Package: krb5-admin-server Version: 1.12.1+dfsg-16 Severity: important Tags: patch
The systemd krb5-admin-server.service file is missing the critical directory /etc/krb5kdc used by kadmind in the ReadWriteDirectories stanza. The kerberose default database location is created under /etc/krb5kdc. The location must be writeable. The krb5-admi-server.service file makes it readonly. Attempting to use kadmin to add a kerberos principal will receive the following error at the kadmin prompt: kadmin: add_principal -randkey host/somehost ... add_principal: Insufficient access to lock database while creating "host/someh...@example.com". Workaround: 1) Add /etc/krb5kdc to the ReadWriteDirectories stanza. 2) Restart krb5-admin-server systemd service. -- System Information: Debian Release: 8.0 APT prefers testing-updates APT policy: (500, 'testing-updates'), (500, 'testing') Architecture: i386 (i686) Kernel: Linux 3.16.0-4-686-pae (SMP w/2 CPU cores) Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system)
11c11 < ReadWriteDirectories=/var/tmp /tmp /var/lib/krb5kdc /var/run /run --- > ReadWriteDirectories=/var/tmp /tmp /var/lib/krb5kdc /var/run /run /etc/krb5kdc
