Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm attempting to connect Kerio to an Open Directory instance. I'm using kinit to test the setup, and I get the following:

$ kinit -V -S host/server.domain.co.uk@server.domain.co.uk igor@server.domain.co.uk
Please enter the password for igor@server.domain.co.uk:
Kerberos Login Failed: Cannot resolve network address for KDC in requested realm

This occurs, even though I am 100% sure that the password is correct. Either way, I am more concerned with regards to the part of the message that says

Kerberos Login Failed: Cannot resolve network address for KDC in requested realm

From the server running OD, and a second in house server I get the same error message. I can dig and ping server.domain.co.uk correctly from both servers, so it boggles my mind what could be wrong.

I need this to be working before I can move forward and connect up the Kerio instance to my OD.

edu.mit.kerberos

[libdefaults]
    default_realm = SERVER.domain.CO.UK
[realms]
    SERVER.domain.CO.UK = {
        admin_server = server.domain.co.uk
        kdc = server.domain.co.uk
    }
[domain_realm]
    domain.co.uk = SERVER.domain.CO.UK
    .domain.co.uk = SERVER.domain.CO.UK
[logging]
    admin_server = FILE:/var/log/krb5kdc/kadmin.log
    kdc = FILE:/var/log/krb5kdc/kdc.log

SERVER is the real hostname for the machine in question, and domain.co.uk is my FQDN, or at least replacing my FQDN

Thanks for any assistance.

share|improve this question
    
could you show your client krb5.conf? i believe it should be placed the on /etc/ dir. –  cikuraku May 21 '12 at 13:57
    
I'm not trying to get a client to authenticate just yet, I was trying to check that the OD server can fulfil requests first. –  Mister IT Guru May 21 '12 at 14:08
    
ok then, could you please show your realms/hosts on the krb database? –  cikuraku May 21 '12 at 14:24
    
I've edited my question to reflect the config –  Mister IT Guru May 21 '12 at 16:37

4 Answers 4

The kerberos principal is username@realm, not username@domain, and the realm is case-sensitive, so please try your kinit for igor@SERVER.domain.CO.UK, capitalized exactly the way you have the realm capitalized in your conf.

The subtle distinction between server and realm is why your error is so hard to interpret - what it's trying to say is "I don't know what the server address would be for that REALM - I can't match that REALM to anything in the conf file."

share|improve this answer
    
Nada's right about that too. –  John K May 29 '12 at 18:44
    
When I use the setup in the config file to run kinit on a desktop computer, I still get an authentication error, but on the server itself, when using the kerberos utility, it authenticates locally, so, I'm wondering which bit is broken.... –  Mister IT Guru Jun 14 '12 at 12:42
    
I think your kinit command is broken. If your config is exactly like in your question, you must do igor@SERVER.domain.CO.UK , with exactly that capitalization. If you have already tried that and are still having problems, please confirm that your config file above is exactly correct and please confirm what kinit command you're using. –  Nada Jun 14 '12 at 14:30
    
I'm using kinit from my mac book terminal, (remote) the server terminal (local) - both fail even when using using that I know the password to. –  Mister IT Guru Jun 15 '12 at 9:54

It looks like your REALM and KDC declarations might be a little off.

I could be wrong, but I'm thinking instead of

[libdefaults]

default_realm = SERVER.domain.CO.UK

[realms]

SERVER.domain.CO.UK = {

admin_server = server.domain.co.uk

kdc = server.domain.co.uk }

You'd want to put

[libdefaults]

default_realm = domain.CO.UK

[realms]

domain.CO.UK = {

admin_server = server.domain.co.uk

kdc = server.domain.co.uk }

share|improve this answer
    
I thought that it should be like that!? Why does the apple wizard/help app set it up wrongly? <ignore last question, it's more of a rant> –  Mister IT Guru May 25 '12 at 11:48
    
Yeah, I can understand that feeling. I've always had mixed success with the various wizards and configuration tools too, unfortunately. It's always so tempting to not have to open the actual file, unfortunately that's usually what ends up needing to be done anyway. Hope that helps! –  John K May 25 '12 at 14:27
    
I've manually made the changes to this file and restarted the server - It came back up running the same configuration as it previously was. Using the Server Admin tool, it still claims the realm is server.domain.co.uk ? I've edited the correct config file in /Library/Preferences is there another place that the configuration is taken from?? I'm running 10.5.8 - I'm starting to tear my hair out with this one! –  Mister IT Guru Jun 14 '12 at 12:39
[libdefaults]
default_realm = domain.CO.UK

[realms]
domain.CO.UK = {
  admin_server = server.domain.co.uk
  kdc = server.domain.co.uk
}
share|improve this answer
    
Could you explain this answer a little bit more? –  slm Jun 9 '13 at 0:05

add this in krb5.ini :

dns_lookup_kdc = true
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.