illumos gate

Notes from testing krb5 pkinit preauth.

bloody# klist
klist: No credentials cache file found (ticket cache FILE:/tmp/krb5cc_0)

bloody# kinit bloody.omniosce.org
Apr 13 20:04:54 bloody krb5kdc[7503](info): AS_REQ (7 etypes {18 17 16 23 24 3 1}) 172.27.10.9: NEEDED_PREAUTH: bloody.omniosce.org@OMNIOSCE.ORG for krbtgt/OMNIOSCE.ORG@OMNIOSCE.ORG, Additional pre-authentication required
Apr 13 20:04:54 bloody krb5kdc[7503](info): AS_REQ (7 etypes {18 17 16 23 24 3 1}) 172.27.10.9: ISSUE: authtime 1523649894, etypes {rep=18 tkt=18 ses=18}, bloody.omniosce.org@OMNIOSCE.ORG for krbtgt/OMNIOSCE.ORG@OMNIOSCE.ORG

bloody# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: bloody.omniosce.org@OMNIOSCE.ORG

Valid starting                Expires                Service principal
04/13/18 20:04:54  04/14/18 04:04:54  krbtgt/OMNIOSCE.ORG@OMNIOSCE.ORG
        renew until 04/20/18 20:04:54

Testing notes for kmf openssl backend:

DSA & RSA import

bloody% pktool import keystore=file infile=rsa.p12 outkey=l.pem outcert=ll.pem
Enter password to use for accessing the PKCS12 file:
Found 1 certificate(s) and 1 key(s) in rsa.p12

bloody% pktool import keystore=file infile=dsa.p12 outkey=l.pem outcert=ll.pem
Enter password to use for accessing the PKCS12 file:
Found 1 certificate(s) and 1 key(s) in dsa.p12

Certificate/key creation:

for type in rsa dsa; do
        pktool gencert keystore=file \
                outcert=$certs/$type-cert.pem \
                outkey=$certs/$type-key.pem \
                serial=1 \
                subject="CN=illumos tester" \
                format=pem \
                keytype=$type \
                keylen=2048 \
                lifetime=1-year
done