-
タイトル
Why does Authentication Services allow mismatched knvo tickets? -
説明
After upgrading to Authentication Service 4.2 the following error is seen:
Failed to find <SPN>(kvno x) in keytab FILE
Where SPN is your Service Principal name and x is the kvno number that is in the ticket but not in the service account Active Directory.This same keytab works in 4.1.
-
原因
The behavior in 4.1 that allowed Authentication Services to authenticate with mismatched kvno’s was added many years ago due to kvno issues between Windows 2000 and 2003.
Since neither are supported any more, and this behavior would not be keeping in line with Microsoft security behavior this was not included during development of 4.2. -
対策
The kvno's become mismatched by resetting the keytab with the same password and then not replacing all of the existing keytabs that share the same service account with the updated one.
This can be seen by running the following where hashtest.keytab is your keytab:vastool ktutil -k /tmp/hashtest.keytab list --keys
The same hash will have a different kvno number and therefore the password was re-used.
It is recommended when using kerberos and keytabs to keep all keytabs in sync with any password changes that occur.