Attachment 1970873 Details for Bug 2214399 – KRB5_TRACE log of a failed lookup [mildly redacted]

KRB5_TRACE log of a failed lookup [mildly redacted]

krb5-fail-log.txt (text/plain), 10.00 KB, created by Ian Collier on 2023-06-14 16:32:02 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ian Collier

Created: 2023-06-14 16:32:02 UTC

Size: 10.00 KB

patch

obsolete

>[295167] 1686758204.598965: Getting initial credentials for host/myhost@MYREALM
>[295167] 1686758204.598966: Setting initial creds service to krbtgt/MYREALM@MYREALM
>[295167] 1686758204.598967: Found entries for host/myhost@MYREALM in keytab: aes256-cts, aes128-cts
>[295167] 1686758204.598969: Sending unauthenticated request
>[295167] 1686758204.598970: Sending request (222 bytes) to MYREALM
>[295167] 1686758204.598971: Sending initial UDP request to dgram ipaserver1:88
>[295167] 1686758204.598972: Received answer (532 bytes) from dgram ipaserver1:88
>[295167] 1686758204.598973: Response was from primary KDC
>[295167] 1686758204.598974: Received error from KDC: -1765328359/Additional pre-authentication required
>[295167] 1686758204.598977: Preauthenticating using KDC method data
>[295167] 1686758204.598978: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
>[295167] 1686758204.598979: Selected etype info: etype aes256-cts, salt "lKh51H1tY9P[CO^S", params ""
>[295167] 1686758204.598980: Received cookie: MIT1...
>[295167] 1686758204.598981: PKINIT client has no configured identity; giving up
>[295167] 1686758204.598982: Preauth module pkinit (147) (info) returned: 0/Success
>[295167] 1686758204.598983: PKINIT client received freshness token from KDC
>[295167] 1686758204.598984: Preauth module pkinit (150) (info) returned: 0/Success
>[295167] 1686758204.598985: PKINIT client has no configured identity; giving up
>[295167] 1686758204.598986: Preauth module pkinit (16) (real) returned: 22/Invalid argument
>[295167] 1686758204.598987: SPAKE challenge received with group 1, pubkey HEXDIGITS
>[295167] 1686758204.598988: Retrieving host/myhost@MYREALM from FILE:/etc/krb5.keytab (vno 0, enctype aes256-cts) with result: 0/Success
>[295167] 1686758204.598989: SPAKE key generated with pubkey HEXDIGITS
>[295167] 1686758204.598990: SPAKE algorithm result: HEXDIGITS
>[295167] 1686758204.598991: SPAKE final transcript hash: HEXDIGITS
>[295167] 1686758204.598992: Sending SPAKE response
>[295167] 1686758204.598993: Preauth module spake (151) (real) returned: 0/Success
>[295167] 1686758204.598994: Produced preauth for next request: PA-FX-COOKIE (133), PA-SPAKE (151)
>[295167] 1686758204.598995: Sending request (481 bytes) to MYREALM
>[295167] 1686758204.598996: Sending initial UDP request to dgram ipaserver1:88
>[295167] 1686758204.598997: Received answer (885 bytes) from dgram ipaserver1:88
>[295167] 1686758204.598998: Response was from primary KDC
>[295167] 1686758204.598999: AS key determined by preauth: aes256-cts/53FE
>[295167] 1686758204.599000: Decrypted AS reply; session key is: aes256-cts/74C2
>[295167] 1686758204.599001: FAST negotiation: available
>[295167] 1686758204.599002: Storing host/myhost@MYREALM -> krbtgt/MYREALM@MYREALM in MEMORY:_autofstkt
>[295167] 1686758204.599003: TXT record _kerberos.ipaserver1. not found
>[295167] 1686758204.599004: TXT record _kerberos.mydomain. found: MYREALM
>[295167] 1686758204.599005: ccselect module realm chose cache MEMORY:_autofstkt with client principal host/myhost@MYREALM for server principal ldap/ipaserver1@MYREALM
>[295167] 1686758204.599006: Storing config in MEMORY:_autofstkt for : refresh_time: 1686758234
>[295167] 1686758204.599007: Storing host/myhost@MYREALM -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in MEMORY:_autofstkt
>[295167] 1686758204.599008: Getting initial credentials for host/myhost@MYREALM
>[295167] 1686758204.599009: Couldn't lookup etypes in keytab: 2/Key table file '/var/kerberos/krb5/user/0/client.keytab' not found
>[295167] 1686758204.599011: Sending unauthenticated request
>[295167] 1686758204.599012: Sending request (222 bytes) to MYREALM
>[295167] 1686758204.599013: Sending initial UDP request to dgram ipaserver1:88
>[295167] 1686758204.599014: Received answer (532 bytes) from dgram ipaserver1:88
>[295167] 1686758204.599015: Response was from primary KDC
>[295167] 1686758204.599016: Received error from KDC: -1765328359/Additional pre-authentication required
>[295167] 1686758204.599019: Preauthenticating using KDC method data
>[295167] 1686758204.599020: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
>[295167] 1686758204.599021: Selected etype info: etype aes256-cts, salt "lKh51H1tY9P[CO^S", params ""
>[295167] 1686758204.599022: Received cookie: MIT1...
>[295167] 1686758204.599023: PKINIT client has no configured identity; giving up
>[295167] 1686758204.599024: Preauth module pkinit (147) (info) returned: 0/Success
>[295167] 1686758204.599025: PKINIT client received freshness token from KDC
>[295167] 1686758204.599026: Preauth module pkinit (150) (info) returned: 0/Success
>[295167] 1686758204.599027: PKINIT client has no configured identity; giving up
>[295167] 1686758204.599028: Preauth module pkinit (16) (real) returned: 22/Invalid argument
>[295167] 1686758204.599029: SPAKE challenge received with group 1, pubkey HEXDIGITS
>[295167] 1686758204.599030: Retrieving host/myhost@MYREALM from FILE:/var/kerberos/krb5/user/0/client.keytab (vno 0, enctype aes256-cts) with result: 2/Key table file '/var/kerberos/krb5/user/0/client.keytab' not found
>[295167] 1686758204.599031: Preauth module spake (151) (real) returned: 2/Key table file '/var/kerberos/krb5/user/0/client.keytab' not found
>[295167] 1686758204.599032: Retrieving host/myhost@MYREALM from FILE:/var/kerberos/krb5/user/0/client.keytab (vno 0, enctype aes256-cts) with result: 2/Key table file '/var/kerberos/krb5/user/0/client.keytab' not found
>[295167] 1686758204.599033: Preauth module encrypted_timestamp (2) (real) returned: 2/Key table file '/var/kerberos/krb5/user/0/client.keytab' not found
>[295167] 1686758204.599034: Getting credentials host/myhost@MYREALM -> ldap/ipaserver1@ using ccache MEMORY:_autofstkt
>[295167] 1686758204.599035: Retrieving host/myhost@MYREALM -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:_autofstkt with result: -1765328243/Matching credential not found
>[295167] 1686758204.599036: Retrieving host/myhost@MYREALM -> ldap/ipaserver1@ from MEMORY:_autofstkt with result: -1765328243/Matching credential not found
>[295167] 1686758204.599037: Retrying host/myhost@MYREALM -> ldap/ipaserver1@MYREALM with result: -1765328243/Matching credential not found
>[295167] 1686758204.599038: Retrieving host/myhost@MYREALM -> krbtgt/MYREALM@MYREALM from MEMORY:_autofstkt with result: 0/Success
>[295167] 1686758204.599039: TXT record _kerberos.ipaserver2. not found
>[295167] 1686758204.599040: TXT record _kerberos.mydomain. found: MYREALM
>[295167] 1686758204.599041: ccselect module realm chose cache MEMORY:_autofstkt with client principal host/myhost@MYREALM for server principal ldap/ipaserver2@MYREALM
>[295167] 1686758204.599042: Storing config in MEMORY:_autofstkt for : refresh_time: 1686758234
>[295167] 1686758204.599043: Storing host/myhost@MYREALM -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in MEMORY:_autofstkt
>[295167] 1686758204.599044: Getting initial credentials for host/myhost@MYREALM
>[295167] 1686758204.599045: Couldn't lookup etypes in keytab: 2/Key table file '/var/kerberos/krb5/user/0/client.keytab' not found
>[295167] 1686758204.599047: Sending unauthenticated request
>[295167] 1686758204.599048: Sending request (222 bytes) to MYREALM
>[295167] 1686758204.599049: Sending initial UDP request to dgram ipaserver1:88
>[295167] 1686758204.599050: Received answer (532 bytes) from dgram ipaserver1:88
>[295167] 1686758204.599051: Response was from primary KDC
>[295167] 1686758204.599052: Received error from KDC: -1765328359/Additional pre-authentication required
>[295167] 1686758204.599055: Preauthenticating using KDC method data
>[295167] 1686758204.599056: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
>[295167] 1686758204.599057: Selected etype info: etype aes256-cts, salt "lKh51H1tY9P[CO^S", params ""
>[295167] 1686758204.599058: Received cookie: MIT1...
>[295167] 1686758204.599059: PKINIT client has no configured identity; giving up
>[295167] 1686758204.599060: Preauth module pkinit (147) (info) returned: 0/Success
>[295167] 1686758204.599061: PKINIT client received freshness token from KDC
>[295167] 1686758204.599062: Preauth module pkinit (150) (info) returned: 0/Success
>[295167] 1686758204.599063: PKINIT client has no configured identity; giving up
>[295167] 1686758204.599064: Preauth module pkinit (16) (real) returned: 22/Invalid argument
>[295167] 1686758204.599065: SPAKE challenge received with group 1, pubkey HEXDIGITS
>[295167] 1686758204.599066: Retrieving host/myhost@MYREALM from FILE:/var/kerberos/krb5/user/0/client.keytab (vno 0, enctype aes256-cts) with result: 2/Key table file '/var/kerberos/krb5/user/0/client.keytab' not found
>[295167] 1686758204.599067: Preauth module spake (151) (real) returned: 2/Key table file '/var/kerberos/krb5/user/0/client.keytab' not found
>[295167] 1686758204.599068: Retrieving host/myhost@MYREALM from FILE:/var/kerberos/krb5/user/0/client.keytab (vno 0, enctype aes256-cts) with result: 2/Key table file '/var/kerberos/krb5/user/0/client.keytab' not found
>[295167] 1686758204.599069: Preauth module encrypted_timestamp (2) (real) returned: 2/Key table file '/var/kerberos/krb5/user/0/client.keytab' not found
>[295167] 1686758204.599070: Getting credentials host/myhost@MYREALM -> ldap/ipaserver2@ using ccache MEMORY:_autofstkt
>[295167] 1686758204.599071: Retrieving host/myhost@MYREALM -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:_autofstkt with result: -1765328243/Matching credential not found
>[295167] 1686758204.599072: Retrieving host/myhost@MYREALM -> ldap/ipaserver2@ from MEMORY:_autofstkt with result: -1765328243/Matching credential not found
>[295167] 1686758204.599073: Retrying host/myhost@MYREALM -> ldap/ipaserver2@MYREALM with result: -1765328243/Matching credential not found
>[295167] 1686758204.599074: Retrieving host/myhost@MYREALM -> krbtgt/MYREALM@MYREALM from MEMORY:_autofstkt with result: 0/Success

Actions: View

Attachments on bug 2214399: 1970873 | 1970874 | 1973430