Home / server / Questions / 979809
In Process
Tolsadus
Asked: 2019-08-20 03:15:57 +0800 CST

Kerberos slave doesn't update his Master KDC DB fields

  • 772

Since we've put in place a Master/Slave for our Kerberos, we've noticed that our fields doesn't get updated (Information wise)

Last password change: Fri Aug 02 10:18:08 GMT 2019
Last modified: Fri Aug 02 10:18:08 GMT 2019 (root/[email protected])
Last successful authentication: Sat Aug 03 12:35:41 GMT 2019
Last failed authentication: Wed Jul 10 12:59:28 GMT 2019

This only happened when our clients are configured as follow

[libdefaults]
    default_realm = EXAMPLE.COM
    forwardable = true
    proxiable = true
    dns_lookup_kdc = no
    dns_lookup_realm = no
    allow_weak_crypto = true

[realms]
    EXAMPLE.COM = {
        kdc = kerberos-slave.EXAMPLE.COM
        admin_server = kerberos.EXAMPLE.COM
        kpasswd_server = kerberos.EXAMPLE.COM
        master_kdc = kerberos.EXAMPLE.COM
        default_domain = EXAMPLE.COM
        default_lifetime = 7d
        ticket_lifetime = 7d
    }

[domain_realm]
    .EXAMPLE.COM = EXAMPLE.COM
     EXAMPLE.COM = EXAMPLE.COM

If our clients directly use the master kerberos, our fields do get updated nicely. Would there be a way to update the fields on the Master, while querying directly from the slave?

Directly using kdc = master kerberos does update the KDC DB fields.

[libdefaults]
    default_realm = EXAMPLE.COM
    forwardable = true
    proxiable = true
    dns_lookup_kdc = no
    dns_lookup_realm = no
    allow_weak_crypto = true

[realms]
    EXAMPLE.COM = {
        kdc = kerberos.EXAMPLE.COM
        admin_server = kerberos.EXAMPLE.COM
        kpasswd_server = kerberos.EXAMPLE.COM
        master_kdc = kerberos.EXAMPLE.COM
        default_domain = EXAMPLE.COM
        default_lifetime = 7d
        ticket_lifetime = 7d
    }

[domain_realm]
    .EXAMPLE.COM = EXAMPLE.COM
     EXAMPLE.COM = EXAMPLE.COM
kerberos

0 Answers