X-GM-Features: Ac12FXzAI--WjCmfPT2wU84XNNwGnDw3or-F7w6awBoigZsXVs9iIwPZ-7qYUrY X-MS-Exchange-Transport-Crosstenantheadersstamped: BN0PR01MB7008 X-MS-Exchange-Senderadcheck: 0 X-MS-Traffictypediagnostic: DS1PEPF00017095:EE_|BN0PR01MB7008:EE_ From: "Travis Bean" X-Google-Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1756257813; x=1756862613; h=content-transfer-encoding:to:subject:message-id:date:from :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=S/B6loT2zCoJ8DuC3ZeYDfLCZcAv1ofzRqhja56POBg=; b=LLuQb5KDMSPUx6Q2mbSK2YB80OPvDq6WzpGIPFXY5h9X1xQr4om0a/0SdnWoKlrVug QsPfhv7l3PP83nQJsluXJn0aHTAxPVyaO2qeGi1f5RE6Y1qlj6xixcE+XH+2Cp6Jn/sE KJImij5AgNqA0qicdbMjATMpmNPHl2LomkwFT9PV87tMEI9dHv2nNa5omrUST2g9Mk5b oFftKxhU0kwtX7PvuDeYPK6S16/bZh/RVtItHO1lPsfH/JoW+xjKDR8I1+2n0UIjwlEp qNZuW6Q9hjMwtJLChdH4E6HDc2ZpqyTQ8S/eCCyLfqDmA4oZP42UUtmsTgGh52m+7Uhh 1t0A== Received: from mailman.mit.edu (mailman.mit.edu [18.7.21.50]) by krbdev.mit.edu (Postfix) with ESMTP id 73C301031FE; Wed, 27 Aug 2025 01:05:22 -0400 (EDT) Received: from mailman.mit.edu (localhost [127.0.0.1]) by mailman.mit.edu (8.15.2/8.12.8) with ESMTP id 57R55LRA2844196; Wed, 27 Aug 2025 01:05:21 -0400 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2054.outbound.protection.outlook.com [40.107.237.54]) by mailman.mit.edu (8.15.2/8.12.8) with ESMTPS id 57R1Na3N2792494 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=OK) for ; Tue, 26 Aug 2025 21:23:36 -0400 Received: from DM6PR06CA0056.namprd06.prod.outlook.com (2603:10b6:5:54::33) by BN0PR01MB7008.prod.exchangelabs.com (2603:10b6:408:167::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9073.13; Wed, 27 Aug 2025 01:23:34 +0000 Received: from DS1PEPF00017095.namprd03.prod.outlook.com (2603:10b6:5:54:cafe::f2) by DM6PR06CA0056.outlook.office365.com (2603:10b6:5:54::33) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9052.22 via Frontend Transport; Wed, 27 Aug 2025 01:23:34 +0000 Received: from mail-il1-x133.google.com (2607:f8b0:4864:20::133) by DS1PEPF00017095.mail.protection.outlook.com (2603:10b6:2c:400:0:1002:0:a) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9073.11 via Frontend Transport; Wed, 27 Aug 2025 01:23:33 +0000 Received: by mail-il1-x133.google.com with SMTP id e9e14a558f8ab-3e6831f5ce4so26642195ab.3 for ; Tue, 26 Aug 2025 18:23:33 -0700 (PDT) Arc-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=XDgtzAei0lsFhMw0r4nesZTWXdK1hxlZfVvMoPTW0cmGkT0BBvvWnCruvuuxuYzMAlpEyHSdWS5GsSxllLC+VZ2AGHgEdH3bOWj2lJd/Uf31bocPdPYGzh8dZZMBDAxJtB0ci94ZTepSbxD1CVd80kyi7/Zkie1VwzrZamFaCIOdwWIxIX9Gi8oWQx/7LkZT0FKWkB5PRJeredoAWhYzMf81mKV9E7TYTLujghf6w355XF8bS6Ro9SJoptoDyMcbDBZI2vF1BTGlp/PvoR6TZgpbw36Uv7ZU/381SeYzCkp1t1c/4SUphW9xsVapGhFvP4B5FA6rDw4en8OPiJ99tg== X-MS-Exchange-Crosstenant-ID: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b Sender: "krb5-bugs-incoming" content-type: text/plain; charset="utf-8" X-RT-Incoming-Encryption: Not encrypted Content-Transfer-Encoding: 8bit Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates 2607:f8b0:4864:20::133 as permitted sender) receiver=protection.outlook.com; client-ip=2607:f8b0:4864:20::133; helo=mail-il1-x133.google.com; pr=C X-GM-Message-State: AOJu0Yw02r8iKjzofNmKFZWLecDQKPhaJl3nqqBG/mqO953UmTrxlSew 1zBhDoMxZhYVxKaOU29moCYW1EhXX/52BVTmT/L/Y9mMJ9HfgLY2ejXN04gPi8BCpGmUwwNw5MO GnxxAHpByvezKsQqkkeL9zR4Edle551l4tUnM+yo= X-MS-Office365-Filtering-Correlation-ID: 0032104c-9e1a-4c8c-d3cd-08dde5085722 X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr X-Mailman-Approved-At: Wed, 27 Aug 2025 01:05:21 -0400 X-MS-Exchange-Crosstenant-Originalarrivaltime: 27 Aug 2025 01:23:33.9918 (UTC) Date: Tue, 26 Aug 2025 18:23:22 -0700 X-MS-Publictraffictype: Email X-Google-SMTP-Source: AGHT+IHU1nGy3XadhG6BBcIA/1xJ1HLdjrn3eEWlvVEStZQQI4PfXhNiopG7wKYJ6z27EGT3MPdZqz8pE/bNXYGEG2c= Return-Path: X-Originatororg: mitprod.onmicrosoft.com X-MIME-Autoconverted: from quoted-printable to 8bit by mailman.mit.edu id 57R1Na3N2792494 Authentication-Results: mailman.mit.edu; dkim=fail reason="signature verification failed" (1024-bit key, unprotected) header.d=mitprod.onmicrosoft.com header.i=@mitprod.onmicrosoft.com header.a=rsa-sha256 header.s=selector2-mitprod-onmicrosoft-com header.b=Eimn8TqW; dkim=fail reason="signature verification failed" (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=bcXEl6Gt Authentication-Results: spf=pass (sender IP is 2607:f8b0:4864:20::133) smtp.mailfrom=gmail.com; dkim=pass (signature was verified) header.d=gmail.com;dmarc=pass action=none header.from=gmail.com; X-MS-Exchange-Antispam-Relay: 0 From krb5-bugs-incoming-bounces@mit.edu Wed Aug 27 01:05:22 2025 X-MS-Exchange-Crosstenant-Authsource: DS1PEPF00017095.namprd03.prod.outlook.com X-Beenthere: krb5-bugs-incoming@mit.edu X-MS-Exchange-Crosstenant-Fromentityheader: Internet X-Microsoft-Antispam: BCL:0; ARA:13230040|376014|7093399015|61400799027|9140799003|48200799018|13003099007; Arc-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=S/B6loT2zCoJ8DuC3ZeYDfLCZcAv1ofzRqhja56POBg=; b=mLwLbq9GKMDaDAU7Rgcz+z+Ur4voUYKlGiLUEabGTItrferStI+nW+nB0KlbbMxfSkFnDNLUNWjSOylXiD5JvBJv0BZE/CbuxXW2SoYFi8tke8mmDMKdJyxvaW/3591SQcrujH4djrXbxfCnYjaSdqrDzhL4Dn2YtUV837ecdu3kKk5HtpszTjyZUjtQKgNgiVtE/uNe+5Uc55euWua2Y4vRkzYm9fzzmN7ymGcGQmev0NvsWJZJC+WPsdoAcBpauqRk1pOLcxh3fOy48/YAzS9WzMit3gAE/e1P/JXUZSK+xIHaTnQ2u58SWmL2JYz1isWmcIqH2dFeWo6i9RJejA== X-GM-GG: ASbGncvvOh/EN3mLH2iRPdFEoedVpwJXUL//9dsiUkxFEgQ0R8BdZPmN4KriZyxGVB3 BiowcEhELohpg8p1dezaW4lcandpSv9zaAcE4pICj0lcOBz17ml35DmVYyBQKtYyjaNTSC/9JPv irGTTjfSOyTZxZrTV8ChXDEOq96MWGzRKv8QYk1qCWuLUh/H44DlD8XFEDgqXRD1or3sGpV3gy+ 7XYcbPS X-Eoptenantattributedmessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0 MIME-Version: 1.0 Errors-To: krb5-bugs-incoming-bounces@mit.edu X-Eopattributedmessage: 0 X-Microsoft-Antispam-Message-Info: oH2tWHsYty4jyH5rAnModydDgLrWD7WsuOm8GgW3WkTpnC4Ww0ap0iO5v1F/636MEiXjJqsI78ZDjTC+wCvI7gf80sWvJWy6tFJGndo45sJ70NCcnXvIn24L2fgz9pypJZohc4UFWQsk8oTcoWWysXhSKqjJn/SWvS9cQqgL1AppDC6hy4QPn1Xi3JjmxYZdwEePRwrFKWe2D6SdFscyydG+xx1Cxvs702nbKJiDN7Xr0wWQcaknb/xq0jyr9RNqXgulasgVze7vAeuud8yKz27zDEsoBn2zUh+GVF9HkaxoXETw7FppP/4HxUflHIsPV5/cU3FgJpTtHWQousc7MaqPab1+PZvOmMIupRuO2+PIXqcyL3veTAhvpPu3SIi3Owx6nxu2lc/YHLOoRi0Lhh9w4EJsjJHQa/HP+h9n9ifLb1Gahe0ozx1qDhaaEmhOrZPf457gZ1rEXrsYEhhbXpz4ZwnMT2Q1oT8EqHFZzWm1Kkrjnk3bX4OOGbr3Dqt5Rx1kxm8VIaLbHN3Su8iS0IzGdIbYiZ8yZvw5K8MFYxZzxBpCcMZxY+bLxNhk0/XkR6NMp1msaYIuhTM95pvstfrEj7/8m4Q6YWPk1KogDk2673/gJOhoX5rv3jEr6I0W+4+r1h9BB67UCIQpQzeJp0GKT91FFJjcJ8Ff5eD8F9P7esi+J9GNVnyK0EHbepouWDbYsgLnmLdT4IYMbzPtZj0KO6gdhPhN9P51RgqXWvlmXZPUmckXGAG7GSkDPAoPrWJHYO6zx33ZkQugKAvm5cejDXK+IFvBLP0WLxaIrcjCJu0OKqC6Ms2/e1xm0cF0FBursnnvSqsv3KTC/2UIKu8EIEw5M9uMWAGwuI6UtAH/a9p+A/EOscgbDVvPvRyjZNoQWGL92vtNLgfs/n6X+KsxmTnPscGCboksdTpLjWIzsMCpilAFIuuwrjlr16wHy4oKoWemDUgz0Dh1eV/owwQaur1Py7uguqV7ioxCX1vE42C3j64cRhbB3nPzHDAM+3UrwcNfPhgUifvk8nFTrqXehRDU35g7/yQNmkpCBKoJXKUicAJ7ivUajPDJMiJNeV16PqIvj74FzXLQ5mWkc58Q3iAca0aII4emsCmL+/RyPjhlJUm64ISAOIxB2sOdEEB591Yo6sYDQ7QApCCsygh3vLIZpxpvRFC5Rz4dBS3o0e2IdiSbteMeTqOY6PNvuqRtXaY7nrPhlLHgmlqhEhQKffqQOY9JgQ+oBTs9X9cchcy/kbx6CTctI45YKgKblRZ/MUEVRYBBEnUAASBz9wKRq7dJHzdMvYlFGzHTQEUosRwoZxQA0bgx85IpxTmt7op/YHlF1kOc2/pvO8QnRWj7/7fTP4enwkx8w+H9GKRHEhtC1QpoGeONwbYHJmjz937w5jxJNdpaT9vOLooE2U1URGG3hQIVYRVrc5sqH0+/Zr+uxyGZJM6FjNlVi4RZ X-Mailman-Version: 2.1.34 Arc-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 2607:f8b0:4864:20::133) smtp.rcpttodomain=mit.edu smtp.mailfrom=gmail.com; dmarc=pass (p=none sp=quarantine pct=100) action=none header.from=gmail.com; dkim=pass (signature was verified) header.d=gmail.com; arc=none (0) X-Received: by 2002:a05:6e02:4419:10b0:3f0:40fd:9d1c with SMTP id e9e14a558f8ab-3f040fd9ecfmr248585ab.9.1756257813250; Tue, 26 Aug 2025 18:23:33 -0700 (PDT) X-MS-Exchange-Crosstenant-Authas: Anonymous X-Externalrecipientoutboundconnectors: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b Precedence: list Subject: bug in kdb5_ldap_util X-Auto-Response-Suppress: DR, OOF, AutoReply X-MS-Exchange-Atpmessageproperties: SA X-Forefront-Antispam-Report: CIP:2607:f8b0:4864:20::133; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:mail-il1-x133.google.com; PTR:mail-il1-x133.google.com; CAT:NONE; SFS:(13230040)(376014)(7093399015)(61400799027)(9140799003)(48200799018)(13003099007); DIR:OUT; SFP:1101; To: krb5-bugs@mit.edu Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=S/B6loT2zCoJ8DuC3ZeYDfLCZcAv1ofzRqhja56POBg=; b=Eimn8TqWwIBSao6OUPsdwe5ek0O9IhT1saocXfHBmbAHNBJZgyDqa6B+oRp1+TL+QGhZwq+cicOSngZxMFSTJkXTYDkpbVdga/HbyPKgBTn47h6vGPBuTK+W7ftef+l5lvl52YJsf9IlNPIj51fRDSp9+cYgOXDUDYx1Rbo7IH8= Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1756257813; x=1756862613; darn=mit.edu; h=content-transfer-encoding:to:subject:message-id:date:from :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=S/B6loT2zCoJ8DuC3ZeYDfLCZcAv1ofzRqhja56POBg=; b=bcXEl6GtiesAd6bYFRHuRyq4sc9Dl9eFJxFZHZ7/0yxTJjOyOeqwvbtkW0Oo2m6CeH n4WneA9z3YzWAwfgRjNzqEd+5BjaGp9+DzuMNhG0cAi+heM3DcRzm33FKlbVi5Vu8kk5 dDbtUneGmXciSqOlWBP5wD3gCCGls3sr/rZnHrZSdeVd+a5h0hD+Gktaxn4jGY4Kmgqw FnVUOJGQovZYAcrS987WAT4z1IClHFfcqi5PLoNngm4uur7kLUfMkkk9fFoSYmoWS6zi nTqFD/KLDAsFbisku0BNtFVqZ24zV3O3JWVkq4JViyMh2erKBkFL3NfaCj7zXgGhG8+1 harw== Message-ID: Dkim-Filter: OpenDKIM Filter v2.11.0 unknown-host (unknown-jobid) Dkim-Filter: OpenDKIM Filter v2.11.0 unknown-host (unknown-jobid) X-MS-Exchange-Crosstenant-Network-Message-ID: 0032104c-9e1a-4c8c-d3cd-08dde5085722 X-RT-Original-Encoding: utf-8 X-RT-Interface: Email Content-Length: 1313 After I install Kerberos with an OpenLDAP backend, I cannot start krb5-admin-server and krb5-kdc due to a malformed stash file. When attempting to start krb5-admin-server, it produces the following error: “Cannot bind to LDAP server ldapi:/// as ‘cn=adm-srv,cn=krbContainer,dc=example,dc=local’: Invalid credentials - while initializing database.” When attempting to start krb5-kdc, it produces the following error: “Cannot bind to LDAP server ldapi:/// as ‘cn=kdc-srv,cn=krbContainer,dc=example,dc=local’: Invalid credentials - while initializing database.” I used the following test.sh Bash script for testing: https://drive.google.com/file/d/1PWNAxH6Y0Sk3vBWd85JheG6DOSjmCFbq/view?usp=sharing The part of this test.sh Bash script that is generating the stash file is as follows: echo -ne "$ADMIN_PASSWORD\n$ADMIN_PASSWORD\n" | kdb5_ldap_util \ -D uid=admin,ou=people,"$LDAP_BASE_DN" -w "$ADMIN_PASSWORD" stashsrvpw \ -f /etc/krb5kdc/service.keyfile cn=kdc-srv,cn=krbContainer,"$LDAP_BASE_DN" echo -ne "$ADMIN_PASSWORD\n$ADMIN_PASSWORD\n" | kdb5_ldap_util \ -D uid=admin,ou=people,"$LDAP_BASE_DN" -w "$ADMIN_PASSWORD" stashsrvpw \ -f /etc/krb5kdc/service.keyfile cn=adm-srv,cn=krbContainer,"$LDAP_BASE_DN" By the way, I am using Ubuntu Server 24.04. Kind regards, Travis Bean