Improper format of Kerberos configuration file

Bug #159357 reported by Matt Hollingsworth
8
Affects Status Importance Assigned to Milestone
krb5 (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

kadmind refuses to start for me with ubuntu-server 7.10. Here is the error:

Improper format of Kerberos configuration file while initializing context, aborting

strace shows that it's opening up the right file:

stat64("/etc/krb5kdc/kdc.conf", {st_mode=S_IFREG|0644, st_size=555, ...}) = 0
open("/etc/krb5kdc/kdc.conf", O_RDONLY) = 4
access("/etc/krb5kdc/kdc.conf", W_OK) = 0
fstat64(4, {st_mode=S_IFREG|0644, st_size=555, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f1c000
read(4, "[kdcdefaults]\n\n\tkdc_ports = 750,"..., 4096) = 555
close(4) = 0
munmap(0xb7f1c000, 4096) = 0
write(2, "kadmind: Improper format of Kerb"..., 93kadmind: Improper format of Kerberos configuration file while initializing context, aborting
) = 93
exit_group(1) = ?
Process 13773 detached

And here is my file, which is the default kdc.conf:

[kdcdefaults]

        kdc_ports = 750,88

[realms]
     = {
        database_name = /var/lib/krb5kdc/principal
        admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
        acl_file = /etc/krb5kdc/kadm5.acl
        key_stash_file = /etc/krb5kdc/stash
        kdc_ports = 750,88
        max_life = 10h 0m 0s
        max_renewable_life = 7d 0h 0m 0s
        master_key_type = des3-hmac-sha1
        supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3
        default_principal_flags = +preauth
    }

This also happens on a fresh install of ubuntu-server, if and only if I just change the /etc/hostname file, and set the hostname via the hostname command, i.e.:

$ sudo hostname myserver.otherdomain.local
$ sudo echo myserver.otherdomain.local > /etc/hostname

I don't know what that has to do with anything, but I do know that if I do a fresh install of ubuntu-server 7.10, and just do the following:

$ sudo apt-get install krb5-admin-server

it works fine, but if I do

$ sudo hostname myserver.otherdomain.local
$ sudo echo myserver.otherdomain.local > /etc/hostname
$ sudo apt-get install krb5-admin-server

it fails. I did this in a VMWare virtual machine with a fresh install, with these commands being the only thing I ever ran on it, and it failed.

This is reproducible on multiple computers as well.

It is also worth noting that the following is output during the installation of krb5-config:

dnsdomainname: Unknown host

which I assume is the best indicator of what the problem actually is

Any help would be greatly appreciated! Thanks ahead of time.

-Matt

Revision history for this message
Matt Hollingsworth (mr-hworth) wrote :

Of course, it's not until exactly 2 minutes after I submit the bug report that I figure out the fix. I maintain that this is still a bug, because the installation should have failed, but at least I have a workaround now.

After noticing that dnsdomainname complained during the install, I decided to wager that it was the main contributing factor, so I started fiddling around and found that it was, indeed the problem. One just needs to make sure that dnsdomainname returns a proper result, and that is done by fiddling with either your dns or the /etc/hosts file... the latter is what I did. After dnsdomainname returned a proper result, I did

$ sudo aptitude purge krb5-admin-server
$ sudo apt-get install krb5-admin-server

and all was well. Perhaps there should be a fallback for when dnsdomainname doesn't return properly during installation? Either way, installation shouldn't fail that critically when there is something amiss with the dns, no?

-Matt

Revision history for this message
Neal McBurnett (nealmcb) wrote :

Thanks for writing this up!

I think the package should notice this sort of problem with dnsdomainname and ask for more help or fail.
Otherwise as you note the config file ends up with the invalid entry

 [realms]
     = {
 ...

instead of

 [realms]
    EXAMPLE.COM = {
 ...

or whatever.

Changed in krb5:
status: New → Confirmed
Revision history for this message
Russ Allbery (rra-debian) wrote :

This is fixed in the 1.6.dfsg.3-1 Debian release:

  * If krb5-config/default_realm isn't set, use EXAMPLE.COM as the realm
    so that the kdc.conf will at least be syntactically valid (but will
    still require editing). (Closes: #474741)

Mathias Gug (mathiaz)
Changed in krb5:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.