RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 749142 - net ads join generated host keytab contains dysfunctional principals
Summary: net ads join generated host keytab contains dysfunctional principals
Keywords:
Status: CLOSED DUPLICATE of bug 748831
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: samba
Version: 6.2
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Guenther Deschner
QA Contact: qe-baseos-daemons
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-10-26 10:06 UTC by Marko Myllynen
Modified: 2011-11-24 09:22 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-11-24 09:22:46 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Marko Myllynen 2011-10-26 10:06:57 UTC 
Description of problem:
With "kerberos method = secrets and keytab" in smb.conf "net ads join" generates /etc/krb5.keytab for host client-123.ad.example.com containing:

# klist -ke /etc/krb5.keytab
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   2 host/client-123.ad.example.com.COM (des-cbc-crc) 
   2 host/client-123.ad.example.com.COM (des-cbc-md5) 
   2 host/client-123.ad.example.com.COM (arcfour-hmac) 
   2 host/CLIENT-123.COM (des-cbc-crc) 
   2 host/CLIENT-123.COM (des-cbc-md5) 
   2 host/CLIENT-123.COM (arcfour-hmac) 
   2 CLIENT-123$@AD.EXAMPLE.COM (des-cbc-crc) 
   2 CLIENT-123$@AD.EXAMPLE.COM (des-cbc-md5) 
   2 CLIENT-123$@AD.EXAMPLE.COM (arcfour-hmac) 

However, of these only the third principal can be used (with properly configured krb5.conf, see bug 748407 and bug 748528):

# kinit -k -t /etc/krb5.keytab 'host/client-123.ad.example.com.COM'
kinit: Client not found in Kerberos database while getting initial credentials
# kinit -k -t /etc/krb5.keytab 'host/CLIENT-123.COM'
kinit: Client not found in Kerberos database while getting initial credentials
# kinit -k -t /etc/krb5.keytab 'CLIENT-123$@AD.EXAMPLE.COM'
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: CLIENT-123$@AD.EXAMPLE.COM

Valid starting     Expires            Service principal
10/26/11 12:46:43  10/26/11 22:46:29  krbtgt/AD.EXAMPLE.COM.COM
	renew until 11/02/11 11:46:43

This causes issues with applications expecting the standard host principal (like sshd and mount.cifs, see bug 748402 and bug 748757).

If creating a new machine account on AD and generating a keytab for it with:

> ktpass /out krb5.keytab /rndpass /crypto all /ptype KRB5_NT_SRV_HST -desonly /princ host/client-123.ad.example.com.COM /mapuser AD\Client-123$

then after transferring the keytab file to client-123.ad.example.com as /etc/krb5.keytab, "kinit -k -t /etc/krb5.keytab 'host/client-123.ad.example.com.COM'" works as expected.

Version-Release number of selected component (if applicable):
RHEL 6.2
Comment 2 Ondrej Valousek 2011-10-26 13:43:59 UTC 
I believe that the "Client not found in Kerberos database" message means that there is no UPN defined in AD by that name.
Locate the "client-123" computer object in AD and set its "userPrincipalName" attribute to "host/CLIENT-123.COM".
You can go back to your linux box and verify that "kinit -k host/CLIENT-123" works now.

Note that I can also confirm that the workaround you mentioned works for me, too.
Comment 3 Marko Myllynen 2011-10-27 12:01:48 UTC 
(In reply to comment #2)
> I believe that the "Client not found in Kerberos database" message means that
> there is no UPN defined in AD by that name.

Correct, indeed a better test is to use kvno:

# kvno 'host/client-123.ad.example.com.COM'
kvno: Server not found in Kerberos database while getting credentials for host/client-123.ad.example.com.COM
# kvno 'host/CLIENT-123.COM'
host/CLIENT-123.COM: kvno = 2
# kvno 'CLIENT-123$@AD.EXAMPLE.COM'
CLIENT-123$@AD.EXAMPLE.COM: kvno = 2
Comment 4 RHEL Program Management 2011-10-31 05:47:14 UTC 
Since RHEL 6.2 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.
Comment 5 Marko Myllynen 2011-11-24 09:22:46 UTC 
This is caused by the issues related to bug 748831 - when the join completes normally all the principals are as expected.

Closing this one, further discussion can go to bug 748831. Thanks.

*** This bug has been marked as a duplicate of bug 748831 ***
Note You need to log in before you can comment on or make changes to this bug.