Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm unable to make working a simple configuration written in Samba Wiki. NSLCD worked fine, when authentized by name and password. But I have no idea, what can I do wrong when following that simple how-to. It always fails, when using Kerberos, saying: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not fou... (That mean Server not found in Kerberos database, it thing). I though, that there must be somthing wrong in some machine name. This experiment I'm doing on the same machine the Samba runs on. So probably the machine is identified as localhost. I added several SPNs, but it does not work.

$ samba-tool spn list ldap-connect
User CN=ldap-connect,CN=Users,DC=barbucha,DC=local has the following servicePrincipalName: 

My problem is, that I don't know actually, what I'm exactly doing. I need some explanation, how these things works. (And they do work. I found several post, where people had this thing functional.) Why several post suggest to use HOST/machine principal, some of them host/machine and the Samba Wiki nslcd/machine? Why are these SPN always bound to exactly one user principal? Is there somebody, who knows, what exactly do and why? How do I get the right machine name?

The main problem is, that if I'm unable to make this work, then I'm unable to kerberize any service and Kerberos is good just to distribute some useless tickets.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.