[38642] in Kerberos
Re: Decrypt integrity check failed while getting initial ticket
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Dec 9 16:57:13 2019
To: "Stephen Carville (Kerberos List)" <b44261a2@opayq.com>,
<kerberos@mit.edu>
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <2af42cb4-31b3-8fed-5f8d-effca770054a@mit.edu>
Date: Mon, 9 Dec 2019 16:56:35 -0500
MIME-Version: 1.0
In-Reply-To: <ed3b1f90-bd01-2797-43ae-1215395aeff3@opayq.com>
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 12/9/19 1:04 PM, Stephen Carville (Kerberos List) wrote:
> Recently I migrated the kerberos master and one slave to another
> location using tool called "Zerto". Perhaps coincidentally, replication
> broke with the above error message. I checked that DNS A and PTR records
> for all the servers are correct. I can get a ticket using kinit (kinit
> -k host/<hostname>). I finally recreated the keytab file
> (/etc/krb5.keytab) and propagated it to the other three servers. Still
> no replication.
I suggest running "KRB5_TRACE=/dev/stdout kprop ..." to get a better
idea of what ticket it's trying to get. It should be doing something
similar to "kinit -k host/hostname", but if you've just migrated hosts,
there could be a difference in the canonical hostname as it appears to
libkrb5.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
