Thank you all for your time and attention. Very simply I'm getting this error when invoking kinit to test kerberos authentication against my AD domain (which is hosted on a Server 2012 box).
The error: kinit: Cannot contact any KDC for realm 'MYDOMAIN.LOCAL' while getting initial credentials
Now, everything is fixed when I either explicitly set the KDC to an IP address instead of the host name in /etc/krb5.conf (e.g. kdc = 172.16.0.10 vs kdc = ad0.mydomain.local and same with admin_server) and it also works when the KDC is set as the hostname in /etc/krb5.conf and the KDC also has an explicit entry in /etc/hosts. My real question is why is this necessary? The whole point of DNS is to not have to use these local hosts files and I don't want my config setup that way. Does anyone know why this works this way? All the usual network tools and the host -t SRV ... queries all seem to work correctly (details below) without these extra steps (/etc/krb5.conf lists host name and no entry in /etc/hosts).
So can anyone tell me why kinit seems to be ignoring my resolv.conf file?
Tokens
- local host IP is
172.16.0.20 - Local hostname is
ps - Local FQDN is
ps.mydomain.local - AD host IP is
172.16.0.10 - AD hostname is
ad0 - AD FQDN is
ad0.mydomain.local - AD is primary DNS
- domain is
mydomain.local(I know .local is bad, working on it) - Network is 172.16.0.0/24
/etc/network/interfaces
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 172.16.0.20
netmask 255.255.255.0
gateway 172.16.0.1
network 172.16.0.0
broadcast 172.16.0.255
dns-nameservers 172.16.0.10 8.8.8.8
dns-search MYDOMAIN.LOCAL
/etc/hosts
127.0.0.1 localhost
172.16.0.20 ps.mydomain.local ps
# IPv6 stuff, don't think it's relevant to the problem
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
/etc/resolv.conf - automatically generated
nameserver 172.16.0.10
nameserver 8.8.8.8
search MYDOMAIN.LOCAL
/etc/krb5.conf
[libdefaults]
default_realm = MYDOMAIN.LOCAL
dns_lookup_kdc = true
dns_lookup_realm = true
# tried dns_lookup_realm as both true and false, no change
[realms]
MYDOMAIN.LOCAL = {
kdc = ad0.mydomain.local
admin_server = ad0.mydomain.local
default_domain = mydomain.local
}
[domain_realm]
.opticonwa.local = OPTICONWA.LOCAL
opticonwa.local = OPTICONWA.LOCAL
Not including smb.conf as this all works once kinit functions.
Tests
user@ps:~$ KRB5_TRACE=/dev/stdout kinit administrator
[1634] 1447281918.814976: Getting initial credentials for [email protected]
[1634] 1447281918.815297: Sending request (181 bytes) to MYDOMAIN.LOCAL
[1634] 1447281918.815346: Resolving hostname ad0.mydomain.local
[1634] 1447281923.817731: Resolving hostname ad0.mydomain.local
kinit: Cannot contact any KDC for realm 'MYDOMAIN.LOCAL' while getting initial credentials
user@ps:~$ host -t SRV _kerberos._udp.mydomain.local
_kerberos._udp.mydomain.local has SRV record 0 0 88 ad0.mydomain.local.
_kerberos._udp.mydomain.local has SRV record 0 100 88 ad0.mydomain.local.
user@ps:~$ host -t SRV _kerberos._tcp.mydomain.local
_kerberos._tcp.mydomain.local has SRV record 0 0 88 ad0.mydomain.local.
_kerberos._tcp.mydomain.local has SRV record 0 100 88 ad0.mydomain.local.
user@ps:~$ dig -x 172.16.0.10
; <<>> DiG 9.9.5-3ubuntu0.5-Ubuntu <<>> -x 172.16.0.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19749
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;10.0.16.172.in-addr.arpa. IN PTR
;; ANSWER SECTION:
10.0.16.172.in-addr.arpa. 1200 IN PTR ad0.mydomain.local.
;; Query time: 2 msec
;; SERVER: 172.16.0.10#53(172.16.0.10)
;; WHEN: Thu Nov 12 11:19:27 PST 2015
;; MSG SIZE rcvd: 92
Not sure why I'm showing 2 SRV records as the server only has 1 (at least that I'm aware of).
output of gentent hosts ...
user@ps:~$ getent hosts ad0.mydonaim.local
user@ps:~$ getent hosts 172.16.0.10
172.16.0.10 ad0.mydomain.local
So reverse lookups work when the hosts file does not contain an entry for the domain controller. Forward lookups do not. Both work when the entry is in hosts...
Output of nsswitch.conf unmodified from base install...
passwd: files winbind
group: files winbind
#passwd: compat
#group: compat
shadow: compat
hosts: files mdns4_minimal [NOTFOUND=return] dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
So can anyone tell me why kinit seems to ignore /etc/resolv.conf? Does it have to do with the incomplete DNS implementation for the admin_server stanza in /etc/krb5.conf? Or am I stuck in some kind of DNS catch-22 that I'm failing to notice? But why only Kerberos? As an add-on question, why does the local host name need to be in /etc/hosts anyway? Can someone point me to a thorough writeup on linux networking that would explain how this works on the back end?
Thanks again for your help. This is really bugging me.
