1

kinit [email protected]
klist -afe

Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: [email protected]
Valid starting Expires Service principal
08/04/11 13:14:53 08/05/11 01:14:53 krbtgt/[email protected]
renew until 08/05/11 13:14:53, Flags: FRI
Etype (skey, tkt): des3-cbc-sha1, des3-cbc-sha1
Addresses: (none)

ldapwhoami -h dc1.windows.domain.tld

SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server ldap/[email protected] not found in Kerberos database)

kvno ldap/[email protected]
ldap/[email protected]: kvno = 65

klist -afe

Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: [email protected]
Valid starting Expires Service principal
08/04/11 13:14:53 08/05/11 01:14:53 krbtgt/[email protected]
renew until 08/05/11 13:14:53, Flags: FRI
Etype (skey, tkt): des3-cbc-sha1, des3-cbc-sha1
Addresses: (none)
08/04/11 13:24:35 08/05/11 01:14:53 krbtgt/[email protected]
renew until 08/05/11 13:14:53, Flags: FRT
Etype (skey, tkt): des-cbc-crc, des-cbc-crc
Addresses: (none)
08/04/11 13:24:35 08/05/11 01:14:53 ldap/[email protected] renew until 08/05/11 13:14:53, Flags: FR
Etype (skey, tkt): arcfour-hmac, arcfour-hmac
Addresses: (none)

ldapwhoami -h dc1.windows.domain.tld

SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server ldap/[email protected] not found in Kerberos database)

2 Answers 2

1

Insufficient domain realm mapping.

Required either
krb5.conf:
[domain_realm]
windows.domain.tld = WINDOWS.DOMAIN.TLD
.windows.domain.tld = WINDOWS.DOMAIN.TLD
or
DNS:
_kerberos.windows.domain.tld. TXT "WINDOWS.DOMAIN.TLD"

Only had DNS:
_kerberos.domain.tld. IN TXT "DOMAIN.TLD"

0

the ldapserver needs to be the first entry in /etc/hosts

192.168.1.5  fqdn.of.your.ad.server some.other.name and.another

If everything is correctly in dns, then remove the line from /etc/hosts all together.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .