fedora-infrastructure

#8068 Can't use kerberos with fedora-infrastructure
Closed: Fixed by jogas. Opened by jogas.

Closed: Fixed
Reopen Issue

Greetings,

I am having issues with kinit. My sincerest apologies if I have missed something trivial, I'm not familiar with kerberos.

I've followed the instructions from https://fedoraproject.org/wiki/Infrastructure/Kerberos#How_to_use_kerberos_auth_with_Fedora_Infrastructure. I suspect there is further kerberos configuration I missing or neglected to follow.

Please help.

Error:

$ kinit jogas@FEDORAPROJECT.ORG
kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials

Output from KrbDebug:

$ ./KrbDebug
test_01_installed (__main__.TestKerberos) ... ok
test_02_using_collection (__main__.TestKerberos) ... ok
test_03_configuration (__main__.TestKerberos) ... ok
test_04_kinit (__main__.TestKerberos) ... FAIL
======================================================================
FAIL: test_04_kinit (__main__.TestKerberos)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "./KrbDebug", line 95, in test_04_kinit
    ' occured. Please tell puiterwijk you got: %s' % stderr)
AssertionError: Strange error occured. Please tell puiterwijk you got: kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials
----------------------------------------------------------------------
Ran 4 tests in 54.389s
FAILED (failures=1)

Output with KRB5_TRACE:

$ KRB5_TRACE=/dev/stdout kinit jogas@FEDORAPROJECT.ORG
[62181] 1564779776.39586: Getting initial credentials for jogas@FEDORAPROJECT.ORG
[62181] 1564779776.39588: Sending unauthenticated request
[62181] 1564779776.39589: Sending request (183 bytes) to FEDORAPROJECT.ORG
[62181] 1564779776.39590: Resolving hostname id.fedoraproject.org
[62181] 1564779776.39591: Terminating TCP connection to https 209.132.181.15:443
[62181] 1564779776.39592: Terminating TCP connection to https 152.19.134.142:443
[62181] 1564779776.39593: Terminating TCP connection to https 209.132.181.16:443
[62181] 1564779776.39594: Terminating TCP connection to https 140.211.169.206:443
[62181] 1564779776.39595: Terminating TCP connection to https 152.19.134.198:443
[62181] 1564779776.39596: Terminating TCP connection to https 209.132.190.2:443
[62181] 1564779776.39597: Terminating TCP connection to https 67.203.2.67:443
[62181] 1564779776.39598: Terminating TCP connection to https 140.211.169.196:443
[62181] 1564779776.39599: Terminating TCP connection to https 8.43.85.67:443
[62181] 1564779776.39600: Terminating TCP connection to https 8.43.85.73:443
[62181] 1564779776.39601: Resolving hostname fedoraproject.org
[62181] 1564779776.39602: Sending initial UDP request to dgram 140.211.169.196:88
[62181] 1564779777.293536: Sending initial UDP request to dgram 152.19.134.198:88
[62181] 1564779778.294770: Sending initial UDP request to dgram 209.132.181.16:88
[62181] 1564779779.296023: Sending initial UDP request to dgram 209.132.181.15:88
[62181] 1564779780.297302: Sending initial UDP request to dgram 209.132.190.2:88
[62181] 1564779781.298515: Sending initial UDP request to dgram 152.19.134.142:88
[62181] 1564779782.299761: Sending initial UDP request to dgram 140.211.169.206:88
[62181] 1564779783.301016: Sending initial UDP request to dgram 67.203.2.67:88
[62181] 1564779784.302271: Sending initial UDP request to dgram 8.43.85.73:88
[62181] 1564779785.303556: Sending initial UDP request to dgram 8.43.85.67:88
[62181] 1564779786.304930: Initiating TCP connection to stream 140.211.169.196:88
[62181] 1564779787.305360: Initiating TCP connection to stream 152.19.134.198:88
[62181] 1564779788.306598: Initiating TCP connection to stream 209.132.181.16:88
[62181] 1564779789.307869: Initiating TCP connection to stream 209.132.181.15:88
[62181] 1564779790.309230: Initiating TCP connection to stream 209.132.190.2:88
[62181] 1564779791.310471: Initiating TCP connection to stream 152.19.134.142:88
[62181] 1564779792.311710: Initiating TCP connection to stream 140.211.169.206:88
[62181] 1564779793.312966: Initiating TCP connection to stream 67.203.2.67:88
[62181] 1564779794.313361: Initiating TCP connection to stream 8.43.85.73:88
[62181] 1564779795.314586: Initiating TCP connection to stream 8.43.85.67:88
[62181] 1564779796.315861: Initiating TCP connection to stream 2610:28:3090:3001:dead:beef:cafe:fed3:88
[62181] 1564779796.315862: Initiating TCP connection to stream 2605:bc80:3010:600:dead:beef:cafe:feda:88
[62181] 1564779796.315863: Initiating TCP connection to stream 2605:bc80:3010:600:dead:beef:cafe:fed9:88
[62181] 1564779798.318072: Sending retry UDP request to dgram 140.211.169.196:88
[62181] 1564779799.319273: Sending retry UDP request to dgram 152.19.134.198:88
[62181] 1564779800.320420: Sending retry UDP request to dgram 209.132.181.16:88
[62181] 1564779801.321602: Sending retry UDP request to dgram 209.132.181.15:88
[62181] 1564779802.322775: Sending retry UDP request to dgram 209.132.190.2:88
[62181] 1564779803.323939: Sending retry UDP request to dgram 152.19.134.142:88
[62181] 1564779804.325105: Sending retry UDP request to dgram 140.211.169.206:88
[62181] 1564779805.326286: Sending retry UDP request to dgram 67.203.2.67:88
[62181] 1564779806.327480: Sending retry UDP request to dgram 8.43.85.73:88
[62181] 1564779807.328674: Sending retry UDP request to dgram 8.43.85.67:88
[62181] 1564779812.333997: Sending retry UDP request to dgram 140.211.169.196:88
[62181] 1564779813.335177: Sending retry UDP request to dgram 152.19.134.198:88
[62181] 1564779814.336328: Sending retry UDP request to dgram 209.132.181.16:88
[62181] 1564779815.337515: Sending retry UDP request to dgram 209.132.181.15:88
[62181] 1564779816.338726: Sending retry UDP request to dgram 209.132.190.2:88
[62181] 1564779817.339928: Sending retry UDP request to dgram 152.19.134.142:88
[62181] 1564779818.341154: Sending retry UDP request to dgram 140.211.169.206:88
[62181] 1564779819.342334: Sending retry UDP request to dgram 67.203.2.67:88
[62181] 1564779820.343520: Sending retry UDP request to dgram 8.43.85.73:88
[62181] 1564779821.344727: Sending retry UDP request to dgram 8.43.85.67:88
[62181] 1564779830.354072: Terminating TCP connection to stream 140.211.169.196:88
[62181] 1564779830.354073: Terminating TCP connection to stream 152.19.134.198:88
[62181] 1564779830.354074: Terminating TCP connection to stream 209.132.181.16:88
[62181] 1564779830.354075: Terminating TCP connection to stream 209.132.181.15:88
[62181] 1564779830.354076: Terminating TCP connection to stream 209.132.190.2:88
[62181] 1564779830.354077: Terminating TCP connection to stream 152.19.134.142:88
[62181] 1564779830.354078: Terminating TCP connection to stream 140.211.169.206:88
[62181] 1564779830.354079: Terminating TCP connection to stream 67.203.2.67:88
[62181] 1564779830.354080: Terminating TCP connection to stream 8.43.85.73:88
[62181] 1564779830.354081: Terminating TCP connection to stream 8.43.85.67:88
kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials

The config file: /etc/krb5.conf:

includedir /etc/krb5.conf.d
[libdefaults]
    default_realm = FEDORAPROJECT.ORG
    default_ccache_name = KEYRING:persistent:1001
[realms]
    FEDORAPROJECT.ORG = {
        kdc = fedoraproject.org:88
    default_domain = fedoraproject.org
    }
[domain_realm]
    .FEDORAPORJECT.GOV = FEDORAPROJECT.ORG

That krb5.conf has at least one spelling error.. but may not work because port 88 is not reachable outside of a firewall. (I am not sure where that config came from).

Spelling error below:

[domain_realm]
    .FEDORAPORJECT.GOV = FEDORAPROJECT.ORG

Let us look at trying the following:
1. Change the /etc/krb5.conf to the following:

includedir /etc/krb5.conf.d/
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 default_ccache_name = KEYRING:persistent:%{uid}
 dns_canonicalize_hostname = false
[realms]
[domain_realm]

Create the file /etc/krb5.conf.d/fedoraproject_org with the following content

[realms]
 FEDORAPROJECT.ORG = {
        kdc = https://id.fedoraproject.org/KdcProxy
 }
[domain_realm]
 .fedoraproject.org = FEDORAPROJECT.ORG
 fedoraproject.org = FEDORAPROJECT.ORG

Metadata Update from @smooge:
- Issue assigned to smooge

Metadata Update from @smooge:
- Issue priority set to: Waiting on Reporter (was: Needs Review)
- Issue tagged with: authentication

@smooge Thank you so much for taking time to help me troubleshoot, much appreciated.

With the updated /etc/krb5.conf and /etc/krb5.conf.d/fedoraproject_org files, I am seeing the same error but instantly rather than over 60 seconds (0.114s vs 54s).

/etc/krb5.conf:

$ cat /etc/krb5.conf
includedir /etc/krb5.conf.d/
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 default_ccache_name = KEYRING:persistent:%{uid}
 dns_canonicalize_hostname = false
[realms]
[domain_realm]

/etc/krb5.conf.d/fedoraproject_org:

$ cat /etc/krb5.conf.d/fedoraproject_org
[realms]
 FEDORAPROJECT.ORG = {
        kdc = https://id.fedoraproject.org/KdcProxy
 }
[domain_realm]
 .fedoraproject.org = FEDORAPROJECT.ORG
 fedoraproject.org = FEDORAPROJECT.ORG

KrbDebug output:

$ ./KrbDebug
test_01_installed (__main__.TestKerberos) ... ok
test_02_using_collection (__main__.TestKerberos) ... ok
test_03_configuration (__main__.TestKerberos) ... ok
test_04_kinit (__main__.TestKerberos) ... FAIL
======================================================================
FAIL: test_04_kinit (__main__.TestKerberos)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "./KrbDebug", line 95, in test_04_kinit
    ' occured. Please tell puiterwijk you got: %s' % stderr)
AssertionError: Strange error occured. Please tell puiterwijk you got: kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials
----------------------------------------------------------------------
Ran 4 tests in 0.177s
FAILED (failures=1)

Krb5 trace output:

$ KRB5_TRACE=/dev/stdout kinit jogas@FEDORAPROJECT.ORG
[67657] 1565016655.807938: Getting initial credentials for jogas@FEDORAPROJECT.ORG
[67657] 1565016655.807940: Sending unauthenticated request
[67657] 1565016655.807941: Sending request (202 bytes) to FEDORAPROJECT.ORG
[67657] 1565016655.807942: Resolving hostname id.fedoraproject.org
[67657] 1565016655.807943: Terminating TCP connection to https 140.211.169.196:443
[67657] 1565016655.807944: Terminating TCP connection to https 209.132.190.2:443
[67657] 1565016655.807945: Terminating TCP connection to https 8.43.85.67:443
[67657] 1565016655.807946: Terminating TCP connection to https 152.19.134.198:443
[67657] 1565016655.807947: Terminating TCP connection to https 209.132.181.15:443
[67657] 1565016655.807948: Terminating TCP connection to https 140.211.169.206:443
[67657] 1565016655.807949: Terminating TCP connection to https 8.43.85.73:443
[67657] 1565016655.807950: Terminating TCP connection to https 152.19.134.142:443
[67657] 1565016655.807951: Terminating TCP connection to https 209.132.181.16:443
[67657] 1565016655.807952: Terminating TCP connection to https 67.203.2.67:443
kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials

Several questions come to mind:
1. What is the guest OS being used (name and version)
2. That terminating TCP connection seems to say it is trying to reach such sites and something is timing it out. Do you have a network proxy or firewall on your site?

The guest OS is Centos 7, specifically:

$ cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)

Re proxy: Yes, I am sitting behind a proxy. However, my environment variables are configured accordingly. See the following (note address is edited out).

$ env | grep proxy
http_proxy=http://*************:8080
all_proxy=http://*************:8080
ALL_PROXY=http://*************:8080
RSYNC_PROXY=http://*************:8080
https_proxy=http://*************:8080
HTTPS_PROXY=http://*************:8080
no_proxy=localhost,127.0.0.1,.********
HTTP_PROXY=http://*************:8080

Re. firewall: Yes, I am also sitting behind a network firewall. However, it hasn't been a problem for any of my activities thus far.

Is there additional configuration needed when sitting behind a proxy?

I am not sure if kinit uses proxy environment variables or not. However, after doing some research it seems that various proxies will look at kerberos requests and try to check to see if they are ok to send out. So I am not sure what exactly is going on.. aka is it kinit trying to connect directly or is it the proxy saying 'hey you are not the kdc I am configured for.'

This appears to be an issue on my side. I was able to successfully kinit with the configuration above on a system outside of my restricted network. Thanks for your time @smooge. Closing.

Metadata Update from @jogas:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata

authentication

None
None
High
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.