Iowa State University

ITInformation Technology

Reconfigure Kerberos to Use Version 5

This news item expired September 5, 2008. It may contain out-of-date information.
If you did not reconfigure Kerberos on your computer last spring or over the summer, you will need to do so to be able to use the newest version. Kerberos needed to be reconfigured on or before May 15, 2008 to disable a "Kerberos-5-to-4" ticket generation that was occurring.

During the transition period from Kerberos 4 to Kerberos 5, both were able to be used. Now, only Kerberos 5 is functional; applications that can only use Kerberos-4 will not work.

Kerberos for Windows

Applications on your system that use Kerberos need to be able to use Kerberos 5. Current versions of some applications include:

-- KfW 3.2.2
-- PCLPR 2.3.3
-- Kpoprelay 1.0.0.1 (replaces SideCar, which is obsolete)
-- WinZephyr 2.0
-- Eudora Pro 7.1

If you have not upgraded the above applications and configured to use Kerberos-5, they will no longer work.

Instructions for the "Kerberos for Windows" configuration tool
Download the "Kerberos for Windows" configuration tool

Kerberos for Mac OS X

If the Kerberos configuration change is not done, you will experience these problems:

-- If you have configured your system to use your Kerberos password on login and try to login with your kerberos password, the system won't let you login. No error message will be displayed -- the Login Window will just shake as if the username or password were invalid.

-- If you login with your local password and run kinit from the command line or from the Kerberos.app, you will get this error: "Kerberos Login Failed: Can't send request (send_to_kdc)"

In both cases above, the system pauses about 20-25 seconds before failing.

The only Mac OS X application that was distributed by IT Services that used Kerberos 4 tickets was MacZephyr. MacZephyr ceased to function starting May 15. A new Zephyr Utility will be available soon for users wanting to use Zephyr on their Mac OS X system.

IT Services has put together a Kerberos Configuration installer that will install the Kerberos preference file that has been configured for Kerberos 5 for use at Iowa State.

"How To Configure Kerberos" instructions for Mac OS X
Download the Kerberos Configuration installer for Mac OS X