Long story short, we had to redeploy part of our FreeIPA cluster. As far as
I know I followed all of the proper procedures and everything seems to be
working from the client side however we are getting a TON of these messages
in krb5kdc.log
ipa3.example.com krb5kdc[31232](info): TGS_REQ (8 etypes {18 17 20 19 16 23
25 26}) 10.6.21.19: LOOKING_UP_SERVER: authtime 0, host/
client100.example.com(a)EXAMPLE.COM for nfs/nfs1.example.com(a)EXAMPLE.COM,
Server not found in Kerberos database
client100.example.com has working forward and reverse DNS entries that
resolve from all FreeIPA servers and from itself.
nfs1.example.com has working forward and reverse entries that resolve from
all FreeIPA servers and from itself, it is not part of the FreeIPA domain
at all, it is still using the authentication we are replacing with FreeIPA.
It is used for automount homedirs in FreeIPA but is not kerberized
All of the clients reporting this error still properly automount homedirs
and that is the only thing on
nfs1.example.com. There is another
mountpoint, also not kerberized, in the automount setup that is not
throwing any errors and access extremely frequently.
I am happy to provide any logs necessary to track this down.
--
*Mark Potter*