[27703] in Kerberos
Re: Lots of UNKNOWN_SERVER this time... whoa
daemon@ATHENA.MIT.EDU (Russ Allbery)
Mon Apr 23 18:08:29 2007
From: Russ Allbery <rra@stanford.edu>
To: kerberos@mit.edu
In-Reply-To: <462D0963.8090208@kickflop.net> (Jeff Blaine's message of "Mon,
23 Apr 2007 15:30:43 -0400")
Date: Mon, 23 Apr 2007 15:08:19 -0700
Message-ID: <87fy6qsq0c.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Jeff Blaine <jblaine@kickflop.net> writes:
> Stumped again :) Any help would be great. I am clearly doing something
> poorly.
> Alright, I completely nuked my krb5kdc directory and started over from
> scratch with an all-caps realm name. I updated krb5.conf and kdc.conf
> accordingly (beforehand).
> Now a simple SINGLE authentication (which works) + AFS token getting via
> pam_afs_session.so (which works) takes 10 seconds and generates 256
> lines of log information!
Your PAM module seems to be probing for a default realm by trying various
manipulations of your local hostname. Usually this would indicate that
your krb5.conf isn't setting a local realm.
> ==============================================================
> KDC: Solaris 9 + MIT 1.6
> Client: RHELv4 + stock SSH + stock pam_krb5.so + pam_afs_session.so
Does the stock pam_krb5.so on Solaris look for krb5.conf in some different
path than the one that you updated, perhaps?
> Apr 23 15:10:44 kdc.foo.com krb5kdc[12698](info): TGS_REQ (1 etypes {1})
> 129.83.11.213: UNKNOWN_SERVER: authtime 1177355435, jblaine@RCF.FOO.COM
> for afsx/rcf.foo.com@RCF.FOO.COM, Server not found in Kerberos database
> Apr 23 15:10:44 kdc.foo.com krb5kdc[12698](info): TGS_REQ (1 etypes {2})
> 129.83.11.213: UNKNOWN_SERVER: authtime 1177355435, jblaine@RCF.FOO.COM
> for afsx/rcf.foo.com@RCF.FOO.COM, Server not found in Kerberos database
> Apr 23 15:10:44 kdc.foo.com krb5kdc[12698](info): TGS_REQ (1 etypes {3})
> 129.83.11.213: UNKNOWN_SERVER: authtime 1177355435, jblaine@RCF.FOO.COM
> for afsx/rcf.foo.com@RCF.FOO.COM, Server not found in Kerberos database
These are interesting. I've not heard of afsx before. What aklog are you
using?
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
