Bug 884662

Summary:	GSS-API (or Kerberos) error while initializing kadmin interface
Product:	Red Hat Enterprise Linux 6	Reporter:	Jian Li <jiali>
Component:	krb5	Assignee:	Robbie Harwood <rharwood>
Status:	CLOSED INSUFFICIENT_DATA	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.4	CC:	dpal, jplans, nmurray
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-09-09 22:19:38 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jian Li 2012-12-06 14:06:18 UTC

Description of problem:
Fetch principal ticket from a krb5 client through `kadmin` tool, this command fails :

( after config krb5.conf )
# kadmin -p kadmin/admin -w redhat -q "ktadd root test0 test1 "  
kadmin: GSS-API (or Kerberos) error while initializing kadmin interface

This fail couldn't be reproduced 100%, all appear in automatic test, and manual test couldn't meet such problem.

And I have fix time with ntp
# ntpdate clock.redhat.com

Version-Release number of selected component (if applicable):
RHEL distro: RHEL6.4-20121203.n.0

How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 3 Nalin Dahyabhai 2012-12-10 18:10:14 UTC

There's not much to work with there.  Log messages from /var/log/kadmind.log on the KDC, output you see at the client when KRB5_TRACE=/dev/stderr, and packet captures might at least give us a place to start.

Comment 4 Nalin Dahyabhai 2012-12-10 19:54:49 UTC

Also, since you mention that this is occurring during automated testing, I'm wondering if this is a consequence of having insufficient entropy available for kadmind to finish seeing its PRNG and start handling requests in a timely fashion, as we see in bug #874284.  The workaround there is to arrange for kadmind to be started with the undocumented -W flag to have it use /dev/urandom instead.

Comment 5 Jian Li 2012-12-11 02:03:26 UTC

(In reply to comment #4)
> Also, since you mention that this is occurring during automated testing, I'm
> wondering if this is a consequence of having insufficient entropy available
> for kadmind to finish seeing its PRNG and start handling requests in a
> timely fashion, as we see in bug #874284.  The workaround there is to
> arrange for kadmind to be started with the undocumented -W flag to have it
> use /dev/urandom instead.

Yes, I will check that workaround, I think its the same issue, I would close this bug if it is.  thanks for reply.

Comment 6 RHEL Program Management 2012-12-14 08:15:01 UTC

This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

Comment 8 Robbie Harwood 2015-09-09 22:19:38 UTC

We could not reproduce, and reporter is unresponsive.