PLANNED MAINTENANCE

Hello, DataStax Community!

We want to make you aware of a few operational updates which will be carried out on the site. We are working hard to streamline the login process to integrate with other DataStax resources. As such, you will soon be prompted to update your password. Please note that your username will remain the same.

As we work to improve your user experience, please be aware that login to the DataStax Community will be unavailable for a few hours on:

  • Wednesday, July 15 16:00 PDT | 19:00 EDT | 20:00 BRT
  • Thursday, July 16 00:00 BST | 01:00 CEST | 04:30 IST | 07:00 CST | 09:00 AEST

For more info, check out the FAQ page. Thank you for being a valued member of our community.

question

Erick Ramirez avatar image
Erick Ramirez asked ·

Why does cqlsh result in a Kerberos error "LoginException: Message stream modified (41)" ?

When trying to connect to a Kerberos-enabled cluster running on CentOS 7.x with cqlsh, a login exception is thrown and the following error is logged in system.log:

ERROR [IOThread-0] 2020-03-04 05:42:32,069  DseAuthenticator.java:778 - Error obtaining subject for server identity
javax.security.auth.login.LoginException: Message stream modified (41)
    at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:808)
    at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:618)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at javax.security.auth.login.LoginContext.invoke(LoginContext.java:755)
    at javax.security.auth.login.LoginContext.access$000(LoginContext.java:195)
    at javax.security.auth.login.LoginContext$4.run(LoginContext.java:682)
    at javax.security.auth.login.LoginContext$4.run(LoginContext.java:680)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
    at javax.security.auth.login.LoginContext.login(LoginContext.java:587)
    at com.datastax.bdp.transport.server.KerberosServerUtils.loginServer(KerberosServerUtils.java:36)
    at com.datastax.bdp.cassandra.auth.DseAuthenticator$GSSAPISaslNegotiator.(DseAuthenticator.java:774)
    at com.datastax.bdp.cassandra.auth.DseAuthenticator.getSaslNegotiatorForScheme(DseAuthenticator.java:682)
    at com.datastax.bdp.cassandra.auth.DseAuthenticator.access$400(DseAuthenticator.java:100)
    at com.datastax.bdp.cassandra.auth.DseAuthenticator$UnifiedSaslNegotiator.evaluateResponse(DseAuthenticator.java:513)
    ...
Caused by: sun.security.krb5.internal.KrbApErrException: Message stream modified (41)
    at sun.security.krb5.KrbKdcRep.check(KrbKdcRep.java:101)
    at sun.security.krb5.KrbAsRep.decrypt(KrbAsRep.java:159)
    at sun.security.krb5.KrbAsRep.decryptUsingKeyTab(KrbAsRep.java:121)
    at sun.security.krb5.KrbAsReqBuilder.resolve(KrbAsReqBuilder.java:308)
    at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:447)
    at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:780)
    ... 31 common frames omitted
securitycentoskerberos
10 |1000 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

1 Answer

Erick Ramirez avatar image
Erick Ramirez answered ·

Background

There is an issue with CentOS 7 that prevents applications from authenticating successfully with Kerberos. A quick internet search shows that the problem affects lots of different applications and is widespread. The issue is reported as a bug on CentOS and is tracked as defect ID #17000.

Workaround

Users have reported that removing the renew_lifetime parameter from the Kerberos configuration file /etc/krb5.conf allows applications to authenticate successfully. For example, remove the line:

 renew_lifetime = 7d

from the [libdefaults] section:

[libdefaults]
 default_realm = TEST.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

As stated above, this issue affects various applications and isn't specific to DataStax Enterprise or Apache Cassandra. The root cause is not completely understood so there is no available fix at the time of writing.

References

The workaround above is also documented in the DataStax Support KB article #360006872038.

Share
10 |1000 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.