Ryfujk

The command

sudo kprop -r MY.DOMAIN -f /var/lib/krb5kdc/slave_datatrans slave_kdc.my.domain

returns

kprop: Key table entry not found while getting initial credentials

This is a new installation on two linux debian servers. The master_kdc seems to work, but I cannot get the database to propagate. I manually copied the database dump and loaded it onto the slave_kdc, but the propagation still does not work.

/etc/krb5.conf

[libdefaults]

    default_realm = MY.DOMAIN

# The following krb5.conf variables are only for MIT Kerberos.

    kdc_timesync = 1

    ccache_type = 4

    forwardable = true

    proxiable = true



[realms]

    MY.DOMAIN = {

            kdc = master_kdc.my.domain

            kdc = slave_kdc.my.domain

            admin_server = master_kdc.my.domain

    }

[domain_realm]

    .my.domain = MY.DOMAIN

    my.domain = MY.DOMAIN

/etc/krb5kdc/kdc.conf

[kdcdefaults]

    kdc_ports = 750,88



[realms]

    MY.DOMAIN = {

        database_name = /var/lib/krb5kdc/principal

        admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab

        acl_file = /etc/krb5kdc/kadm5.acl

        key_stash_file = /etc/krb5kdc/stash

        kdc_ports = 750,88

        max_life = 10h 0m 0s

        max_renewable_life = 7d 0h 0m 0s

        master_key_type = des3-hmac-sha1

        #supported_enctypes = aes256-cts:normal aes128-cts:normal

        default_principal_flags = +preauth

    }



[logging]

    kdc = FILE:/var/log/krb5kdc.log

    admin_server = FILE:/var/log/kadmin.log

    default = FILE:/var/log/krb5lib.log

/etc/krb6kdc/kadm5/acl

john/admin@MY.DOMAIN        *

/etc/krb5kdc/kpropd.acl

host/master_kdc.my.domain@MY.DOMAIN

host/slave_kdc.my.domain@MY.DOMAIN

I installed xinetd and created the following file and enabled and started the xinetd service.
/etc/xinetd.d/krb5_prop

service krb5_prop

{

    disable = no

    socket_type = stream

    protocol = tcp

    wait = no

    user = root

    server = /usr/sbin/kpropd

}

result of sudo cat /etc/services | grep krb5

kerberos    88/tcp      kerberos5 krb5 kerberos-sec # Kerberos v5

kerberos    88/udp      kerberos5 krb5 kerberos-sec # Kerberos v5

krb5_prop   754/tcp     krb-prop krb_prop hprop # Kerberos slave propagation

I generated the /etc/krb5.keytab file on master_kdc and on slave_kdc after copying over the database.

kadmin: ktadd host/slave_kdc.my.domain

Nothing is being logged (I don't know why).

/etc/bind/zones/db.my.domain

$TTL    604800

@       IN      SOA     master_kdc.my.domain. john.my.domain. (

                          5         ; Serial

                     604800         ; Refresh

                      86400         ; Retry

                    2419200         ; Expire

                     604800 )       ; Negative Cache TTL

;

; Name servers - NS records

@       IN      NS      master_kdc.my.domain.

@       IN      NS      slave_kdc.my.domain.



; Name servers - A records

master_kdc  IN      A      AAA.BBB.CCC.DD1

slave_kdc  IN      A       AAA.BBB.CCC.DD2



; Kerberos services

_kerberos._udp.MY.DOMAIN.   IN      SRV     1       0       88      master_kdc.my.domain.

_kerberos._tcp.MY.DOMAIN.   IN      SRV     1       0       88      master_kdc.my.domain.

_kerberos._udp.MY.DOMAIN.   IN      SRV     10      0       88      slave_kdc.my.domain.

_kerberos._tcp.MY.DOMAIN.   IN      SRV     10      0       88      slave_kdc.my.domain.

_kerberos-adm._tcp.MY.DOMAIN.       IN      SRV     1       0       749     master_kdc.my.domain.

_kpasswd._udp.MY.DOMAIN.   IN      SRV     1       0       464      master_kdc.my.domain.

/etc/bind/zones/db.AAA

$TTL    604800

@       IN      SOA     master_kdc.my.domain.   john.my.domain. (

                                    5       ; Serial

                               604800       ; Refresh

                                86400       ; Retry

                              2419200       ; Expire

                               604800 )     ; Negative Cache TTL

;

; Name servers - NS records

@       IN      NS      master_kdc.my.domain.

@       IN      NS      slave_kdc.my.domain.

master_kdc  IN      A       AAA.BBB.CCC.DD1

slave_kdc   IN      A       AAA.BBB.CCC.DD2



; Name servers - PTR records

DD1      IN      PTR     master_kdc.my.domain.

DD2      IN      PTR     slave_kdc.my.domain.

I spent few hours to resolve this exact same issue.
Finally it was solved by this steps:

1. create master host principal " addprinc host/mastr.comain.com "


2. On master server, add to keytab the master host principal " ktadd
   host/mastr.comain.com"

Apparently kprop use "kinit -k" to get a ticket and this only work when you have your master host entry in keytab.