I do not understand what the problem until now. Advise how to find the bug? I see the message in a loop a few minutes in apache log:
src/mod_auth_kerb.c(691): [client 192.168.1.75] Trying to get TGT for user [email protected] then KDC gives TGT and message repeats... After few minutes then browser enter to the site and shows pages. If the password is incorrect then this shall be reported almost immediately. debug enabled in apache2 config KDC verifying disabled to reduce the size of the log apache virtual host config: <VirtualHost *:80> Servername www.h-----g.com DocumentRoot /var/www/www.h-----g.com <Directory /var/www/www.h-----g.com/profile> AuthGROUP_Enabled on AuthType Kerberos KrbServiceName "webinterface/webserver" Krb5Keytab /etc/apache2/krb5.keytab # KrbMethodK5Passwd off KrbMethodNegotiate off KrbSaveCredentials on # Require group dhcs Require valid-user KrbVerifyKDC off </Directory> </VirtualHost> I try to enter to the site, user "[email protected]": tail -f /var/log/apache2/error.log /var/log/heimdal-kdc.log /var/log/apache2/other_vhosts_access.log: ==> /var/log/apache2/error.log <== [Wed Oct 21 03:07:53 2009] [debug] src/mod_auth_kerb.c(1105): [client 192.168.1.75] kerb_authenticate_user_krb5pwd ret=0 [email protected] authtype=Basic [Wed Oct 21 03:07:53 2009] [debug] src/mod_auth_kerb.c(1579): [client 192.168.1.75] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Wed Oct 21 03:07:53 2009] [debug] src/mod_auth_kerb.c(1023): [client 192.168.1.75] Using webinterface/[email protected] as server principal for password verification [Wed Oct 21 03:07:53 2009] [debug] src/mod_auth_kerb.c(691): [client 192.168.1.75] Trying to get TGT for user [email protected] ==> /var/log/heimdal-kdc.log <== 2009-10-21T03:07:53 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:07:53 No preauth found, returning PREAUTH-REQUIRED -- [email protected] 2009-10-21T03:07:53 sending 400 bytes to IPv4:192.168.1.75 2009-10-21T03:08:01 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:08:01 Client sent patypes: encrypted-timestamp 2009-10-21T03:08:01 Looking for PKINIT pa-data -- [email protected] 2009-10-21T03:08:01 Looking for ENC-TS pa-data -- [email protected] 2009-10-21T03:08:01 ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96 2009-10-21T03:08:01 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, arcfour-hmac-md5, des-cbc-crc, des-cbc-md5, des-cbc-md4 2009-10-21T03:08:01 Using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96 2009-10-21T03:08:01 Requested flags: renewable_ok, proxiable, forwardable 2009-10-21T03:08:01 AS-REQ authtime: 2009-10-21T03:08:01 starttime: unset endtime: 2009-10-22T03:07:53 renew till: unset 2009-10-21T03:08:01 sending 638 bytes to IPv4:192.168.1.75 ==> /var/log/apache2/error.log <== [Wed Oct 21 03:08:09 2009] [debug] src/mod_auth_kerb.c(1105): [client 192.168.1.75] kerb_authenticate_user_krb5pwd ret=0 [email protected] authtype=Basic [Wed Oct 21 03:08:09 2009] [debug] src/mod_auth_kerb.c(1579): [client 192.168.1.75] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Wed Oct 21 03:08:09 2009] [debug] src/mod_auth_kerb.c(1023): [client 192.168.1.75] Using webinterface/[email protected] as server principal for password verification [Wed Oct 21 03:08:09 2009] [debug] src/mod_auth_kerb.c(691): [client 192.168.1.75] Trying to get TGT for user [email protected] ==> /var/log/heimdal-kdc.log <== 2009-10-21T03:08:09 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:08:09 No preauth found, returning PREAUTH-REQUIRED -- [email protected] 2009-10-21T03:08:09 sending 400 bytes to IPv4:192.168.1.75 2009-10-21T03:08:17 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:08:17 Client sent patypes: encrypted-timestamp 2009-10-21T03:08:17 Looking for PKINIT pa-data -- [email protected] 2009-10-21T03:08:17 Looking for ENC-TS pa-data -- [email protected] 2009-10-21T03:08:17 ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96 2009-10-21T03:08:17 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, arcfour-hmac-md5, des-cbc-crc, des-cbc-md5, des-cbc-md4 2009-10-21T03:08:17 Using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96 2009-10-21T03:08:17 Requested flags: renewable_ok, proxiable, forwardable 2009-10-21T03:08:17 AS-REQ authtime: 2009-10-21T03:08:17 starttime: unset endtime: 2009-10-22T03:08:09 renew till: unset 2009-10-21T03:08:17 sending 638 bytes to IPv4:192.168.1.75 ==> /var/log/apache2/error.log <== [Wed Oct 21 03:08:25 2009] [debug] src/mod_auth_kerb.c(1105): [client 192.168.1.75] kerb_authenticate_user_krb5pwd ret=0 [email protected] authtype=Basic [Wed Oct 21 03:08:25 2009] [debug] src/mod_auth_kerb.c(1579): [client 192.168.1.75] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Wed Oct 21 03:08:25 2009] [debug] src/mod_auth_kerb.c(1023): [client 192.168.1.75] Using webinterface/[email protected] as server principal for password verification [Wed Oct 21 03:08:25 2009] [debug] src/mod_auth_kerb.c(691): [client 192.168.1.75] Trying to get TGT for user [email protected] ==> /var/log/heimdal-kdc.log <== 2009-10-21T03:08:25 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:08:25 No preauth found, returning PREAUTH-REQUIRED -- [email protected] 2009-10-21T03:08:25 sending 400 bytes to IPv4:192.168.1.75 2009-10-21T03:08:33 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:08:33 Client sent patypes: encrypted-timestamp 2009-10-21T03:08:33 Looking for PKINIT pa-data -- [email protected] 2009-10-21T03:08:33 Looking for ENC-TS pa-data -- [email protected] 2009-10-21T03:08:33 ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96 2009-10-21T03:08:33 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, arcfour-hmac-md5, des-cbc-crc, des-cbc-md5, des-cbc-md4 2009-10-21T03:08:33 Using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96 2009-10-21T03:08:33 Requested flags: renewable_ok, proxiable, forwardable 2009-10-21T03:08:33 AS-REQ authtime: 2009-10-21T03:08:33 starttime: unset endtime: 2009-10-22T03:08:25 renew till: unset 2009-10-21T03:08:33 sending 638 bytes to IPv4:192.168.1.75 ==> /var/log/apache2/error.log <== [Wed Oct 21 03:08:41 2009] [debug] src/mod_auth_kerb.c(1105): [client 192.168.1.75] kerb_authenticate_user_krb5pwd ret=0 [email protected] authtype=Basic [Wed Oct 21 03:08:42 2009] [debug] src/mod_auth_kerb.c(1579): [client 192.168.1.75] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Wed Oct 21 03:08:42 2009] [debug] src/mod_auth_kerb.c(1023): [client 192.168.1.75] Using webinterface/[email protected] as server principal for password verification [Wed Oct 21 03:08:42 2009] [debug] src/mod_auth_kerb.c(691): [client 192.168.1.75] Trying to get TGT for user [email protected] ==> /var/log/heimdal-kdc.log <== 2009-10-21T03:08:42 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:08:42 No preauth found, returning PREAUTH-REQUIRED -- [email protected] 2009-10-21T03:08:42 sending 400 bytes to IPv4:192.168.1.75 2009-10-21T03:08:50 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:08:50 Client sent patypes: encrypted-timestamp 2009-10-21T03:08:50 Looking for PKINIT pa-data -- [email protected] 2009-10-21T03:08:50 Looking for ENC-TS pa-data -- [email protected] 2009-10-21T03:08:50 ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96 2009-10-21T03:08:50 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, arcfour-hmac-md5, des-cbc-crc, des-cbc-md5, des-cbc-md4 2009-10-21T03:08:50 Using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96 2009-10-21T03:08:50 Requested flags: renewable_ok, proxiable, forwardable 2009-10-21T03:08:50 AS-REQ authtime: 2009-10-21T03:08:50 starttime: unset endtime: 2009-10-22T03:08:42 renew till: unset 2009-10-21T03:08:50 sending 638 bytes to IPv4:192.168.1.75 ==> /var/log/apache2/error.log <== [Wed Oct 21 03:08:58 2009] [debug] src/mod_auth_kerb.c(1105): [client 192.168.1.75] kerb_authenticate_user_krb5pwd ret=0 [email protected] authtype=Basic [Wed Oct 21 03:08:58 2009] [debug] src/mod_auth_kerb.c(1579): [client 192.168.1.75] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Wed Oct 21 03:08:58 2009] [debug] src/mod_auth_kerb.c(1023): [client 192.168.1.75] Using webinterface/[email protected] as server principal for password verification [Wed Oct 21 03:08:58 2009] [debug] src/mod_auth_kerb.c(691): [client 192.168.1.75] Trying to get TGT for user [email protected] ==> /var/log/heimdal-kdc.log <== 2009-10-21T03:08:58 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:08:58 No preauth found, returning PREAUTH-REQUIRED -- [email protected] 2009-10-21T03:08:58 sending 400 bytes to IPv4:192.168.1.75 2009-10-21T03:09:06 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:09:06 Client sent patypes: encrypted-timestamp 2009-10-21T03:09:06 Looking for PKINIT pa-data -- [email protected] 2009-10-21T03:09:06 Looking for ENC-TS pa-data -- [email protected] 2009-10-21T03:09:06 ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96 2009-10-21T03:09:06 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, arcfour-hmac-md5, des-cbc-crc, des-cbc-md5, des-cbc-md4 2009-10-21T03:09:06 Using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96 2009-10-21T03:09:06 Requested flags: renewable_ok, proxiable, forwardable 2009-10-21T03:09:06 AS-REQ authtime: 2009-10-21T03:09:06 starttime: unset endtime: 2009-10-22T03:08:58 renew till: unset 2009-10-21T03:09:06 sending 638 bytes to IPv4:192.168.1.75 ==> /var/log/apache2/error.log <== [Wed Oct 21 03:09:15 2009] [debug] src/mod_auth_kerb.c(1105): [client 192.168.1.75] kerb_authenticate_user_krb5pwd ret=0 [email protected] authtype=Basic [Wed Oct 21 03:09:15 2009] [debug] src/mod_auth_kerb.c(1579): [client 192.168.1.75] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Wed Oct 21 03:09:15 2009] [debug] src/mod_auth_kerb.c(1023): [client 192.168.1.75] Using webinterface/[email protected] as server principal for password verification [Wed Oct 21 03:09:15 2009] [debug] src/mod_auth_kerb.c(691): [client 192.168.1.75] Trying to get TGT for user [email protected] ==> /var/log/heimdal-kdc.log <== 2009-10-21T03:09:15 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:09:15 No preauth found, returning PREAUTH-REQUIRED -- [email protected] 2009-10-21T03:09:15 sending 400 bytes to IPv4:192.168.1.75 2009-10-21T03:09:23 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:09:23 Client sent patypes: encrypted-timestamp 2009-10-21T03:09:23 Looking for PKINIT pa-data -- [email protected] 2009-10-21T03:09:23 Looking for ENC-TS pa-data -- [email protected] 2009-10-21T03:09:23 ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96 2009-10-21T03:09:23 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, arcfour-hmac-md5, des-cbc-crc, des-cbc-md5, des-cbc-md4 2009-10-21T03:09:23 Using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96 2009-10-21T03:09:23 Requested flags: renewable_ok, proxiable, forwardable 2009-10-21T03:09:23 AS-REQ authtime: 2009-10-21T03:09:23 starttime: unset endtime: 2009-10-22T03:09:15 renew till: unset 2009-10-21T03:09:23 sending 638 bytes to IPv4:192.168.1.75 ==> /var/log/apache2/error.log <== [Wed Oct 21 03:09:31 2009] [debug] src/mod_auth_kerb.c(1105): [client 192.168.1.75] kerb_authenticate_user_krb5pwd ret=0 [email protected] authtype=Basic [Wed Oct 21 03:09:31 2009] [debug] src/mod_auth_kerb.c(1579): [client 192.168.1.75] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Wed Oct 21 03:09:31 2009] [debug] src/mod_auth_kerb.c(1023): [client 192.168.1.75] Using webinterface/[email protected] as server principal for password verification [Wed Oct 21 03:09:31 2009] [debug] src/mod_auth_kerb.c(691): [client 192.168.1.75] Trying to get TGT for user [email protected] ==> /var/log/heimdal-kdc.log <== 2009-10-21T03:09:31 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:09:31 No preauth found, returning PREAUTH-REQUIRED -- [email protected] 2009-10-21T03:09:31 sending 400 bytes to IPv4:192.168.1.75 2009-10-21T03:09:39 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:09:39 Client sent patypes: encrypted-timestamp 2009-10-21T03:09:39 Looking for PKINIT pa-data -- [email protected] 2009-10-21T03:09:39 Looking for ENC-TS pa-data -- [email protected] 2009-10-21T03:09:39 ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96 2009-10-21T03:09:39 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, arcfour-hmac-md5, des-cbc-crc, des-cbc-md5, des-cbc-md4 2009-10-21T03:09:39 Using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96 2009-10-21T03:09:39 Requested flags: renewable_ok, proxiable, forwardable 2009-10-21T03:09:39 AS-REQ authtime: 2009-10-21T03:09:39 starttime: unset endtime: 2009-10-22T03:09:31 renew till: unset 2009-10-21T03:09:39 sending 638 bytes to IPv4:192.168.1.75 ==> /var/log/apache2/error.log <== [Wed Oct 21 03:09:47 2009] [debug] src/mod_auth_kerb.c(1105): [client 192.168.1.75] kerb_authenticate_user_krb5pwd ret=0 [email protected] authtype=Basic [Wed Oct 21 03:09:47 2009] [debug] src/mod_auth_kerb.c(1579): [client 192.168.1.75] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Wed Oct 21 03:09:47 2009] [debug] src/mod_auth_kerb.c(1023): [client 192.168.1.75] Using webinterface/[email protected] as server principal for password verification [Wed Oct 21 03:09:47 2009] [debug] src/mod_auth_kerb.c(691): [client 192.168.1.75] Trying to get TGT for user [email protected] ==> /var/log/heimdal-kdc.log <== 2009-10-21T03:09:47 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:09:47 No preauth found, returning PREAUTH-REQUIRED -- [email protected] 2009-10-21T03:09:47 sending 400 bytes to IPv4:192.168.1.75 2009-10-21T03:09:55 AS-REQ [email protected] from IPv4:192.168.1.75 for krbtgt/[email protected] 2009-10-21T03:09:55 Client sent patypes: encrypted-timestamp 2009-10-21T03:09:55 Looking for PKINIT pa-data -- [email protected] 2009-10-21T03:09:55 Looking for ENC-TS pa-data -- [email protected] 2009-10-21T03:09:55 ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96 2009-10-21T03:09:55 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, arcfour-hmac-md5, des-cbc-crc, des-cbc-md5, des-cbc-md4 2009-10-21T03:09:55 Using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96 2009-10-21T03:09:55 Requested flags: renewable_ok, proxiable, forwardable 2009-10-21T03:09:55 AS-REQ authtime: 2009-10-21T03:09:55 starttime: unset endtime: 2009-10-22T03:09:47 renew till: unset 2009-10-21T03:09:55 sending 638 bytes to IPv4:192.168.1.75 ==> /var/log/apache2/error.log <== [Wed Oct 21 03:10:03 2009] [debug] src/mod_auth_kerb.c(1105): [client 192.168.1.75] kerb_authenticate_user_krb5pwd ret=0 [email protected] authtype=Basic [Wed Oct 21 03:10:03 2009] [debug] mod_deflate.c(632): [client 192.168.1.75] Zlib: Compressed 937 to 463 : URL /profile/ ==> /var/log/apache2/other_vhosts_access.log <== www.h-----g.com:80 192.168.1.75 - [email protected] [21/Oct/2009:03:07:37 +0800] "GET /profile/ HTTP/1.1" 200 481 "-" "Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9.0.13) Gecko/2009082121 Iceweasel/3.0.6 (Debian-3.0.6-3)"
signature.asc
Description: PGP signature
