On ke, 15 elo 2018, Kat wrote:
You were right!
(ok, you were expecting that) - the entry that is failing shows
host/hostname1(a)EXAMPLE.COM
and the entry that works is:
host/hostname1.example.com(a)EXAMPLE.COM
BUT - what I can't figure out is why the request being sent from the
host sometimes shows the correct hostname and sometimes not - again,
this is very random. If I run the exact same command using an ssh
remote command with a keytab file 10 times, the 4th and 8th time it
might fail with: Authentication failed. and the other 8 times it works
perfectly!!
THAT is where I am banging my head against the wall.
That points to a DNS issue
where you are getting qualified/non-qualified
reponses.
May be you have non-FQDN entries in /etc/hosts and when DNS server
doesn't respond promptly you get that one?
On 8/15/18 11:15, Alexander Bokovoy wrote:
>On ke, 15 elo 2018, Kat wrote:
>>I think you missed the point. This only happens randomly, but to
>>clarify - it also lists the host fully qualified.
>Then show the log entries from krb5kdc.log.
>
>>One entry might list the host as
host1.example.com and with a
>>username1 are the principal. The next entry is identical and it
>>throws the error as not in the database. The only difference is
>>random times. It comes from the exact same jobs, but these jobs
>>run hourly for example, and sometimes they fail, sometimes they
>>don't.
>>
>>Does that help at all? I will try to get exact log entries, just
>>have to sanitize them.
>No, it doesn't. You need to show logs. Make sure to differentiate
>between fqdn and non-fqdn in the sanitized logs too.
>
>'Server not found in Kerberos database' is a clear error message that
>says a Kerberos client attempts to obtain a ticket to a service KDC
>doesn't know about. In most cases this is indeed about FQDN/non-FQDN
>hostnames in use.
>
>There are 3 conditions in KDC code for this error:
>- an empty (NULL) target service was requested
>- a target service Kerberos principal was not found
>- a referral to the target service realm was not found
>
>Theoretically, the latter two can be caused by an LDAP driver not being
>able to look the entry for the target service Kerberos principal for
>whatever reasons, but then we could see an error in either krb5kdc.log
>or in the access log of the LDAP server, associated with the connection
>used by the krb5kdc.
>
>>On 8/15/18 10:05, Alexander Bokovoy wrote:
>>>On ke, 15 elo 2018, Kat via FreeIPA-users wrote:
>>>>Hi all --
>>>>
>>>>RHEL 7.5 as of yesterday and 4.5.4-10.el7_5.3 FreeIPA.
>>>>
>>>>I am randomly seeing: Server not found in Kerberos database
>>>>
>>>>for a host that seems to work just fine and understand that
>>>>most of the time you see normal authentications happening for
>>>>this same host, so it is not happening all the time. Looking
>>>>for guidance as to where to look when one sees this kind of
>>>>error popping up in the IPA Server logs.
>>>Can you show exact message from the /var/log/krb5kdc.log on the
>>>IPA master?
>>>
>>>A most likely reason for this is that you have clients configured with
>>>non-fully qualified domain names and asking for tickets to such
>>>servers,
>>>so that you get a request to, say, host/some-hostname@REALM instead of
>>>host/some-hostname.my.domain@REALM.
>>>
>>
>
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland