cannot auth with AES256 keytab

ermacaz commented 1 year ago

Hi. I am trying to update my existing working setup from arcfour to AES256 however my new keys fail when attempting to auth.

In nginx debug log I get an empty error message for gss_accept_sec_context() failed

2023/05/16 00:01:00 [debug] 1503#0: *7 Token decoded: YIIHZgYGKwYBBQUCoIIHWjCCB1agMDAuBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICHgYKKwYBBAGCNwICCqKCByAEggccYIIHGAYJKoZIhvcSAQICAQBuggcHMIIHA6ADAgEFoQMCAQ6iBwMFACAAAACjggUSYYIFDjCCBQqgAwIBBaEUGxJBRC5UUklXQVRDSERPRy5DT02iLTAroAMCAQKhJDAiGwRIVFRQGxpjb3NzYW5kYm94LnRyaXdhdGNoZG9nLmNvbaOCBLwwggS4oAMCARKhAwIBBqKCBKoEggSmQ5LxFxpM020r0DtilaOPyfRYAPC/T7JeWLvwxRwiIlh3JRvoZ9AJYT4cR3FY9dV3bn7dd1ZVjMBIOyHnjzEZDULwnF8L/wGFsB1BIoaEDvgwC157aeIortK5E8eLFfEFO9eiz3FFL9T7SP2ohDbrE8H4AEdVWpFBD527u9mYcDB6bO9WB3LmL4YJoThwpP+DCe7lmjQX3OpPS8qBln118sKSMpXdHoLtrwZ3TkGqetAxkyIEY53msfNc9bZGAuTMjZ5jUMOUa3P3Iu2qR/nPQGktLune0MHhLCTvp7R3d9lCkk1LjTcWt+fNJ2PlNPpqjMir0ETV6grIr8JM7VidcYWdUiC4psERC743o96K0qn1c4PYD0TzO5WiCwEhNMf7vBKgD0G+NXqUANasfm88IXnp1CC6dvqrIk5t/j13ITfuwSY+8Zhq5ISqVbZ12IXP7bf/Gfp4L9j58M+JBHUu3kl2DEO3ADQkZOT49pRt2G8aQMWLcc78lcrVUq4K1zhmm4pmHBXJMCpO8wfTm7Ej59i9LdVxkuu7hClpzVOXSoSb0EfrgkVlCbL3pMW3PxgQ6A2VHWh+LQlqseyahZN4PE/1bwjl9dTvYTxmmN/6z1RsZYR2O44RpHr4x9eHeJk5PXAELOBtKKq7X2zEna8DdRG809o8u34Aorq9KLe5rDvboxzhMqRfze8gfwbPPr2vNlTLbPCbE2BLvvshG28SuT0C3B3lEHVySrVsqNEfBdTeyMPUug4I/M9h5JIG2hiIZ7+l2ik1nBqa2HLpLYd1atuwCLUEu/CuD69t10Kxbvbz41oI2tAD9X1FK2sx9b8w+WBRb+hlZfYhAqcL/YZSUay2LnMc3wDo4WWIRwJLi9bnm0JUUfQ8b4ktcKcU+cC4YXN4zg/b2MTk+pPTM5ctLdDiKvThpbo2yqYnzud2z1+77UTqSSy2E+EgV+lLIB/R9Stb31BgFmZa54pr/ZX2INmkQQM4KldoYHdsB+QU+9aVElacBG5O8JF+9ssWPp7bjfjQgpFgoHpveB9mUHy/FCFOI2CQfk/oWguH8AZJB9STQ02M+QLhdz6wGfyp1677eQ5GJ6MUx062E+UbU4bEVRB1cqKaCvCx6of0iiRJXkijIw6wUioPJ88Dm1dr9kjJLJ5MI6rgR+e9+kOG6EffrZaOwmgIMuk3JZWniupu8E/qP7RpH66rOIJSQCsFxmH1H80DgaUKBfDfPFAohVhH8QT+Tu+HwdbRgikvjkiS7Z5L6VBFcJaG7OYpjea2OBWSKUkfqOrAsHI6RfX9W3P82iQT1MWWQRjbykuA0QXs2Q39+okGLw6UvLQ3o0/VRh88DC3pB95lMquYpTOX/vi4YY2MQ2JwTxqiTOK9Mngq2wrG98y7+xNMPA6bm+Vr17o6VHbOURRSPL710dR4CETpqxLR6i1cWkK8u9LsRU7WxDuHGh6MkfEzCGYWdH4uofqdRWMZdCLraP5y3Y5uYbjaP3Gyn3JCSYAVrglkHoVtfn5mxoxzLdfZii5e0Rcm3u0jTny4c5aL2Pt9JzMtnqybCBptI388b/IY3ibRNsvm1p7dbuPB942kggHWMIIB0qADAgESooIByQSCAcUtpD1WFCwpgOfkS6AIyFYkrXl0S6o5hT2u6nXpgsH/i+2P1n0HZ694xFKX90/vOI+xy
2023/05/16 00:01:00 [debug] 1503#0: *7 Client sent a reasonable Negotiate header
2023/05/16 00:01:00 [debug] 1503#0: *7 GSSAPI authorizing
2023/05/16 00:01:00 [debug] 1503#0: *7 Use keytab /etc/krb5.keytab
2023/05/16 00:01:00 [debug] 1503#0: *7 gss_accept_sec_context() failed: :
2023/05/16 00:01:00 [debug] 1503#0: *7 GSSAPI failed

Key has good perms and ownership

$ ls -l /etc/krb5.keytab 
-rw------- 1 www-data root 206 May 15 23:43 /etc/krb5.keytab

mhamada@cossandbox:~$ sudo klist -kte
Keytab name: FILE:/etc/krb5.keytab
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   4 05/15/2023 23:43:03 HTTP/sandbox.site.com@SITE.COM (aes256-cts-hmac-sha1-96)

Keytab is being generated on windows server active directory with

ktpass -princ HTTP/sandbox.site.com@SITE.COM -mapuser   AD\aduser -pass 'test123' -out http.keytab -ptype KRB5_NT_PRINCIPAL -crypto AES256-SHA1

krb5.conf on server should be allowing AES256

default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac
default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac
permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac

Went through and also remade new arc4 keys to ensure there wasnt a step missing from our process and those work fine; something about the AES256 keys is causing a failure.

Any help appreciated

ermacaz commented 1 year ago

[sad unauthenticated noises]

stnoonan commented 1 year ago

This looks like an issue with your service account on the windows side. You need to explicitly enable support for AES256 for each one after generating the keytab.

See https://social.technet.microsoft.com/wiki/contents/articles/36470.active-directory-using-kerberos-keytabs-to-integrate-non-windows-systems.aspx

On Sat 20 May 2023 at 17:14, Matt @.***> wrote:

[sad unauthenticated noises]

— Reply to this email directly, view it on GitHub https://github.com/stnoonan/spnego-http-auth-nginx-module/issues/141#issuecomment-1555944321, or unsubscribe https://github.com/notifications/unsubscribe-auth/AADGOAV53VFQ2GY3RA7S3JDXHDUX7ANCNFSM6AAAAAAYC44IKI . You are receiving this because you are subscribed to this thread.Message ID: @.*** com>

ermacaz commented 1 year ago

That option is enabled on the service account. Tried disabling-reenabling but no luck. Also tried AES128 key but same issue.

stnoonan commented 1 year ago

It is strange that you aren’t getting an error message from the underlying library ( https://github.com/stnoonan/spnego-http-auth-nginx-module/blob/master/ngx_http_auth_spnego_module.c#L1524 )

Are you doing MIT or Heimdal? Can you kinit successfully using the generated keytab?

On Sat 20 May 2023 at 22:45, Matt @.***> wrote:

That option is enabled on the service account. Tried disabling-reenabling but no luck. Also tried AES128 key but same issue.

[image: image] https://user-images.githubusercontent.com/3372343/239710415-52666fdc-507f-452a-bdfb-192bb8538c9c.png

— Reply to this email directly, view it on GitHub https://github.com/stnoonan/spnego-http-auth-nginx-module/issues/141#issuecomment-1556020751, or unsubscribe https://github.com/notifications/unsubscribe-auth/AADGOASLGIDGPLPY472BDXLXHE3RLANCNFSM6AAAAAAYC44IKI . You are receiving this because you commented.Message ID: @.***>

ermacaz commented 1 year ago

$ sudo krb5-config  --all
Version:     Kerberos 5 release 1.15.5
Vendor:      Massachusetts Institute of Technology

I've honestly never been able to get kinit to work with old or new keys, always gives me a realm not local error but didnt cause issues with it working before

stnoonan commented 1 year ago

If you haven’t been able to get it to work, you probably have a busted config in the first place. It’s quite possibly unrelated, but you know how these things go.

I’m still surprised you get no actual error printed.

(For what it’s worth, I don’t actually have an environment to test your case anymore, so it is rather difficult to debug. If you can get kinit to work correctly, we would know the issue lies in the module rather than your local config.)

On Sat 20 May 2023 at 23:26, Matt @.***> wrote:

$ sudo krb5-config --all Version: Kerberos 5 release 1.15.5 Vendor: Massachusetts Institute of Technology

I've honestly never been able to get kinit to work with old or new keys, always gives me a realm not local error but didnt cause issues with it working before

— Reply to this email directly, view it on GitHub https://github.com/stnoonan/spnego-http-auth-nginx-module/issues/141#issuecomment-1556030735, or unsubscribe https://github.com/notifications/unsubscribe-auth/AADGOAXDIVBXTK2ZBUNEUTTXHFAINANCNFSM6AAAAAAYC44IKI . You are receiving this because you commented.Message ID: @.***>

ermacaz commented 1 year ago

Rebuilt our Active directory test env and that seemed to fix it... Closing as likely config issue as suspected

stnoonan / spnego-http-auth-nginx-module

cannot auth with AES256 keytab #141