1

I'm trying to install krb5-admin-server and krb5-kdc for a school project, everything is working fine but I can't stop krb5-admin-server nor restart it.

Here are the logs I retrieved with cat /var/log/syslog

Nov 27 17:57:45 Kerberos systemd[1]: krb5-admin-server.service stop-sigterm timed out. Killing.
Nov 27 17:57:45 Kerberos systemd[1]: krb5-admin-server.service: main process exited, code=killed, status=9/KILL
Nov 27 17:57:45 Kerberos systemd[1]: Unit krb5-admin-server.service entered failed state.

I can't stop it so the system kills the process but I can start it correctly, so it is running right now :

root@Kerberos:/home/# service krb5-admin-server status
● krb5-admin-server.service - Kerberos 5 Admin Server
   Loaded: loaded (/lib/systemd/system/krb5-admin-server.service;     enabled)
   Active: active (running) since ven. 2015-11-27 18:13:55 CET; 2min 6s ago
 Main PID: 6398 (kadmind)
   CGroup: /system.slice/krb5-admin-server.service
       └─6398 /usr/sbin/kadmind -nofork

 nov. 27 18:13:55 Kerberos kadmind[6398]: setsockopt(9,IPV6_V6ONLY,1)     worked
nov. 27 18:13:55 Kerberos kadmind[6398]: listening on fd 9: udp    ####::####:####:####:####%eth0.464
nov. 27 18:13:55 Kerberos kadmind[6398]: setsockopt(10,IPV6_V6ONLY,1) worked
nov. 27 18:13:55 Kerberos kadmind[6398]: listening on fd 11: tcp 0.0.0.0.464
nov. 27 18:13:55 Kerberos kadmind[6398]: listening on fd 10: tcp ::.464
nov. 27 18:13:55 Kerberos kadmind[6398]: listening on fd 12: rpc 0.0.0.0.749
nov. 27 18:13:55 Kerberos kadmind[6398]: setsockopt(13,IPV6_V6ONLY,1) worked
nov. 27 18:13:55 Kerberos kadmind[6398]: listening on fd 13: rpc ::.749
nov. 27 18:13:55 Kerberos kadmind[6398]: set up 6 sockets
nov. 27 18:13:55 Kerberos kadmind[6398]: Seeding random number generator

You can also notice that the time is wrong, it is because my school blocked the NTP protocol.

I don'n think it's normal that I can't stop the service normally, I tried reinstalling it several times with different configurations but it still doesn't work so does anyone know what is happening ?

Thank you in advance.

  • 1
    "notice that the time is wrong" - regardless of your other problems, incorrect timekeeping is extremely problematic for Kerberos since the security relies among others on time stamps. – HBruijn Dec 9 '15 at 8:56
0

Okay, so I think this is all related to NTP (but someone feel free to correct me). I'm going to assume your doing this in a VM on your schools network, and I'll assume you've tried the following on the rogue process' pid.

kill -9 <pid>

Since Kerberos (and pretty much all authentication/authorisation protocols) rely on synchronised time, your school must have an internal NTP server or some other time server, your best bet is to get hold of those host names and configure your NTP deamon to point at them. You can do that in /etc/ntpd.conf.

As for the unstoppable process, this can sometimes happen in Linux. It is rare though.

If a processes blocking on a response from a remote host and then times out, the service will enter a failed state but the process sort of goes rogue and no kill signal will terminate it. In this case you have to reboot the machine.

The reason for this is because the process has likely entered an uninterruptible sleep. You can check this by running

ps aef | grep <process_name>

And you'll notice it probably has status D.

Good luck with your project!

  • Well, I turned in the project a while ago so we used our own internet to do it but it was indeed the NTP protocol causing the problem. Nevertheless, thank you for your answer. – IPelican Jun 15 '16 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.