etc/krb5.keytab
> -rw-r--r--   1 root     root         337 Aug 23 14:36 /etc/krb5.keytab
>
> I managed to get a Kerberos ticket
> sunws1 % /usr/local/bin/kinit [email protected]
> Password for [email protected]:
> sunws1 % /usr/local/bin/klist
> Ticket cache: FILE:/tmp/krb5cc_6010
> Default principal: [email protected]
>
> Valid starting     Expires            Service principal
> 08/26/13 08:07:09  08/27/13 08:07:09  krbtgt/[email protected]
> sunws1 % ./rdesktop css0008
> Connection established using CredSSP.
> sunws1 %
> But nothing happens, no desktop appears? Connecting to windows 2003 works fine but not windows 2012
>
> Same with debug on.
> sunws1 % ./rdesktop-with-debug css0008
> Out TSRequest 1354 bytes
> data here...
> In TSRequest token 178 bytes
> data here...
> Out TSRequest 347 bytes
> data here...
> In TSRequest token 347 bytes
> data here...
> Out TSCredentials 39 bytes
> data here...
> Out TSRequest 110 bytes
> data here...
> Connection established using CredSSP.
> sunws1 %
>
> Any ideas?

A wireshark trace might show something too, especially if
acquiring additional Kerberos tickets is involved.

>
> - Roland
>
> -----Original Message-----
> From: Henrik Andersson [mailto:[email protected]]
> Sent: Wednesday, 21 August 2013 11:12 PM
> To: Roland Soderstrom
> Cc: 'Henrik Andersson'; [email protected]
> Subject: RE: [rdesktop-users] Compiling rdesktop 1.8 on Solaris
>
>
>> I must say I don't know what "initialize a kerberos ticket for the AD
>> realm" means.
>>
>
> You need to setup the kerberos klient so you can get auth and get tickets from the Windows Domain kerberos realm.
>
>> I asked the windows guy, (I'm not a windows guy) and he said that the
>> server is installed with whatever Is the default, no added security or
>> encryption, he believed but was not sure Kerberos was installed and
>> enabled by default.
>>
>> I might need to do something with Kerberos on Solaris but on Linux?
>> Remmina is connecting without any problem.
>>
>
> Remmina do use freerdp which supports CredSSP+NTLM, rdesktop does only support CredSSP+Kerberos so you need to configure your solaris host to work with the Window Kerberos domain. See /etc/krb5.conf, when everything is in place you should be able to retreive a ticket by:
>
> # kinit [email protected]
> Password: ****
>
> You can verify that you have got a ticket using the klist command.
>
>> I get the same rdesktop error in Linux Mint 15 mate.
>>
>
> See above answer, you need to configure the kerberos client and initialize a ticket.
>
>
>
>
> ------------------------------------------------------------------------------
> Introducing Performance Central, a new site from SourceForge and
> AppDynamics. Performance Central is your source for news, insights,
> analysis and resources for efficient Application Performance Management.
> Visit us today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
> _______________________________________________
> rdesktop-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/rdesktop-users
>

-- 

  Douglas E. Engert  <[email protected]>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444

------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and 
AppDynamics. Performance Central is your source for news, insights, 
analysis and resources for efficient Application Performance Management. 
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk