selinux? On 12/17/2014 03:12 PM, Braden McDaniel wrote:
I upgraded a Kerberos server box from Fedara 20 to 21. Since doing so, other Fedora machines (which are still using Fedora 20) can no longer authenticate:$ kinit kinit: Cannot contact any KDC for realm 'ENDOFRAME.NET' while getting initial credentials On the server: # systemctl status krb5kdc ● krb5kdc.service - Kerberos 5 KDC Loaded: loaded (/etc/systemd/system/krb5kdc.service; enabled) Active: active (running) since Tue 2014-12-16 08:27:54 EST; 24h ago Process: 22776 ExecStart=/usr/sbin/krb5kdc -P /var/run/krb5kdc.pid $KRB5KDC_ARGS (code=exited, status=0/SUCCESS) Main PID: 22777 (krb5kdc) CGroup: /system.slice/krb5kdc.service └─22777 /usr/sbin/krb5kdc -P /var/run/krb5kdc.pid And I'm able to kinit just fine locally on the server. I've tried completely disabling firewalls; that didn't help. /var/log/krb5kdc.log on the server looks like this: otp: Loaded Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](Error): preauth pkinit failed to initialize: No realms configured correctly for pkinit support Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): setting up network... Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): listening on fd 12: udp 0.0.0.0.88 (pktinfo) krb5kdc: setsockopt(13,IPV6_V6ONLY,1) worked krb5kdc: Invalid argument - Cannot request packet info for udp socket address :: port 88 Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): skipping unrecognized local address family 17 Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): skipping unrecognized local address family 17 krb5kdc: setsockopt(13,IPV6_V6ONLY,1) worked Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): listening on fd 13: udp fe80::21c:c0ff:fedf:4b55%eth0.88 krb5kdc: setsockopt(14,IPV6_V6ONLY,1) worked Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): listening on fd 15: tcp 0.0.0.0.88 Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): listening on fd 14: tcp ::.88 Dec 16 08:27:54 knock.endoframe.net krb5kdc[22776](info): set up 4 sockets Dec 16 08:27:54 knock.endoframe.net krb5kdc[22777](info): commencing operation Dec 17 08:52:59 knock.endoframe.net krb5kdc[22777](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 192.168.1.10: ISSUE: authtime 1418824379, etypes {rep=18 tkt=18 ses=18}, bra...@endoframe.net for krbtgt/endoframe....@endoframe.net Where should I be looking?
-- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
