Subject: Pine 4.4x and the Kerberos 4 Patch Kit ??

From: Seth Meyer <[email-masked]>
Date: Fri, 30 Nov 2001 19:29:33 -0500

Hello All,

Has anyone had experience using the Kerberos 4 Patch Kit with Pine 4.4x ?

I am seeing a problem:  Kerberos_V4 SASL authentication fails;  the client
asks the server for Kerberos_V4 authentication, then the server rejects
the authenticator:

 42   0.00055 gremlins.imap.itd.umich.edu -> metacortex.gpcc.itd.umich.edu IMAP R port=55798 * CAPABILITY IMAP4 I

	   0: 0800 209b 60f7 00d0 0621 f7fd 0800 4500    .. .`÷...!÷...E.
	  16: 00d5 130b 4000 fd06 5a16 8dd3 0e0d 8dd5    ....@...Z.......
	  32: e64b 008f d9f6 574e 7b1f 850c 50e2 5018    .K...öWN{...P.P.
	  48: 2238 f845 0000 2a20 4341 5041 4249 4c49    "8øE..* CAPABILI
	  64: 5459 2049 4d41 5034 2049 4d41 5034 5245    TY IMAP4 IMAP4RE
	  80: 5631 204e 414d 4553 5041 4345 2049 444c    V1 NAMESPACE IDL
	  96: 4520 5343 414e 2053 4f52 5420 4d41 494c    E SCAN SORT MAIL
	 112: 424f 582d 5245 4645 5252 414c 5320 4c4f    BOX-REFERRALS LO
	 128: 4749 4e2d 5245 4645 5252 414c 5320 4155    GIN-REFERRALS AU
	 144: 5448 3d4b 4552 4245 524f 535f 5634 2041    TH=KERBEROS_V4 A
	 160: 5554 483d 4c4f 4749 4e20 5448 5245 4144    UTH=LOGIN THREAD
	 176: 3d4f 5244 4552 4544 5355 424a 4543 540d    =ORDEREDSUBJECT.
	 192: 0a30 3030 3030 3030 3020 4f4b 2043 4150    .00000000 OK CAP
	 208: 4142 494c 4954 5920 636f 6d70 6c65 7465    ABILITY complete
	 224: 640d 0a                                 d..

 43   0.00495 metacortex.gpcc.itd.umich.edu -> gremlins.imap.itd.umich.edu IMAP C port=55798 00000001 AUTHENTICAT

	   0: 0000 0c07 ace6 0800 209b 60f7 0800 4500    ........ .`÷..E.
	  16: 004b 6b30 4000 ff06 007b 8dd5 e64b 8dd3    .Kk0@....{...K..
	  32: 0e0d d9f6 008f 850c 50e2 574e 7bcc 5018    ...ö....P.WN{.P.
	  48: 2238 8da7 0000 3030 3030 3030 3031 2041    "8....00000001 A
	  64: 5554 4845 4e54 4943 4154 4520 4b45 5242    UTHENTICATE KERB
	  80: 4552 4f53 5f56 340d 0a                  EROS_V4..

 44   0.00082 gremlins.imap.itd.umich.edu -> metacortex.gpcc.itd.umich.edu IMAP R port=55798 + AAA2LA==\r\n

	   0: 0800 209b 60f7 00d0 0621 f7fd 0800 4500    .. .`÷...!÷...E.
	  16: 0034 130c 4000 fd06 5ab6 8dd3 0e0d 8dd5    .4..@...Z.......
	  32: e64b 008f d9f6 574e 7bcc 850c 5105 5018    .K...öWN{...Q.P.
	  48: 2238 b5b8 0000 2b20 4141 4132 4c41 3d3d    "8....+ AAA2LA==
	  64: 0d0a                                       ..

 45   0.04497 metacortex.gpcc.itd.umich.edu -> gremlins.imap.itd.umich.edu IMAP C port=55798 

	   0: 0000 0c07 ace6 0800 209b 60f7 0800 4500    ........ .`÷..E.
	  16: 0028 6b31 4000 ff06 009d 8dd5 e64b 8dd3    .(k1@........K..
	  32: 0e0d d9f6 008f 850c 5105 574e 7bd8 5010    ...ö....Q.WN{.P.
	  48: 2238 f9dc 0000                             "8....

 46   0.00376 metacortex.gpcc.itd.umich.edu -> gremlins.imap.itd.umich.edu IMAP C port=55798 

	   0: 0000 0c07 ace6 0800 209b 60f7 0800 4500    ........ .`÷..E.
	  16: 002b 6b32 4000 ff06 0099 8dd5 e64b 8dd3    .+k2@........K..
	  32: 0e0d d9f6 008f 850c 5105 574e 7bd8 5018    ...ö....Q.WN{.P.
	  48: 2238 c5c4 0000 2a0d 0a                  "8....*..

 47   0.00345 gremlins.imap.itd.umich.edu -> metacortex.gpcc.itd.umich.edu IMAP R port=55798 00000001 NO AUTHENTI

	   0: 0800 209b 60f7 00d0 0621 f7fd 0800 4500    .. .`÷...!÷...E.
	  16: 0055 130d 4000 fd06 5a94 8dd3 0e0d 8dd5    .U..@...Z.......
	  32: e64b 008f d9f6 574e 7bd8 850c 5108 5018    .K...öWN{...Q.P.
	  48: 2238 02b1 0000 3030 3030 3030 3031 204e    "8....00000001 N
	  64: 4f20 4155 5448 454e 5449 4341 5445 204b    O AUTHENTICATE K
	  80: 4552 4245 524f 535f 5634 2066 6169 6c65    ERBEROS_V4 faile
	  96: 640d 0a                                 d..

and yet my client has not obtained a service ticket for imap,  yet
I have a valid TGT:

smeyer@metacortex:~> klist
Ticket file:    /ticket/p1090534387
Principal:      [email-masked]

Issued           Expires          Principal
Nov 30 12:58:55  Dec  1 00:43:55  [email-masked]
Nov 30 12:58:55  Dec  1 00:43:55  [email-masked]

The Kerberos 4 Patch Kit is unsupported,  yet if anyone has run into this,
I'd appreciate hearing about how they handled this.

(I reproduced the above scenario w/ Pine versions 4.41, 4.42, and 4.43
built with NOSSL and NOLDAP,  EXTRAAUTHENTICATORS=krb and MIT Krb4
libraries,  no GSS support, the SunPRO Forte compiler version 6,  in a
solaris 8 sparcv9 environment.  The IMAP server is IMAP4rev1 v12.250um1,
not that the um1 is much help to you,  but kerberos_v4 sasl auth works
with Pine4.33 and this same server.)

    Seth Meyer
    University of Michigan

---

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------