Hi Russ, > Your PAM module seems to be probing for a default realm by > trying various manipulations of your local hostname. Usually > this would indicate that your krb5.conf isn't setting a local > realm.
Here's /etc/krb5.conf. Using 'kinit jblaine' asks me for the password for [EMAIL PROTECTED], so I believe it is using krb5.conf fine. [libdefaults] default_realm = RCF.FOO.COM forwardable = yes [appdefaults] forwardable = yes [domain_realm] .foo.com = RCF.FOO.COM foo.com = RCF.FOO.COM [realms] RCF.FOO.COM = { kdc = kdc.foo.com admin_server = kdc.foo.com } [logging] kdc = FILE:/var/adm/krb5kdc.log admin_server = FILE:/var/adm/kadmin.log default = FILE:/var/adm/krb5lib.log > Does the stock pam_krb5.so on Solaris look for krb5.conf in > some different path than the one that you updated, perhaps? The only Solaris box in the picture is the KDC, kdc.foo.com. pam_krb5.so is in use on the client, rcf-kerbtest-linux.foo.com (aka 129.83.11.213). All pam_krb5.so modules in use are stock. >> Apr 23 15:10:44 kdc.foo.com krb5kdc[12698](info): TGS_REQ >> (1 etypes {3}) 129.83.11.213: UNKNOWN_SERVER: authtime 1177355435, >> [EMAIL PROTECTED] for afsx/[EMAIL PROTECTED], Server not >> found in Kerberos database > > These are interesting. I've not heard of afsx before. What aklog > are you using? Interesting indeed. OpenAFS 1.4.3 aklog. I just found the reference in the RHELv4 pam_krb5.so on the client box: # strings /lib/security/pam_krb5.so | grep afsx afsx # ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos