doc/html/admin/troubleshoot.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   2   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   3
   4
   5 <html xmlns="http://www.w3.org/1999/xhtml">
   6   <head>
   7     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
   8
   9     <title>Troubleshooting &mdash; MIT Kerberos Documentation</title>
  10
  11     <link rel="stylesheet" href="../_static/agogo.css" type="text/css" />
  12     <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
  13     <link rel="stylesheet" href="../_static/kerb.css" type="text/css" />
  14
  15     <script type="text/javascript">
  16       var DOCUMENTATION_OPTIONS = {
  17         URL_ROOT:    '../',
  18         VERSION:     '1.15.2',
  19         COLLAPSE_INDEX: false,
  20         FILE_SUFFIX: '.html',
  21         HAS_SOURCE:  true
  22       };
  23     </script>
  24     <script type="text/javascript" src="../_static/jquery.js"></script>
  25     <script type="text/javascript" src="../_static/underscore.js"></script>
  26     <script type="text/javascript" src="../_static/doctools.js"></script>
  27     <link rel="author" title="About these documents" href="../about.html" />
  28     <link rel="copyright" title="Copyright" href="../copyright.html" />
  29     <link rel="top" title="MIT Kerberos Documentation" href="../index.html" />
  30     <link rel="up" title="For administrators" href="index.html" />
  31     <link rel="next" title="Advanced topics" href="advanced/index.html" />
  32     <link rel="prev" title="Environment variables" href="env_variables.html" />
  33   </head>
  34   <body>
  35     <div class="header-wrapper">
  36         <div class="header">
  37
  38
  39             <h1><a href="../index.html">MIT Kerberos Documentation</a></h1>
  40
  41             <div class="rel">
  42
  43         <a href="../index.html" title="Full Table of Contents"
  44             accesskey="C">Contents</a> |
  45         <a href="env_variables.html" title="Environment variables"
  46             accesskey="P">previous</a> |
  47         <a href="advanced/index.html" title="Advanced topics"
  48             accesskey="N">next</a> |
  49         <a href="../genindex.html" title="General Index"
  50             accesskey="I">index</a> |
  51         <a href="../search.html" title="Enter search criteria"
  52             accesskey="S">Search</a> |
  53     <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__Troubleshooting">feedback</a>
  54             </div>
  55         </div>
  56     </div>
  57
  58     <div class="content-wrapper">
  59       <div class="content">
  60         <div class="document">
  61
  62       <div class="documentwrapper">
  63         <div class="bodywrapper">
  64           <div class="body">
  65
  66   <div class="section" id="troubleshooting">
  67 <span id="troubleshoot"></span><h1>Troubleshooting<a class="headerlink" href="#troubleshooting" title="Permalink to this headline">¶</a></h1>
  68 <div class="section" id="trace-logging">
  69 <span id="id1"></span><h2>Trace logging<a class="headerlink" href="#trace-logging" title="Permalink to this headline">¶</a></h2>
  70 <p>Most programs using MIT krb5 1.9 or later can be made to provide
  71 information about internal krb5 library operations using trace
  72 logging.  To enable this, set the <strong>KRB5_TRACE</strong> environment variable
  73 to a filename before running the program.  On many operating systems,
  74 the filename <tt class="docutils literal"><span class="pre">/dev/stdout</span></tt> can be used to send trace logging output
  75 to standard output.</p>
  76 <p>Some programs do not honor <strong>KRB5_TRACE</strong>, either because they use
  77 secure library contexts (this generally applies to setuid programs and
  78 parts of the login system) or because they take direct control of the
  79 trace logging system using the API.</p>
  80 <p>Here is a short example showing trace logging output for an invocation
  81 of the <a class="reference internal" href="../user/user_commands/kvno.html#kvno-1"><em>kvno</em></a> command:</p>
  82 <div class="highlight-python"><div class="highlight"><pre>shell% env KRB5_TRACE=/dev/stdout kvno krbtgt/KRBTEST.COM
  83 [9138] 1332348778.823276: Getting credentials user@KRBTEST.COM -&gt;
  84     krbtgt/KRBTEST.COM@KRBTEST.COM using ccache
  85     FILE:/me/krb5/build/testdir/ccache
  86 [9138] 1332348778.823381: Retrieving user@KRBTEST.COM -&gt;
  87     krbtgt/KRBTEST.COM@KRBTEST.COM from
  88     FILE:/me/krb5/build/testdir/ccache with result: 0/Unknown code 0
  89 krbtgt/KRBTEST.COM@KRBTEST.COM: kvno = 1
  90 </pre></div>
  91 </div>
  92 </div>
  93 <div class="section" id="list-of-errors">
  94 <h2>List of errors<a class="headerlink" href="#list-of-errors" title="Permalink to this headline">¶</a></h2>
  95 <div class="section" id="frequently-seen-errors">
  96 <h3>Frequently seen errors<a class="headerlink" href="#frequently-seen-errors" title="Permalink to this headline">¶</a></h3>
  97 <ol class="arabic simple">
  98 <li><a class="reference internal" href="#init-creds-etype-nosupp"><em>KDC has no support for encryption type while getting initial credentials</em></a></li>
  99 <li><a class="reference internal" href="#cert-chain-etype-nosupp"><em>credential verification failed: KDC has no support for encryption type</em></a></li>
 100 <li><a class="reference internal" href="#err-cert-chain-cert-expired"><em>Cannot create cert chain: certificate has expired</em></a></li>
 101 </ol>
 102 </div>
 103 <div class="section" id="errors-seen-by-admins">
 104 <h3>Errors seen by admins<a class="headerlink" href="#errors-seen-by-admins" title="Permalink to this headline">¶</a></h3>
 105 <ol class="arabic simple" id="prop-failed-start">
 106 <li><a class="reference internal" href="#kprop-no-route"><em>kprop: No route to host while connecting to server</em></a></li>
 107 <li><a class="reference internal" href="#kprop-con-refused"><em>kprop: Connection refused while connecting to server</em></a></li>
 108 <li><a class="reference internal" href="#kprop-sendauth-exchange"><em>kprop: Server rejected authentication (during sendauth exchange) while authenticating to server</em></a></li>
 109 </ol>
 110 <hr class="docutils" id="prop-failed-end" />
 111 <div class="section" id="kdc-has-no-support-for-encryption-type-while-getting-initial-credentials">
 112 <span id="init-creds-etype-nosupp"></span><h4>KDC has no support for encryption type while getting initial credentials<a class="headerlink" href="#kdc-has-no-support-for-encryption-type-while-getting-initial-credentials" title="Permalink to this headline">¶</a></h4>
 113 </div>
 114 <div class="section" id="credential-verification-failed-kdc-has-no-support-for-encryption-type">
 115 <span id="cert-chain-etype-nosupp"></span><h4>credential verification failed: KDC has no support for encryption type<a class="headerlink" href="#credential-verification-failed-kdc-has-no-support-for-encryption-type" title="Permalink to this headline">¶</a></h4>
 116 <p>This most commonly happens when trying to use a principal with only
 117 DES keys, in a release (MIT krb5 1.7 or later) which disables DES by
 118 default.  DES encryption is considered weak due to its inadequate key
 119 size.  If you cannot migrate away from its use, you can re-enable DES
 120 by adding <tt class="docutils literal"><span class="pre">allow_weak_crypto</span> <span class="pre">=</span> <span class="pre">true</span></tt> to the <a class="reference internal" href="conf_files/krb5_conf.html#libdefaults"><em>[libdefaults]</em></a>
 121 section of <a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><em>krb5.conf</em></a>.</p>
 122 </div>
 123 <div class="section" id="cannot-create-cert-chain-certificate-has-expired">
 124 <span id="err-cert-chain-cert-expired"></span><h4>Cannot create cert chain: certificate has expired<a class="headerlink" href="#cannot-create-cert-chain-certificate-has-expired" title="Permalink to this headline">¶</a></h4>
 125 <p>This error message indicates that PKINIT authentication failed because
 126 the client certificate, KDC certificate, or one of the certificates in
 127 the signing chain above them has expired.</p>
 128 <p>If the KDC certificate has expired, this message appears in the KDC
 129 log file, and the client will receive a &#8220;Preauthentication failed&#8221;
 130 error.  (Prior to release 1.11, the KDC log file message erroneously
 131 appears as &#8220;Out of memory&#8221;.  Prior to release 1.12, the client will
 132 receive a &#8220;Generic error&#8221;.)</p>
 133 <p>If the client or a signing certificate has expired, this message may
 134 appear in <a class="reference internal" href="#trace-logging">trace_logging</a> output from <a class="reference internal" href="../user/user_commands/kinit.html#kinit-1"><em>kinit</em></a> or, starting in
 135 release 1.12, as an error message from kinit or another program which
 136 gets initial tickets.  The error message is more likely to appear
 137 properly on the client if the principal entry has no long-term keys.</p>
 138 </div>
 139 <div class="section" id="kprop-no-route-to-host-while-connecting-to-server">
 140 <span id="kprop-no-route"></span><h4>kprop: No route to host while connecting to server<a class="headerlink" href="#kprop-no-route-to-host-while-connecting-to-server" title="Permalink to this headline">¶</a></h4>
 141 <p>Make sure that the hostname of the slave (as given to kprop) is
 142 correct, and that any firewalls between the master and the slave allow
 143 a connection on port 754.</p>
 144 </div>
 145 <div class="section" id="kprop-connection-refused-while-connecting-to-server">
 146 <span id="kprop-con-refused"></span><h4>kprop: Connection refused while connecting to server<a class="headerlink" href="#kprop-connection-refused-while-connecting-to-server" title="Permalink to this headline">¶</a></h4>
 147 <p>If the slave is intended to run kpropd out of inetd, make sure that
 148 inetd is configured to accept krb5_prop connections.  inetd may need
 149 to be restarted or sent a SIGHUP to recognize the new configuration.
 150 If the slave is intended to run kpropd in standalone mode, make sure
 151 that it is running.</p>
 152 </div>
 153 <div class="section" id="kprop-server-rejected-authentication-during-sendauth-exchange-while-authenticating-to-server">
 154 <span id="kprop-sendauth-exchange"></span><h4>kprop: Server rejected authentication (during sendauth exchange) while authenticating to server<a class="headerlink" href="#kprop-server-rejected-authentication-during-sendauth-exchange-while-authenticating-to-server" title="Permalink to this headline">¶</a></h4>
 155 <p>Make sure that:</p>
 156 <ol class="arabic simple">
 157 <li>The time is synchronized between the master and slave KDCs.</li>
 158 <li>The master stash file was copied from the master to the expected
 159 location on the slave.</li>
 160 <li>The slave has a keytab file in the default location containing a
 161 <tt class="docutils literal"><span class="pre">host</span></tt> principal for the slave&#8217;s hostname.</li>
 162 </ol>
 163 </div>
 164 </div>
 165 </div>
 166 </div>
 167
 168
 169           </div>
 170         </div>
 171       </div>
 172         </div>
 173         <div class="sidebar">
 174     <h2>On this page</h2>
 175     <ul>
 176 <li><a class="reference internal" href="#">Troubleshooting</a><ul>
 177 <li><a class="reference internal" href="#trace-logging">Trace logging</a></li>
 178 <li><a class="reference internal" href="#list-of-errors">List of errors</a><ul>
 179 <li><a class="reference internal" href="#frequently-seen-errors">Frequently seen errors</a></li>
 180 <li><a class="reference internal" href="#errors-seen-by-admins">Errors seen by admins</a><ul>
 181 <li><a class="reference internal" href="#kdc-has-no-support-for-encryption-type-while-getting-initial-credentials">KDC has no support for encryption type while getting initial credentials</a></li>
 182 <li><a class="reference internal" href="#credential-verification-failed-kdc-has-no-support-for-encryption-type">credential verification failed: KDC has no support for encryption type</a></li>
 183 <li><a class="reference internal" href="#cannot-create-cert-chain-certificate-has-expired">Cannot create cert chain: certificate has expired</a></li>
 184 <li><a class="reference internal" href="#kprop-no-route-to-host-while-connecting-to-server">kprop: No route to host while connecting to server</a></li>
 185 <li><a class="reference internal" href="#kprop-connection-refused-while-connecting-to-server">kprop: Connection refused while connecting to server</a></li>
 186 <li><a class="reference internal" href="#kprop-server-rejected-authentication-during-sendauth-exchange-while-authenticating-to-server">kprop: Server rejected authentication (during sendauth exchange) while authenticating to server</a></li>
 187 </ul>
 188 </li>
 189 </ul>
 190 </li>
 191 </ul>
 192 </li>
 193 </ul>
 194
 195     <br/>
 196     <h2>Table of contents</h2>
 197     <ul class="current">
 198 <li class="toctree-l1"><a class="reference internal" href="../user/index.html">For users</a></li>
 199 <li class="toctree-l1 current"><a class="reference internal" href="index.html">For administrators</a><ul class="current">
 200 <li class="toctree-l2"><a class="reference internal" href="install.html">Installation guide</a></li>
 201 <li class="toctree-l2"><a class="reference internal" href="conf_files/index.html">Configuration Files</a></li>
 202 <li class="toctree-l2"><a class="reference internal" href="realm_config.html">Realm configuration decisions</a></li>
 203 <li class="toctree-l2"><a class="reference internal" href="database.html">Database administration</a></li>
 204 <li class="toctree-l2"><a class="reference internal" href="lockout.html">Account lockout</a></li>
 205 <li class="toctree-l2"><a class="reference internal" href="conf_ldap.html">Configuring Kerberos with OpenLDAP back-end</a></li>
 206 <li class="toctree-l2"><a class="reference internal" href="appl_servers.html">Application servers</a></li>
 207 <li class="toctree-l2"><a class="reference internal" href="host_config.html">Host configuration</a></li>
 208 <li class="toctree-l2"><a class="reference internal" href="backup_host.html">Backups of secure hosts</a></li>
 209 <li class="toctree-l2"><a class="reference internal" href="pkinit.html">PKINIT configuration</a></li>
 210 <li class="toctree-l2"><a class="reference internal" href="otp.html">OTP Preauthentication</a></li>
 211 <li class="toctree-l2"><a class="reference internal" href="princ_dns.html">Principal names and DNS</a></li>
 212 <li class="toctree-l2"><a class="reference internal" href="enctypes.html">Encryption types</a></li>
 213 <li class="toctree-l2"><a class="reference internal" href="https.html">HTTPS proxy configuration</a></li>
 214 <li class="toctree-l2"><a class="reference internal" href="auth_indicator.html">Authentication indicators</a></li>
 215 <li class="toctree-l2"><a class="reference internal" href="admin_commands/index.html">Administration  programs</a></li>
 216 <li class="toctree-l2"><a class="reference internal" href="../mitK5defaults.html">MIT Kerberos defaults</a></li>
 217 <li class="toctree-l2"><a class="reference internal" href="env_variables.html">Environment variables</a></li>
 218 <li class="toctree-l2 current"><a class="current reference internal" href="">Troubleshooting</a><ul class="simple">
 219 </ul>
 220 </li>
 221 <li class="toctree-l2"><a class="reference internal" href="advanced/index.html">Advanced topics</a></li>
 222 <li class="toctree-l2"><a class="reference internal" href="various_envs.html">Various links</a></li>
 223 </ul>
 224 </li>
 225 <li class="toctree-l1"><a class="reference internal" href="../appdev/index.html">For application developers</a></li>
 226 <li class="toctree-l1"><a class="reference internal" href="../plugindev/index.html">For plugin module developers</a></li>
 227 <li class="toctree-l1"><a class="reference internal" href="../build/index.html">Building Kerberos V5</a></li>
 228 <li class="toctree-l1"><a class="reference internal" href="../basic/index.html">Kerberos V5 concepts</a></li>
 229 <li class="toctree-l1"><a class="reference internal" href="../formats/index.html">Protocols and file formats</a></li>
 230 <li class="toctree-l1"><a class="reference internal" href="../mitK5features.html">MIT Kerberos features</a></li>
 231 <li class="toctree-l1"><a class="reference internal" href="../build_this.html">How to build this documentation from the source</a></li>
 232 <li class="toctree-l1"><a class="reference internal" href="../about.html">Contributing to the MIT Kerberos Documentation</a></li>
 233 <li class="toctree-l1"><a class="reference internal" href="../resources.html">Resources</a></li>
 234 </ul>
 235
 236     <br/>
 237     <h4><a href="../index.html">Full Table of Contents</a></h4>
 238     <h4>Search</h4>
 239     <form class="search" action="../search.html" method="get">
 240       <input type="text" name="q" size="18" />
 241       <input type="submit" value="Go" />
 242       <input type="hidden" name="check_keywords" value="yes" />
 243       <input type="hidden" name="area" value="default" />
 244     </form>
 245         </div>
 246         <div class="clearer"></div>
 247       </div>
 248     </div>
 249
 250     <div class="footer-wrapper">
 251         <div class="footer" >
 252             <div class="right" ><i>Release: 1.15.2</i><br />
 253                 &copy; <a href="../copyright.html">Copyright</a> 1985-2017, MIT.
 254             </div>
 255             <div class="left">
 256
 257         <a href="../index.html" title="Full Table of Contents"
 258             >Contents</a> |
 259         <a href="env_variables.html" title="Environment variables"
 260             >previous</a> |
 261         <a href="advanced/index.html" title="Advanced topics"
 262             >next</a> |
 263         <a href="../genindex.html" title="General Index"
 264             >index</a> |
 265         <a href="../search.html" title="Enter search criteria"
 266             >Search</a> |
 267     <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__Troubleshooting">feedback</a>
 268             </div>
 269         </div>
 270     </div>
 271
 272   </body>
 273 </html>