Kadmin can't change dsimport'ed passwords in Snow Leopard Server

Question

Hello, World.
I am attempting to manage user accounts in Open Directory from a non-Mac system. After a good deal of investigation on Leopard Server, I wound up ssh'ing to our Open Directory server to create new accounts with 'dsimport', and then to manage later changes to the account through LDAP (for non-password data) and through Kerberos with kadmin, on the theory that kadmind was supposed to propagate the encrypted plain text passwords into Password Service for all of P.S.'s hashing needs.
This worked great in Leopard Server, but under Snow Leopard Server, any attempt to change a user's password via kadmin fails with
'change_password: KDC policy rejects request while changing password for <principal name>'
At the same time, the system log (/var/log/system.log) shows
Nov 2 17:53:46 od1 sandboxd[76028]: mkpassdb(76026) deny file-read-data /usr/sbin/mkpassdb
Nov 2 17:53:46 od1 sandboxd[76028]: mkpassdb(76027) deny process-exec /usr/bin/ldapsearch
However, if I create a principal directly with kadmin, kadmin does allow me to change the password for the principal I just created.
Use modprinc to remove attributes (REQUIRESPREAUTH DISALLOW_SVR) from the dsimport'ed principals doesn't affect anything in any positive manner, though the principals I create manually in kadmin do lack these attributes.
So, does anyone know what the story is, here? Is there no supported API that I can use from a Solaris/Linux server to fully manage accounts under Open Directory?

Answer 1

I have a Similar issue, Details below. the summary is that Using the Snow Leopard GUI interface I created 17 users with a generic low security Password. then transferred and converted some mail files to the server. Once the mail was working properly, I changed the passwords to a slightly more secure password, and set it so my users would have to change their password to a more secure password at log in.
Even after these password changes it is very easy to get other user's ticket information, if you know the original low Security Password with
kinit <other user name>
Details and demonstration.
oursvr:krb5kdc root# kpasswd someuser
Please enter the old password for [email protected]:
Please enter the new password for [email protected]:
Verifying, please re-enter the new password for
[email protected] again:
Server error
Unknown error code: 2802413321
KDC policy rejects request Unknown error code: 2802413326
Please enter the old password for [email protected]:
oursvr:krb5kdc root# kadmin.local
Authenticating as principal root/[email protected] with password.
kadmin.local: cpw [email protected]
Enter password for principal "[email protected]":
Re-enter password for principal "[email protected]":
ambiguous user name.
change_password: KDC policy rejects request while changing password for
"[email protected]".
kadmin.local: q
oursvr:krb5kdc root# kinit someuser/admin
Please enter the password for someuser/[email protected]:
oursvr:krb5kdc root# klist
Kerberos 5 ticket cache: 'API:Initial default ccache'
Default principal: someuser/[email protected]
Valid Starting Expires Service Principal
12/21/09 12:00:53 12/21/09 22:00:53
krbtgt/[email protected]
renew until 12/28/09 12:00:53
oursvr:krb5kdc root# kadmin
Authenticating as principal someuser/[email protected] with password.
Password for someuser/[email protected]:
kadmin: cpw someuser
Enter password for principal "someuser":
Re-enter password for principal "someuser":
change_password: Unknown error code: 2529638924 while changing password
for "[email protected]".
oursvr:krb5kdc root# kdestroy
oursvr:krb5kdc root# kinit otheruser
Please enter the password for [email protected]:
oursvr:krb5kdc root# klist
Kerberos 5 ticket cache: 'API:Initial default ccache'
Default principal: [email protected]
Valid Starting Expires Service Principal
12/21/09 12:07:55 12/21/09 22:07:50
krbtgt/[email protected]
renew until 12/28/09 12:07:55
CONFIGURATION
=============
Contents of /var/db/krb5kdc/kadm5.acl:
## This file autogenerated by KDCSetup ##
*/[email protected] * *
[email protected] * *
ADDITIONAL INFORMATION
======================
(1) Using 'passwd' to change the password does not change the Kerberos
password.
(2) Using "dscl /LDAPv3/127.0.0.1 -passwd Users/someuser" does not change
the Kerberos password.
(3)
(4) From /var/log/system.log:
Dec 21 11:57:01 oursvr edu.mit.Kerberos.kadmind[79131]: ambiguous user name.
Dec 21 11:57:01 oursvr sandboxd[82190]: mkpassdb(82189) deny file-read-data
/usr/sbin/mkpassdb
(5) From /var/log/krb5kdc/kadmin.log:
Dec 21 12:02:36 oursvr.sub.dom.tld kadmind[79131](Notice): Request:
kadm5chpassprincipal, [email protected], KDC policy rejects
request, client=someuser/[email protected],
service=kadmin/[email protected], addr=VVV.WWW.YYY.ZZ
Dec 21 12:02:36 oursvr.sub.dom.tld kadmind[79131](Notice): Request:
kadm5chpassprincipal, [email protected], KDC policy rejects
request, client=someuser/[email protected],
service=kadmin/[email protected], addr=VVV.WWW.YYY.ZZ
(6) From /var/log/krb5kdc/ldc.log:
Dec 21 11:56:51 oursvr.sub.dom.tld krb5kdc[62](info): AS_REQ (7 etypes {18
17 16 23 1 3 2}) VVV.WWW.YYY.ZZ: NEEDED_PREAUTH:
[email protected] for kadmin/[email protected],
Additional pre-authentication required
Dec 21 11:56:51 oursvr.sub.dom.tld krb5kdc[62](info): AS_REQ (7 etypes {18
17 16 23 1 3 2}) VVV.WWW.YYY.ZZ: NEEDED_PREAUTH:
[email protected] for kadmin/[email protected],
Additional pre-authentication required
Dec 21 11:56:51 oursvr.sub.dom.tld krb5kdc[62](info): AS_REQ (7 etypes {18
17 16 23 1 3 2}) VVV.WWW.YYY.ZZ: ISSUE: authtime 1261414611, etypes
{rep=18 tkt=16 ses=18}, [email protected] for
kadmin/[email protected]
Dec 21 11:56:51 oursvr.sub.dom.tld krb5kdc[62](info): AS_REQ (7 etypes {18
17 16 23 1 3 2}) VVV.WWW.YYY.ZZ: ISSUE: authtime 1261414611, etypes
{rep=18 tkt=16 ses=18}, [email protected] for
kadmin/[email protected]
(7) mkpassdb -dump 0x4b2bf32f30c3d4860000001e0000001e
slot 0030: 0x4b2bf32f30c3d4860000001e0000001e someuser 12/21/2009
12:28:17 PM
Last password change: 12/21/2009 11:00:36 AM
Last login: 12/21/2009 12:28:17 PM
Failed login count: 0
Disable reason: none
Hash-only bit: 0
Last Transaction ID: 2052
Transaction requires kerberos: 1
Record is dead: 0
Record is not to be replicated: 0
Access Features:
isDisabled=0 isAdminUser=0 newPasswordRequired=0 usingHistory=0
canModifyPasswordforSelf=1 usingExpirationDate=0 usingHardExpirationDate=0
requiresAlpha=0 requiresNumeric=0 expirationDateGMT=18446744073709551615
hardExpireDateGMT=18446744073709551615 maxMinutesUntilChangePassword=0
maxMinutesUntilDisabled=0 maxMinutesOfNonUse=0 maxFailedLoginAttempts=0
minChars=0 maxChars=0 passwordCannotBeName=0 requiresMixedCase=0
requiresSymbol=0 notGuessablePattern=0 isSessionKeyAgent=0
isComputerAccount=0 adminClass=0 adminNoChangePasswords=0
adminNoSetPolicies=0 adminNoCreate=0 adminNoDelete=0 adminNoClearState=0
adminNoPromoteAdmins=0
Group(s) for Administration: unrestricted
digest 0: method: *cmusaslsecretSMBNT
digest length: 16
digest: D6B093421FDF17380F0B695721F0F26A
digest 1: method: *cmusaslsecretSMBLM
digest length: 16
digest: 5C957C596B14237409A48A7AC23C7AB2
digest 2: method: *cmusaslsecretDIGEST
digest length: 16
digest: 8E9181A5F7697D7FB83BF2DA430CBB70
digest 3: method: *cmusaslsecretCRAM-M
digest length: 32
digest:
A08E4B9266A4B8676DEFA8584758F9013D29A479D81EE4E41D857D5A5CA4FA71
digest 4: method: KerberosRealmName
digest: OUR.KRB5.RLM
digest 5: method: KerberosPrincName
digest: someuser
digest 6: method: *cmusaslsecretPPS
digest length: 24
digest: A5AC9D1843D42ED4AF39EFB4AB91E536F733FB2580978860
digest 7: <empty>
digest 8: <empty>
digest 9: <empty>
slot checksum: 7DAA85870308B253D5A9294483A4B0EF
(8) dscl /LDAPv3/127.0.0.1 -read Users/someuser | grep -A 2 authAuthority
dsAttrTypeNative:authAuthority:
;ApplePasswordServer;0x4b2bf32f30c3d4860000001e0000001e,1024 35
14773688809506996593092824880872774590718495204127440029375223520574013330136617 78685429961896612181406054801454823310071429734609519569726042321602422714273008 59946509691313082062885828226653436410277560435615063784052163315144051817774743 254036483144235604939879290290235050919364398951613699884041179183857
[email protected]:VVV.WWW.YYY.ZZ
;Kerberosv5;0x4b2bf32f30c3d4860000001e0000001e;[email protected];OUR.KRB5.R LM;1024
35
14773688809506996593092824880872774590718495204127440029375223520574013330136617 78685429961896612181406054801454823310071429734609519569726042321602422714273008 59946509691313082062885828226653436410277560435615063784052163315144051817774743 254036483144235604939879290290235050919364398951613699884041179183857
[email protected]:VVV.WWW.YYY.ZZ