Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a problem that has recently broken single sign-on with our Mac clients (10.5 & 10.6) to an OS X Server (10.5). hosts seem to resolve on clients & server both forward & reverse. subnet is behind firewall and using 10.0.1.xxx.

preliminary tests with nslookup seem to be ok.

are there other tests/tools I could be using. External DNS testing websites won't help as this is behind a firewall...

thanks

EDIT: Here's what I did to break things... I manually removed the block of code below for the zone 0.0.10.in-addr.arpa. I have no 10.0.0.xxx subnet and ServerAdmin annoyingly kept adding it. With no other way to get rid of it I followed the advice of this thread. I guess my question now is does OS X Server require 10.0.0.xxx for some reason? for Kerberos? OD? Network still wonky though getting reports that some services are now working!?! Ah DNS, how I love thee....

server:/etc/dns me$ more publicView.conf.apple
acl "com.apple.ServerAdmin.DNS.public" {localnets;};

//
// This is the view that is shown in Server Admin
// This is an automatically generated file.
// PLEASE DO NOT MANUALLY MODIFY THIS FILE!
// Please make your changes in the named.conf file
//

view "com.apple.ServerAdmin.DNS.public" {
//GUID=A37562D4-E056-2DA7-B4AD-3C4973C63824;

        allow-recursion {"com.apple.ServerAdmin.DNS.public";};

        zone "0.0.10.in-addr.arpa." {
                type master;
                file "db.0.0.10.in-addr.arpa.";
                allow-transfer {none;};
                allow-update {none;};
        };


        zone "domain1.com." {
                type master;
                file "db.domain1.com.";
                allow-transfer {none;};
                allow-update {none;};
        };


        zone "1.0.10.in-addr.arpa." {
                type master;
                file "db.1.0.10.in-addr.arpa.";
                allow-transfer {none;};
                allow-update {none;};
        };


        zone "domain2.com." {
                type master;
                file "db.domain2.com.";
                allow-transfer {none;};
                allow-update {none;};
        };

        zone "." {
                type hint;
                file "named.ca";
        };
        zone "localhost" IN {
                type master;
                file "localhost.zone";
                allow-update { none; };
        };

        zone "0.0.127.in-addr.arpa" IN {
                type master;
                file "named.local";
                allow-update { none; };
        };

};
share|improve this question
    
You need to provide more network information. You haven't actually clearly told us what the problem is, nor even why it might be a DNS problem. –  Alnitak Sep 4 '09 at 7:52
    
ya. didn't want to get into that yet. just wanted to know of other tools. but i'll put up some more info when i get a chance. thx. –  Meltemi Sep 4 '09 at 16:15
add comment

1 Answer

Kerberos is picky with Leopard and SSO. To verify your DNS setup do a few of the following with the tool dig

  • Make sure your OD Master Server resolves correctly dig <od.master.fqdn>
  • Take the IP answer from the previous question and plug it in here dig -x <IP> it should resolve to the FQDN of your OD Server
  • Third verify the authority section from both questions above has all your DNS servers listed in it
  • Finally dig your client your signing in from to make sure the forward and reverse answers are correct. (dig == forward dig -x == reverse)

    If everything looks OK, check to make sure kerberos is even running. Go to ServerAdmin->OpenDirectory->Overview. If Kerberos is not running start it up by running.

    launchctl load /System/Library/LaunchDaemons/edu.mit.Kerberos.krb5kdc.plist

    Click refresh in Server Admin, if Kerberos is STILL not running then tail -f /var/log/krb5kdc/kdc.log while executing the above launchctl command. That should give you some more insight as to why Kerberos is not running.

    Without more details on your part, this is all I can give you.

  • share|improve this answer
    add comment

    Your Answer

     
    discard

    By posting your answer, you agree to the privacy policy and terms of service.

    Not the answer you're looking for? Browse other questions tagged or ask your own question.