Krb5 attempts authentication twice in case of wrong password

[Manoj Unni Krishnan -X (munnikri - HCL TECHNOLOGIES LIMITED at Cisco)]

Hi Team,

We are using Kerberos (version 1.9) in one of our components and we see for a single Kerberos authentication with wrong password, krb5 tries twice then fails with error:

krb5: Received error from KDC: -1765328360/Preauthentication failed

if we have configured user account lock for 3 bad password attempts in Active Directory the user gets locked in 2nd attempt itself as krb5 would have attempted 4times.

We had a look at the latest krb5 src code for the file get_in_tkt.c, could see there are lots of changes been done, But we are having difficulty in moving to the latest version of Kerberos, as there are lot of customizations done over the version of Kerberos (1.9) that we are using. Hence could you please let us know whether the retry attempt has been fixed as part of any bug/commit we could port it to 1.9.

Thanks,
Manoj

_______________________________________________
krbdev mailing list ***@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev

[Roland C. Dowdeswell]

Post by Manoj Unni Krishnan -X (munnikri - HCL TECHNOLOGIES LIMITED at Cisco)
We are using Kerberos (version 1.9) in one of our components and
we see for a single Kerberos authentication with wrong password,

MIT Kerberos will generally fail back to trying the master KDC if
you enter an invalid passwd. This gives the appearance of instant
passwd changes which, I think, is a feature. That is: if you change
your passwd, it will be changed on the master KDC. This change
will then propagate to the various slave KDCs and this may take
time. If a user tries to log in again with their new passwd, it
may fail. This causes user confusion. Failing back to the master,
though, given that it has the latest data, will allow the user to
obtain tickets.

Post by Manoj Unni Krishnan -X (munnikri - HCL TECHNOLOGIES LIMITED at Cisco)
krb5: Received error from KDC: -1765328360/Preauthentication failed
if we have configured user account lock for 3 bad password attempts
in Active Directory the user gets locked in 2nd attempt itself as
krb5 would have attempted 4times.

I would not generally recommend account lockouts because the first
thing that a hacker would do upon getting into your network is to
try all of the admins passwds until they can't log in. This would
make it quite difficult to get them out.

Account lockouts are intentionally building a DoS into your
environment.

Post by Manoj Unni Krishnan -X (munnikri - HCL TECHNOLOGIES LIMITED at Cisco)
We had a look at the latest krb5 src code for the file get_in_tkt.c,
could see there are lots of changes been done, But we are having
difficulty in moving to the latest version of Kerberos, as there
are lot of customizations done over the version of Kerberos (1.9)
that we are using. Hence could you please let us know whether the
retry attempt has been fixed as part of any bug/commit we could
port it to 1.9.

You should be able to disable this feature by failing to define a
master KDC. Check your krb5.conf and see if you have it defined
there or look for the DNS SRV RRs _kerberos-master._udp.REALM or
_kerberos-master._tcp.REALM.