[2655] in Kerberos-V5-bugs
Re: pending/362: Frustrated!! Is there anyone reading this mail list?
daemon@ATHENA.MIT.EDU (Theodore Y. Ts'o)
Tue Feb 4 14:06:34 1997
Date: Tue, 4 Feb 1997 14:05:31 -0500
From: "Theodore Y. Ts'o" <tytso@MIT.EDU>
To: krb5-bugs@MIT.EDU, petals@girlswear.com
Cc: gnats-admin@RT-11.MIT.EDU, krb5-prs@RT-11.MIT.EDU
In-Reply-To: Michael Robinton's message of Tue, 4 Feb 1997 11:02:02 -0500,
<199702041602.LAA20951@rt-11.MIT.EDU>
Try running the test program found in test/resolve/resolve.c. My guess
is that that your name resolver code on your OS is not working
correctly, so that when kprop tries to determine what name it should try
to get initial tickets as (by using gethostname, and then gethostbyname
and gethostbyaddr to get its fully qualified domain name), it's getting
the wrong result.
If this indeed is the problem, it can be fixed under Solaris by editing
/etc/hosts so that in the line which has the hostname and IP address for
the local host, the first hostname on that line is the fully-qualified
domain name (in lower case). Other platforms may require other fixes;
the surefire one is to get the real name resolver library from the BIND
distribution, and link that into your Kerberos programs, thus avoiding
the broken OS resolver libraries. (This won't quite work if you're
using Yellow Pages or NIS, but if you are, you've got other problems ---
like the fact that you're using YP or NIS. :-)
The other way you can see what's going on is to look at KDC log (in
krb5kdc.log) and see what principal kprop was trying to get initial
tickets for when the KDC returned an error. My suspicion is that you'll
find that it's because it's trying to get a ticket for
host/kmaster@PETALSHOME.COM, or host/pandora@PETALSHOME.COM, or
host/pandora.petalshome.com@PETALSHOME.COM, or something else indicating
a failure in the your OS resolver library. (At which point see the
previous paragraph for some more direct ways of diagnosing the problem.)
Good luck! I hope this helps.
- Ted
