[krbdev.mit.edu #8837] kprop replication does not work due to wrong DNS domain handling
Ingo via RT
rt at KRBDEV-PROD-APP-1.mit.edu
Sat Oct 5 10:22:12 EDT 2019
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8837 >
On 2019-10-03 17:56, Greg Hudson via RT wrote:
> Do you have a setting for dns_canonicalize_hostname in krb5.conf?
This is what I use, same on master and replica KDC:
~$ cat /etc/krb5.conf
[libdefaults]
default_realm = EXAMPLE.COM
forwardable = true
proxiable = true
[realms]
EXAMPLE.COM = {
kdc = kdc10-1.example.com
kdc = kdc10-2.example.com
master_kdc = kdc10-1.example.com
admin_server = kdc10-1.example.com
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
~$ sudo cat /etc/krb5kdc/kdc.conf
[kdcdefaults]
[realms]
EXAMPLE.COM = {
database_name = /var/lib/krb5kdc/principal
admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
acl_file = /etc/krb5kdc/kadm5.acl
key_stash_file = /etc/krb5kdc/stash
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
master_key_type = des3-hmac-sha1
default_principal_flags = +preauth
}
More information about the krb5-bugs
mailing list