gyades
n00b
Joined: 15 Apr 2005
Posts: 27
Location: Glen Ellyn, IL
|
 Posted: Mon Dec 03, 2007 12:19 am Post subject: clock skew and kerberos (try again) |
 |
|
Hey,
Back in June, I posted this question about a problem I've been having with kerberos. I haven't had the chance to look into this in a while, but it's becoming increasingly irritating, so I'll try again. The basic symptom is that when I try to do a kinit on my home desktop, i get:
| Code: |
kinit -f
Password for gyades@FNAL.GOV:
kinit(v5): Clock skew too great while getting initial credentials
|
Which would appear to be a wrong clock setting by at least five minutes. Problem is, every test I've done seems to indicate that the clock is correctly set (including checking against my laptop, on which everything works fine). So it must be something else.
I was asked for a network dump, and I generated one using tcpdump, but never got a reply. I just repeated the experiment.
On the desktop (named singularity), I get:
| Code: |
singularity ~ # tcpdump 'host krb-fnal-1.fnal.gov'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 68 bytes
18:05:07.138531 IP singularity.32804 > i-krb-10.fnal.gov.kerberos: v5
18:05:14.459675 IP singularity.32805 > i-krb-10.fnal.gov.kerberos: v5
18:05:15.967513 IP singularity.32806 > i-krb-10.fnal.gov.kerberos: v5
18:05:16.966796 IP singularity.32807 > i-krb-10.fnal.gov.kerberos: v5
18:05:17.967224 IP singularity.47569 > i-krb-10.fnal.gov.kerberos: S 3558513517:3558513517(0) win 5840 <mss 1460,sackOK,timestamp 5555984[|tcp]>
18:05:17.994933 IP i-krb-10.fnal.gov.kerberos > singularity.47569: R 0:0(0) ack 3558513518 win 0
18:05:18.209083 IP i-krb-10.fnal.gov.kerberos > singularity.32806:
18:05:18.223986 IP singularity.32807 > i-krb-10.fnal.gov.kerberos: v5
18:05:19.225279 IP singularity.32808 > i-krb-10.fnal.gov.kerberos: v5
18:05:20.109171 IP i-krb-10.fnal.gov.kerberos > singularity.32808:
10 packets captured
12 packets received by filter
0 packets dropped by kernel
|
While on my laptop (avalon), I see:
| Code: |
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 68 bytes
18:07:31.399574 IP avalon.32769 > i-krb-10.fnal.gov.kerberos: v5
18:07:44.408249 IP avalon.32771 > i-krb-10.fnal.gov.kerberos: v5
18:07:46.196126 IP i-krb-10.fnal.gov.kerberos > avalon.32771: v5
18:07:46.196173 IP avalon > i-krb-10.fnal.gov: ICMP avalon udp port 32771 unreachable, length 492
4 packets captured
6 packets received by filter
0 packets dropped by kernel
|
You can see the results of the first try in the original thread. Any help in decoding this, or suggestions as to what else to try would be appreciated.
Thanks!
mod edit, changed html to phpbb code --bunder |
|
Networking & Security
