Kerberos change password is not working (from kadmin.local)

saranvisa — Tue, 13 Dec 2016 21:46:03 GMT

One of our user lost her kerberos password and I am trying to reset the password using below steps

kadmin.local:
kadmin.local: change_password user@REALM.COM
Enter password for principal "user@REALM.COM":
Re-enter password for principal "user@REALM.COM":
Password for "user@REALM.COM" changed.
kadmin.local:q

Trying to login with new password after that but getting the below error
kinit user@REALM.COM
Password for user@REALM.COM:
kinit: Password incorrect while getting initial credentials

So I drop the user principal using delprinc and recreated with new password but still getting the same error

Then I've created a keytab and tried to access user using keytab, it is working
kadmin.local:xst -norandkey -k /tmp/user.keytab user@REALM.COM

$kinit user@REALM.COM -k -t /tmp/user.keytab

But the below command still shows the error.
$kinit user@REALM.COM
kinit: Password incorrect while getting initial credentials

Can someone help me on this?

Thanks

Kumar

Re: Kerberos change password is not working (from kadmin.local)

saranvisa — Wed, 14 Dec 2016 22:25:48 GMT

Issue fixed!!

My bad! From our list of nodes, i know either node01 or node02 has krb5-server. So I randomly pick the node01 and applied kadmin.local command, it worked, so started applying change password and endup with failure

(Note: kadmin.local command is working in both node01 and node02).

Latter realized node02 is our krb5-server from the below configuration. so login to node02 and delete & recreated the principal. it is working fine now from all our nodes...

cat /etc/krb5.conf
[realms]
*** = {
kdc = node01:88
kdc = node02:88
admin_server = node02:749
default_domain = ***
max_renewable_life = 7d
max_life = 7d
}

Thanks

Kumar

question Re: Kerberos change password is not working (from kadmin.local) in Archives of Support Questions (Read Only)

Kerberos change password is not working (from kadmin.local)

Re: Kerberos change password is not working (from kadmin.local)