[33685] in Kerberos
KDC TGS_REQ ticket expired log message has no client or server info
daemon@ATHENA.MIT.EDU (Chris Hecker)
Thu Jul 28 05:45:48 2011
Message-ID: <4E312FBF.8050001@d6.com>
Date: Thu, 28 Jul 2011 02:45:35 -0700
From: Chris Hecker <checker@d6.com>
MIME-Version: 1.0
To: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
A typical failed TGS_REQ for an expired ticket looks like this:
Jul 28 04:28:17 example.com krb5kdc[14031](info): TGS_REQ (1 etypes
{18}) 1.1.1.1: PROCESS_TGS: authtime 0, <unknown client> for <unknown
server>, Ticket expired
This is slightly less than useful for finding which client is submitting
expired TGTs.
rd_req_decoded_opt computes the enc_part2->client, but then immediately
toasts it on error out.
It's pretty deep down so I guess it'd be a pain to fix, but it's a
shame, since the information for a good error is computed, it's just
thrown away too early.
Thoughts?
Chris
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
