Check the time skew
Hooshang
Zaakarij Selassij wrote:
>
> Hello, I have been trying to get Sun's packaged version of Kerberos (SEAM) running
>on a pair of Sun Netras for nearly 2 weeks now with only partial success and was
>hoping someone could provide some insight to my problem.
>
> Here's the deal:
>
> Kerberos at first seemed to be running correctly on the two systems as I could issue
>tickets and authenticate users and hosts without issue. But when I called kadmin to
>create some default passwd policies, syslog reported the following error on the local
>machines:
>
> #########################
> root@kerberos2> kadmin
> Enter Password:
> kadmin: GSS-API (or Kerberos) error while initializing kadmin interface
> Apr 13 17:38:00 kerberos2-ams kadmin[359]: [ID 824607 user.error] GSS-API error :
>rpc_gss_seccreate failed
> Apr 13 17:38:00 kerberos2-ams kadmin[359]: [ID 824607 user.error] GSS-API error :
>The routine completed successfully
> Apr 13 17:38:00 kerberos2-ams kadmin[359]: [ID 824607 user.error] GSS-API error :
>rpc_gss_seccreate failed
> Apr 13 17:38:00 kerberos2-ams kadmin[359]: [ID 824607 user.error] GSS-API error : No
>error
>
> root@kerberos1> kadmin
> Enter Password:
> Apr 13 17:38:26 kerberos1-ams kadmin[2819]: [ID 824607 user.error] GSS-API error :
>rpc_gss_seccreate failed
> Apr 13 17:38:26 kerberos1-ams kadmin[2819]: [ID 824607 user.error] GSS-API error :
>The routine completed successfully
> Apr 13 17:38:26 kerberos1-ams kadmin[2819]: [ID 824607 user.error] GSS-API error :
>rpc_gss_seccreate failed
> Apr 13 17:38:26 kerberos1-ams kadmin[2819]: [ID 824607 user.error] GSS-API error :
>No error
>
> (NOTE: kerberos1-ams is the KDC and kerberos2-ams is a client)
> #########################
>
> The same syslog error appears when I call 'kpasswd', but I receive a different , yet
>similar, error printed to screen:
>
> #########################
> root@kerberos1> kpasswd
> kpasswd: Changing password for [EMAIL PROTECTED]
> Old password:
> kpasswd: Cannot establish a session with the Kerberos administrative server
>fornrealm TEST.REALM.ORG. GSS-API (or Kerberos) error.
> #########################
>
> I checked the KDC's modinfo to ensure that the appropriate kernel modules were
>loaded, and, much to my surprise, the only module I could see that related to
>security was the standard rpcsec module:
>
> #########################
> root@kerberos1> modinfo |grep sec
> 83 10331c47 4d9b - 1 rpcsec (kernel RPC security module.)
> #########################
>
> So, I manually loaded what I believe are the appropriate modules:
>
> #########################
> 103 102d3877 3d50 - 1 rpcsec_gss (kernel RPCSEC_GSS security ser
> 104 102d73f7 5b96 - 1 kgssapi (in-kernel GSSAPI)
> 07 102b87f8 be73 - 1 do_kmech_krb5 (in-kernel Krb5 GSS mechanis
> 108 78034000 bdf3 - 1 gl_kmech_krb5 (in-kernel Krb5 GSS mechanis
> ########################
>
> This had no effect whatsoever. All relevant patches are already on the system, so
>the problem does not lie there. RPC services and the kerberos daemons are running as
>well:
>
> #########################
> root@kerberos1-ams> ps -ef |grep rpc
> root 109 1 0 Apr 11 ? 0:00 /usr/sbin/rpcbind
>
> root@kerberos1-ams> ps -ef |grep krb5
> root 249 1 0 Apr 11 ? 0:00 /usr/krb5/lib/kadmind
> root 254 1 0 Apr 11 ? 0:00 /usr/krb5/lib/krb5kdc
> #########################
>
> The configuration files all seem to be in working order as well. Here is a list of
>pertinent packages on the systems:
>
> #########################
> ---here are the SEAM-installed packages---
> system SUNWk5pk kernel Kerberos V5 plug-in w/auth+privacy (32-bit)
> system SUNWk5pkx kernel Kerberos V5 plug-in w/auth+privacy (64-bit)
> system SUNWk5pu user Kerberos V5 gss mechanism w/auth+privacy (32-bit)
> system SUNWk5pux user Kerberos V5 gss mechanism w/auth+privacy (64-bit)
> system SUNWkr5ad Kerberos V5 Administration Tools
> system SUNWkr5cl Kerberos V5 clients
> system SUNWkr5ma Kerberos V5 Master KDC
> system SUNWkr5mn SEAM Manual Pages
> system SUNWkr5sl Kerberos V5 Slave KDC
> system SUNWkr5sv Kerberized Network Services
>
> ---and here are the GSS packages---
>
> system SUNWgsdhx GSS Diffie-Hellman (64-bit)
> system SUNWgss GSSAPI V2
> system SUNWgssc GSSAPI CONFIG V2
> system SUNWgssdh GSS Diffie-Hellman
> system SUNWgssk kernel GSSAPI V2
> system SUNWgsskx kernel GSSAPI V2 (64-bit)
> system SUNWgssx GSSAPI V2 (64-bit)
> system SUNWrsg RPCSEC_GSS
> system SUNWrsgk kernel RPCSEC_GSS
> system SUNWrsgx RPCSEC_GSS (64-bit)
> #########################
>
> One last error worth mentioning is with the use of' 'gsscred':
>
> #########################
> root@kerberos1-ams> gsscred -l
> Error searching gsscred table [Operation not Supported: 'gsscred'].
>
> root@kerberos1-ams> gsscred -m kerberos_v5 -a
> Error adding user [root, kerberos_v5].
> Operation not Supported: 'gsscred'
> #########################
>
> Perhaps there has been something that I have missed altogether? Has anyone had any
>experiences similar to this? I rather new to kerberos, so any help here would be
>greatly appreciated.
>
> -Zaakarij
> ________________________________________________
> Kerberos mailing list [EMAIL PROTECTED]
> http://mailman.mit.edu/mailman/listinfo/kerberos
________________________________________________
Kerberos mailing list [EMAIL PROTECTED]
http://mailman.mit.edu/mailman/listinfo/kerberos
