From: sjogren@TGV.COM (Sam Sjogren)
Newsgroups: vmsnet.networks.tcp-ip.multinet
Subject: Re: MultiNet Auth Services Questions
Date: Mon, 28 Dec 92 16:45:29 PST
Organization: Info-Multinet<==>Vmsnet.Networks.Tcp-Ip.Multinet Gateway
X-Gateway-Source-Info: Mailing List

>  1. How does one specify what principals (e.g., jnm.admin@CTD.ORNL.GOV) are
>     allowed to use kadmin (and their corresponding access privileges)? This is
>     what we see when running kadmin from a Unix workstation:

>	  % kadmin
>	  Welcome to the Kerberos Administration Program, version 2
>	  Type "help" if you need it.
>	  admin:  get jnm
>	  Admin password:
>	  kadm error: Insufficient access to perform requested operation

My apologies for this not being documented.  Here's the files:

#define DEFAULT_ACL_DIR "multinet:"
#define ADD_ACL_FILE	"kerberos_admin_acl.add"
#define GET_ACL_FILE	"kerberos_admin_acl.get"
#define MOD_ACL_FILE	"kerberos_admin_acl.mod"


>  2. Does Multinet Kerberos support encrypted rlogin/rcp/rsh (i.e., the -x
>     option)? When we try this from a Unix workstation, we get:

>	  % rlogin kdevel -x
>	  kdevel.CTD.ORNL.GOV: Connection refused
>	  rlogin: Kerberos rcmd failed: rcmd protocol failure.

We don't yet support encryption.  Sometime in the future there'll be an
optional distribution (available in the US and Canada, only) which will
support encryption.  The Kerberos stuff bundled into the general distribution
will, of course, not provide encryption, unless the US department of state
stops classifying DES data encryption as a munition.  We'll continue including
the authentication-only support in the general product.  We'll announce the
availability of the encryption support on Info-MultiNet when it becomes
available.  My guesstimate at the moment is mid-93, but that's not an
official commitment.

>  3. What would be causing the following error:

>	  $ multinet kerberos init
>	  This node is: KDEVEL.CTD.ORNL.GOV
>	  Kerberos Initialization for "jnm"

>	  KERBEROS INIT: Can't send request (send_to_kdc)

That error means that the code either couldn't figure out who the KDC
for the desired realm is, or it couldn't reach it.  Make sure that
MULTINET:KERBEROS.CONFIGURATION contains an entry for the local realm,
CTD.ORNL.GOV (or whatever you specify to the be local realm on the first
line of that file).  You should be able to TELNET, PING, etc. to the
indicated machine by name.  Example:

    $ ty MULTINET:KERBEROS.CONFIGURATION
    FOO.COM
    FOO.COM kerberos.foo.com admin server
    $ mu ping kerberos.foo.com
    PING KERBEROS.FOO.COM (18.72.0.144): 56 data bytes
    64 bytes from 18.72.0.144: icmp_seq=0 time=100 ms
    64 bytes from 18.72.0.144: icmp_seq=1 time=90 ms
    64 bytes from 18.72.0.144: icmp_seq=2 time=90 ms
    64 bytes from 18.72.0.144: icmp_seq=3 time=90 ms
    ...


>  4. Where is the Multinet Kerberos "telnet" documented? What implementation
>     is it compatible with?

The MultiNet Authentication Services Administrators' Guide, in the section
on documentation for end users.  It says that TELNET takes the same
authentication switches as the R-services.  So, you can do the following:

    $ TELNET/AUTH/USER=BOB DOBBS.FOO.COM

Our Kerberized TELNET is conformant with the _draft_ RFC for the TELNET
Authentication Option.	It's compatible with any other implementation that
conforms to that spec.	Specifically, I know it to work with the reference
implementation that Dave Borman put up for FTP at Berkeley, as well as the
implementation that was done at MIT and lives on their Athena systems, FTP
Software's DOS version, and implementations for various platforms by OCSG.

>	  Thanks in advance,
>								  Mike

Cheers,
-Sam