From Fedora Project Wiki

Revision as of 07:41, 18 April 2013 by Stefw (talk | contribs) (Create page)

Description

Demonstrate that MIT Kerberos 1.11 no longer requires clients to synchronize their system clocks with that of the KDC.

Setup

  1. Verify that your ActiveDirectory domain access works. If you don't have an Active Directory domain, you can set one up.
  2. You need a domain account, either a user or administrator. It's useful to test with both.
  3. Your machine must have a configured host name. Do not proceed if you host name is localhost or similar. 
    $ hostname
  4. Make sure you have krb5-workstation-1.11 or later installed.

How to test

  1. Get the client's current system time. 
     $ date 
     Mon Mar 11 15:47:05 EDT 2013
  2. Set the system time on the client to be 24 hours ahead of the client's current system time. This will ensure that the client and Active Directory server's clocks are not synchronized. 
     $ sudo date -s "12 MAR 2013 15:47:05 EDT" 
     Tue Mar 12 15:47:05 EDT 2013
  3. Use an Active Directory domain user account to authenticate to the Active Directory server using kinit 
    $ kinit user@AD.EXAMPLE.COM
    Password for user@AD.EXAMPLE.COM
    • Make sure that you capitalize the domain name.
    • If the above fails with 'Preauthentication failed' then you probably typed the wrong password.
    • There should be no output from this command.

Expected Results

  1. Check that you have an appropriate entry in your credentials cache using the klist command. 
    $ klist
    • You should see a line that has a service principal named "krbtgt/AD.EXAMPLE.COM@AD.EXAMPLE.COM"



Troubleshooting

TBD

Retrieved from "https://fedoraproject.org/w/index.php?title=QA:Testcase_kerberos_unsynced_clocks&oldid=331870"