{"id":34,"date":"2006-05-09T10:09:40","date_gmt":"2006-05-09T10:09:40","guid":{"rendered":"https:\/\/www.bishnet.net\/tim\/blog\/2006\/05\/09\/strange-kerberos-problems\/"},"modified":"2010-11-11T13:01:57","modified_gmt":"2010-11-11T13:01:57","slug":"strange-kerberos-problems","status":"publish","type":"post","link":"https:\/\/www.bishnet.net\/tim\/blog\/2006\/05\/09\/strange-kerberos-problems\/","title":{"rendered":"Strange kerberos problems"},"content":{"rendered":"

A few days ago one of our users reported that they couldn’t change their password. The error coming out of the passwd command was confusing in itself – it said ‘bad old password’, or similar, which turns out to be a bug in our wrapper script.<\/p>\n

After some investigation we discovered that neither kadmin or kpasswd worked:<\/p>\n

tdb [~] % kadmin -p tdb\/admin\r\nEnter Password:\r\nkadmin: Operation failed for unspecified reason while\r\ninitializing kadmin interface<\/pre>\n
tdb [~] % kpasswd\r\nkpasswd: Changing password for tdb.\r\nOld password:\r\nkpasswd: Cannot establish a session with the Kerberos\r\nadministrative server for realm CS.UKC.AC.UK.\r\nOperation failed for unspecified reason.<\/pre>\n
The completely unhelpful bit there is the “failed for unspecified reason” error message. How are you meant to even begin debugging that? After a couple of hours digging I logged the call with Sun.<\/p>\n
It turns out that there is a known bug:<\/p>\n
Document ID:6410919
\nTitle:Patch 112908-24 will cause the kadmin -p kws\/admin to exit with a error message<\/p><\/blockquote>\n
The solution presented was to remove patch 112908-24. This time I’m willing to do that, but from past experience I’d like to see them actually fix the problem rather than just back it out. Or, at the very least, remove the patch from cluster patches. Otherwise in 6 months time I’m left staring at the same problem.<\/p>\n
What I’ve found most interesting in all this is that it took the best part of a month for anyone to notice passwords couldn’t be changed \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"
A few days ago one of our users reported that they couldn’t change their password. The error coming out of the passwd command was confusing in itself – it said ‘bad old password’, or similar, which turns out to be a bug in our wrapper script. After some investigation we discovered that neither kadmin or kpasswd worked: tdb [~] % …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-34","post","type-post","status-publish","format-standard","hentry","category-work"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t