Home / server / Questions / 240854
In Process
danorton
Asked: 2011-02-28 07:06:46 +0800 CST

Problem with testsaslauthd and kerberos5 ("saslauthd internal error")

  • 772

The error message “saslauthd internal error” seems like a catch-all for saslauthd, so I’m not sure if it’s a red herring, but here’s the brief description of my problem:

This Kerberos command works fine:

$ echo getprivs | kadmin -p username -w password
Authenticating as principal username with password.
kadmin:  getprivs
current privileges: GET ADD MODIFY DELETE

But this SASL test command fails:

$ testsaslauthd -u username -p password
0: NO "authentication failed"

saslauthd works fine with "-a sasldb", but the above is with "-a kerberos5"

This is the most detail I seem to be able to get from saslauthd:

saslauthd[]: auth_krb5: krb5_get_init_creds_password: -1765328353
saslauthd[]: do_auth : auth failure: [user=username] [service=imap]
                 [realm=] [mech=kerberos5] [reason=saslauthd internal error]

Kerberos seems happy:

krb5kdc[](info): AS_REQ (4 etypes {18 17 16 23}) 127.0.0.1:
                 ISSUE: authtime 1298779891, etypes {rep=18 tkt=18 ses=18},
                 username at REALM for krbtgt/DOMAIN at REALM

I’m running Ubuntu 10.04 (lucid) with the latest updates, namely:

  • Kerberos 5 release 1.8.1
  • saslauthd 2.1.23

Thanks for any clues.

linux security kerberos sasl

2 Answers

  1. auth_krb5: krb5_get_init_creds_password: -1765328353

    This is the only useful bit. You do have the error code, the tricky part is turning that error into a useful message. Some google fu yields

    https://andromeda.rutgers.edu/~sysmail/krb5_error.html (which has since gone offline, but is available on the Internet Archive)

    Decrypt Integrity check failed.

    Anybody can get a tgt from the kdc, but not everybody can decrypt it to make it useful. It really looks like you don't have the right password.

    http://www.cmf.nrl.navy.mil/krb/kerberos-faq.html#badpass (→ Internet Archive)

    Do you have a keytab for saslauthd to validate logins?

    • 1

  2. Try:

    • specifying username@REALM
    • obtaining TGT with kinit: Kerberos should work without supplying passwords anywhere else.
    • 0