Kerberos: kadmin not working properly

Question

I have some trouble in getting my kadmin to work. Everything is fine in kadmin.local, but whenever I use kadmin, it seems it is using the kadm5.acl file, but isn't.

I have in this file: $ cat /var/kerberos/krb5kdc/kadm5.acl

 */[email protected] *

kadmin can connect to the kdc server correctly, and dns lookup and reverse dns is working also.

My krb5.conf is like this: $ cat /var/kerberos/krb5kdc/kdc.conf

[kdcdefaults]
    kdc_ports = 750,88

[realms]
    HADOOP.COM = {
        admin_keytab = FILE: /var/kerberos/krb5kdc/kadm5.keytab
        kadmind_port = 749
        kdc_ports = 750,88
        max_life = 10h 0m 0s
        max_renewable_life = 7d 0h 0m 0s
        database_name = /var/kerberos/krb5kdc/principal
        acl_file = /var/kerberos/krb5kdc/kadm5.acl
        #key_stash_file = /var/kerberos/krb5kdc/.k5.HADOOP.COM
}

and $ cat /etc/krb5.conf

[logging]
    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log

[libdefaults]  
    default_realm = HADOOP.COM
    dns_lookup_realm = false 
    dns_lookup_kdc = false
    ticket_lifetime = 24h
    forwardable = yes

[realms]
    HADOOP.COM = {
    kdc = evl2400469.eu.verio.net:88  
    admin_server = evl2400469.eu.verio.net:749
    default_domain = hadoop.com 
}

[domain_realm]
    .hadoop.com = HADOOP.COM
    hadoop.com = HADOOP.COM

So when I try to perform an operation such as add a principal, or get the list of principals I get : kadmin: listprincs get_principals: Operation requires ``list'' privilege while retrieving list. kadmin: getprivs current privileges: GET ADD MODIFY DELETE

I really don't know where is the problem in my configuration.

I even tried to get a ticket before using kadmin console: $ klist

Ticket cache: FILE:/tmp/krb5cc_0 Default principal:
 kadmin/[email protected]

 Valid starting     Expires            Service principal 05/21/14
 10:13:34  05/21/14 13:13:34  krbtgt/[email protected]
         renew until 05/22/14 10:13:34


 Kerberos 4 ticket cache: /tmp/tkt0 klist: You have no tickets cached

Thanks a lot for your help on that :)

user3138454 user3138454 · Accepted Answer · 2014-07-18T10:06:02

Try editing /var/kerberos/krb5kdc/kadm5.acl with

*/[email protected]   *

The kadmind daemon needs to be restarted in order for changes in the ACL file to become active:

service kadmind restart

Kerberos: kadmin not working properly

1 Answers