selinux?
On 12/17/2014 03:12 PM, Braden McDaniel wrote:
I upgraded a Kerberos server box from Fedara 20 to 21. Since doing so,
other Fedora machines (which are still using Fedora 20) can no longer
authenticate:
$ kinit
kinit: Cannot contact any KDC for realm 'ENDOFRAME.NET' while getting
initial credentials
On the server:
# systemctl status krb5kdc
● krb5kdc.service - Kerberos 5 KDC
Loaded: loaded (/etc/systemd/system/krb5kdc.service; enabled)
Active: active (running) since Tue 2014-12-16 08:27:54 EST; 24h ago
Process: 22776 ExecStart=/usr/sbin/krb5kdc -P /var/run/krb5kdc.pid
$KRB5KDC_ARGS (code=exited, status=0/SUCCESS)
Main PID: 22777 (krb5kdc)
CGroup: /system.slice/krb5kdc.service
└─22777 /usr/sbin/krb5kdc -P /var/run/krb5kdc.pid
And I'm able to kinit just fine locally on the server.
I've tried completely disabling firewalls; that didn't help.
/var/log/krb5kdc.log on the server looks like this:
otp: Loaded
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](Error): preauth
pkinit failed to initialize: No realms configured correctly for pkinit
support
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): setting up
network...
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): listening
on fd 12: udp 0.0.0.0.88 (pktinfo)
krb5kdc: setsockopt(13,IPV6_V6ONLY,1) worked
krb5kdc: Invalid argument - Cannot request packet info for udp socket
address :: port 88
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): skipping
unrecognized local address family 17
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): skipping
unrecognized local address family 17
krb5kdc: setsockopt(13,IPV6_V6ONLY,1) worked
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): listening
on fd 13: udp fe80::21c:c0ff:fedf:4b55%eth0.88
krb5kdc: setsockopt(14,IPV6_V6ONLY,1) worked
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): listening
on fd 15: tcp 0.0.0.0.88
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): listening
on fd 14: tcp ::.88
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): set up 4
sockets
Dec 16 08:27:54 knock.endoframe.net krb5kdc[22777](info): commencing
operation
Dec 17 08:52:59 knock.endoframe.net krb5kdc[22777](info): AS_REQ (6
etypes {18 17 16 23 25 26}) 192.168.1.10: ISSUE: authtime 1418824379,
etypes {rep=18 tkt=18 ses=18}, braden@xxxxxxxxxxxxx for
krbtgt/ENDOFRAME.NET@xxxxxxxxxxxxx
Where should I be looking?
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
