[OpenAFS] 回复：[SPAM] Re: [OpenAFS] About the upgrading from kaserver toKerberos 5

[huangql]

Hi Jeffrey,


Thanks for your prompt and constructive reply.


If the afs2k5db tool was compiledagainst OpenAFS 1.2 and MIT Kerberos 1.2, does it work forOpenafs-1.4.14-1 versionunder 64bit ?
Or is there other method to migrate the users to kdc 5?


Let me thank you again.


Best Regards,
Qiulan




原始邮件
发件人:Jeffrey ***@auristor.com
收件人:***@ihep.ac.cn; openafs-infoopenafs-***@openafs.org
发送时闎:2018幎5月15日(呚二) 21:00
䞻题:[SPAM] Re: [OpenAFS] About the upgrading from kaserver toKerberos 5


The original poster's text has been modified to replace "Kerberos 4" with "kaserver". "kaserver" is not the same as MIT Kerberos 4 and it is very important to distinguish between the two. On 5/15/2018 4:52 AM, huangql wrote: Hi all, We are working on the upgrading of Openafs kaserver to KDC 5. We checked some documents to know we have to use afs2k5db tool to convert users in kaserver to KDC 5. But it's really a pain to compile it with Openafs-1.4.14-1 andkrb5-server-1.10.3-65.el6.x86-64 due to the incompatibility of the higher version of krb5 and AFS. I tried to modify the afs2k5db source code to eliminate the compile error to generate the tool afs2k5db. However, we failed to convert users with the following error. [***@afs01src]#./afs2k5db/usr/afs/db/kaserver.DB0anafsuser.out ReadofKAdatabaseheaderfailed:onlygot37888of65632bytes Could you help to figure out the issue? And is there other quick way to migrate the users in kaserver to KAS The afs-krb5 source code worked by compiling against private functions within both OpenAFS 1.2.x and MIT Kerberos 1.2.x. The kaserver database format has not changed since that time and although the MIT Kerberos 1.2.x database format has changed it is still possible to dump the MIT Kerberos database from 1.2.x and import it into current data MIT. Current versions of Kerberos have removed all support for Kerberos v4 and have significantly reduced if not removed entirely support for the DES encryption types. It will be easier to build a working version of afs2k5db by building the tool against OpenAFS 1.2 and MIT Kerberos 1.2. Building each of those might require using an old 32-bit version of Linux and the gcc toolchain. Current versions of gcc and clang are unlikely to compile old source code trees and there is the possibility that there are 64-bit compatibility issues with those old releases as well. Good luck. Jeffrey Altman

[Jeffrey Altman]

On 5/15/2018 11:24 AM, huangql wrote:
> Hi Jeffrey,
>
>
> Thanks for your prompt and constructive reply.
>
>
> If the afs2k5db tool was compiled against OpenAFS 1.2 and MIT Kerberos
> 1.2, does it work for Openafs-1.4.14-1 version under 64bit ?

As I indicated, the kaserver database file format has not changed.
Therefore, it should not matter.

> Or is there other method to migrate the users to kdc 5?

Well, IHEP could just bring up a new Kerberos v5 realm and create all
necessary client and server principals from scratch.

At this point that might not be such a bad idea. The kaserver (being
Kerberos v4 based) only supports DES-CBC-CRC 56-bit keys. Those keys
can be brute forced in under 20 hours. The krbtgt and afs keys are
particularly vulnerable. Theft of them permits any identity to be
forged. Copying these keys into the new Kerberos v5 realm is pointless
as they must be replaced immediately.

The client configurations will have to be updated in any case to deploy
Kerberos v5 libraries and configuration files. My recommendation is to
start from scratch with Kerberos v5 and configure the AFS cell to accept
both kaserver and Kerberos v5 for authentication. See the OpenAFS
krb.conf man page.

Again, good luck.

Jeffrey Altman

[HUANG Qiulan]

[huangql]

Dear all,

We have already create all the principals from scratch. As we want to make afs accounts transfer to KDC authentication smoothly without asking them to change password forcely.

From the following information, we know kaserver and KDC can work together for one AFS cell. Do you know how to configure the AFS cell to support kaserver and KDC 5 at the same time?

Thank you so much!

> If the KDC is up and running and the old kaserver are still up running,
> and the windows clients has only the "old" kaserver in their CellServDB
> and the have no kerberos on their system, can the windows clients still
> logon AFS and get tokens via kaserv?
> I mean, with now 2 entrys in the keyfile, can the servers select the
> right one out for Windows AFS clients without kerberos?
>
>
>> As far as I remember from my tests the answer is yes.
Regards,
Qiulan


huangql
====================================================================
Computing center,the Institute of High Energy Physics, CAS, China
Qiulan Huang Tel: [phone]
P.O. Box 918-7 Fax: [phone]
Beijing 100049 P.R. China Email: ***@ihep.ac.cn
===================================================================