Regresar
-
Título
Unable to configure Kerberos authentication for WEC - No key table entry found matching -
Descripción
After configuring the Windows Event Collector (WEC) to use Kerberos authentication the following error is reported in /opt/syslog-ng/var/wec.log
++++++++++++++++++
2021-09-08T10:26:54.067+0100 ERROR KRB-Subscription gssapi error, error list:
{idx:0}Acquiring credentials
{idx:1}No key table entry found matching http/ubuntu16@
{idx:2}major:851968,minor:39756033
{idx:3}Unspecified GSS failure. Minor code may provide more information
++++++++++++++++++ -
Causa
This can be caused when the keytab has not been created properly.
-
Resolución
It is important in this ktpass example that DOMAIN_NETBIOS_NAME is used. This can be found by right-clicking properties on the root of the domain in ADUC. The DOMAIN_NETBIOS_NAME is in the General tab under Domain name (pre-Windows 2000).
ktpass.exe -out C:\kerberos_shared\linux_service_account.keytab -princ http/<linux_hostname>@<kerberos_realm> -mapUser <DOMAIN_NETBIOS_NAME_in_UPPER_CASE>\<domain_user> -pType KRB5_NT_PRINCIPAL -crypto AES256-SHA1 -pass '<domain-user-password-as-string>'
The setspn.exe step must also use the same DOMAIN_NETBIOS_NAME as above:
setspn.exe -L <DOMAIN_NETBIOS_NAME_in_UPPER_CASE>\<domain_username>
Please refer to the Syslog-ng Windows Event Collector Administration Guide for details.