[rstasel]

further info…

After killing all the files and entries I listed before, I rebooted and noticed kdcmond was still trying to load. So I ran `launchctl unload -w /System/Library/LaunchDaemons/com.apple.kdcmond.plist`. That seemed to fix that. Figuring it might be preventing something with the mkpassdb process from running smoothly.

Nada. Running the command again gives the same problem.

The interesting part is that mkpassdb is running in ps aux, and top shows it using 0.2% cpu. But `fs_usage mkpassdb` shows only a couple entries after running for over 10 minutes… so if it’s doing something, it’s doing it VERY slowly.

[rstasel]

I should be more specific. There is a krb5kdc process running with the proper realm, and a kdcmond also running.

I let mkpassdb -kerberize that was called from slapconfig run overnight, and it has still not produced any output. Wish it was just a script so I could go in there and debug it/add some verbosity.

I almost wonder if mkpassdb starts before kerberos has a chance to start up after kdcsetup, etc.

[rstasel]

I’m not sure I understand. From what I can see, stuff looks fine in kadmin.local. And running ps aux shows a kdc process running, as well as serveradmin saying kerberos is running.

So, not sure I know what to look for, or how to recognize, if something isn’t working… all I can really tell is mkpassdb -kerberize is stuck when it’s called from slapconfig. If I open up a new terminal, and run mkpassdb -kerberize myself, it works fine, and runs through about 13k worth of passdb entries.

[rstasel]

So here’s what I get from the slapconfig -kerberize.

ldap:~ root# slapconfig -kerberize -f diradmin REALM.EXAMPLE.COM
diradmin's Password:
command: /sbin/kerberosautoconfig -r REALM.EXAMPLE.COM -m server.example.com -u -v 1
command: /usr/sbin/kdcsetup -f /LDAPv3/127.0.0.1 -w -a diradmin -p **** -v 1 REALM.EXAMPLE.COM
kdcsetup command output:
Contacting the Directory Server
Authenticating to the Directory Server
Creating Kerberos directory
Creating KDC Config File
Creating Admin ACL File
Creating Kerberos Master Key
Creating Kerberos Database
Creating Kerberos Admin user
WARNING: no policy specified for diradmin@REALM.EXAMPLE.COM; defaulting to no policy
Adding kerberos auth authority to admin user
Creating keytab for the admin tools
Adding KDC & kadmind to launchd
edu.mit.kadmind: Already loaded
com.apple.kdcmond: Already loaded
Adding the new KDC into the KerberosClient config record
Finished
command: /usr/sbin/sso_util configure -r REALM.EXAMPLE.COM -f /LDAPv3/127.0.0.1 -a diradmin -p **** -v 1 all
sso_util command output:
Contacting the directory server
Creating the service list
Creating the service principals
WARNING: no policy specified for fcsvr/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for pcast/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for vnc/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for cifs/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for ldap/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for xgrid/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for vpn/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for ipp/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for xmpp/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for XMPP/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for host/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for smtp/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for nfs/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for http/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for HTTP/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for pop/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for imap/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for ftp/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
WARNING: no policy specified for afpserver/server.example.com@REALM.EXAMPLE.COM; defaulting to no policy
Creating the keytab file
Configuring services
WriteSetupFile: setup file path = /temp.oEqc/setup

command: /sbin/kerberosautoconfig -u -v 1
command: /usr/sbin/mkpassdb -kerberize

And there it stays. Kerberos does seem to be running, and a listprincs in kadmin.local does result in meaningful output. But, I’m still where I started, with many users not having kerberos authentication authority info in their user record, just an ApplePasswordServer record.

Please help.

[rstasel]

Okay, so I’ve gotten this to go a bit further, but I’m still stuck.

What I had to do was:
rm /var/db/krb5kdc, /etc/krb5kdc.keytab, /Library/Preferences/edu.mit.kerberos, /var/db/dslocal/nodes/Default/config/Kerberos:REALM

Then, go into WGM, go into inspector, then config for /LDAPv3/127.0.0.1, and kill the KerberosKDC, and KerberosClient.

That seems to be EVERYTHING related to kerberos.

Then if I run slapconfig -kerberize -f diradmin REALM.NAME.COM, it runs through fine until it gets to mkpassdb -kerberize, where it seems to hang. Yet, I can run mkpassdb -kerberize myself just fine.

Once it hangs at that step, it doesn’t do anything else. Meaning it doesn’t go through and fix the user records that don’t have kerberos authentication entries.

After doing all of the above, with removing kerberos, I also can see the “kerberize” button in SA under Open Directory, but hitting that seems to just run slapconfig -kerberize. It hangs in the same spot.

So, I’m stuck. Does anyone have any suggestions? MacTroll?

btw, this is on a 10.5.6 server. changeip -checkhostname comes back clean. I’ve also tried running through this: http://www.makemacwork.com/manually-restart-kerberos.htm in order, but the kdcsetup command gives me a “bus error”.

Please advise!

[rstasel]

So I’m having a similar issue to this. Kerberos seems to be rather hit or miss, so I need to kill it all on the OD master and build a new.

Has anyone had luck using these methods recently? My main goal is to fix several accounts that don’t have kerberos authauthority entries, so they can’t use kerberos.

Here’s my post elsewhere in the forum:

https://www.afp548.com/forum/viewtopic.php?showtopic=23953

[rstasel]

So I’m having a similar issue to this. Kerberos seems to be rather hit or miss, so I need to kill it all on the OD master and build a new.

Has anyone had luck using these methods recently? My main goal is to fix several accounts that don’t have kerberos authauthority entries, so they can’t use kerberos.

Here’s my post elsewhere in the forum:

https://www.afp548.com/forum/viewtopic.php?showtopic=23953

[rstasel]

Though, MacTroll…

Isn’t the passdb supposed to free up the slot-IDs for accounts that no longer exist? It just seems like a waste to have ancient (years old) cruft in the passdb.

Thanks!

[rstasel]

true enough…

though, speaking of broke, I’m having issues with a replica I just set up. Are there still issues with an Intel replicating a PPC master? The password server sync seems to be borked. A new user I created can’t auth to the replica, but can to the master.

[rstasel]

nope, never.

So, clear our /var/db/krb5kdc, /Library/Preferences/edu.mit.kerberos and /etc/krb5kdc.keytab?

I’m not sure how to clear our the dslocal stuff. Also, one of the sites I found said to clear out the local KDC stuff, but I’m not sure how to find out what that is either.

[rstasel]

we are using network homes.

[rstasel]

crap. that’s perfect!

Thanks!

So, got any idea why the “allow simultaneous login on managed clients” doesn’t seem to work (unchecking it doesn’t prevent people from logging in multiple times)? Looking on the web, it looks like it’s a known issue, but… I know this setting is held in OD (diffing a before and after ldif points to the mcx policy stuff…)

Oh, and why “old” users that were migrated from 10.3 to 10.4, then to 10.5, don’t work with iCal server (you select an iCal server, and hit save, only to see the box be unchecked again).

Thanks again!

[rstasel]

That actually makes a lot of sense. It sucks in that, it doesn’t appear it’s that easy to make changes to that system like it is to the OD system (dscl). I see easily enough if they’re disabled… but disabling their account from the cli doesn’t look trivial.

Think my best bet is going to be the keyword approach then (look at the list of users that should have accounts compared to who do have accounts, if someone has an account that shouldn’t, use dscl to set a keyword of “expired” on the account. Then use WGM to disable/delete “expired” accounts).

Thanks a bunch arekdreyer…

[rstasel]

ah, cool!

[rstasel]

Hi,

We too have this problem, and the only solution we can think of is your second option… a “cron” job that chowns everything at regular intervals.

Other input is welcome, but I’m at a loss… I specifically haven’t implemented quotas on our system because of this issue.

[Author]

Posts