[27720] in Kerberos
Re: Lots of UNKNOWN_SERVER this time... whoa
daemon@ATHENA.MIT.EDU (Jeff Blaine)
Mon Apr 30 14:55:45 2007
Message-ID: <46363BDB.2070609@kickflop.net>
Date: Mon, 30 Apr 2007 14:56:27 -0400
From: Jeff Blaine <jblaine@kickflop.net>
MIME-Version: 1.0
To: kerberos@mit.edu
In-Reply-To: <462E3A4C.2030000@kickflop.net>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
I think I see part of the problem, and don't know who is
to "blame" for it.
The command 'kdb5_util create -r RCF.FOO.COM -s' created
krbtgt/RCF.FOO.COM@RCF.FOO.COM
The authentication process is trying to find
krbtgt/rcf.foo.com@RCF.FOO.COM which does not exist.
Is kdb5_util creating an improperly named krbtgt principal
or is RHELv4 pam_krb5.so improperly naming its requested
principal (lowercasing it)?
Jeff Blaine wrote:
> Hi Russ,
>
> > Your PAM module seems to be probing for a default realm by
> > trying various manipulations of your local hostname. Usually
> > this would indicate that your krb5.conf isn't setting a local
> > realm.
>
> Here's /etc/krb5.conf. Using 'kinit jblaine' asks me for
> the password for jblaine@RCF.FOO.COM, so I believe it is
> using krb5.conf fine.
>
> [libdefaults]
> default_realm = RCF.FOO.COM
> forwardable = yes
>
> [appdefaults]
> forwardable = yes
>
> [domain_realm]
> .foo.com = RCF.FOO.COM
> foo.com = RCF.FOO.COM
>
> [realms]
> RCF.FOO.COM = {
> kdc = kdc.foo.com
> admin_server = kdc.foo.com
> }
>
> [logging]
> kdc = FILE:/var/adm/krb5kdc.log
> admin_server = FILE:/var/adm/kadmin.log
> default = FILE:/var/adm/krb5lib.log
>
> > Does the stock pam_krb5.so on Solaris look for krb5.conf in
> > some different path than the one that you updated, perhaps?
>
> The only Solaris box in the picture is the KDC, kdc.foo.com.
>
> pam_krb5.so is in use on the client, rcf-kerbtest-linux.foo.com
> (aka 129.83.11.213).
>
> All pam_krb5.so modules in use are stock.
>
> >> Apr 23 15:10:44 kdc.foo.com krb5kdc[12698](info): TGS_REQ
> >> (1 etypes {3}) 129.83.11.213: UNKNOWN_SERVER: authtime 1177355435,
> >> jblaine@RCF.FOO.COM for afsx/rcf.foo.com@RCF.FOO.COM, Server not
> >> found in Kerberos database
> >
> > These are interesting. I've not heard of afsx before. What aklog
> > are you using?
>
> Interesting indeed. OpenAFS 1.4.3 aklog.
>
> I just found the reference in the RHELv4 pam_krb5.so
> on the client box:
>
> # strings /lib/security/pam_krb5.so | grep afsx
> afsx
> #
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
