问题[kinit](server)

我正在尝试验证主机以进行 kbr5p nfs 挂载，其中 Microsoft 活动目录充当 Kerberos 服务器。

sudo kinit -k -t /etc/krb5.keytab host/[email protected]
kinit: Client 'host/[email protected]' not found in Kerberos database while getting initial credentials

但在活动目录中，以下命令有效

PS C:\Program Files\vmware\VMware OVF Tool> setspn -l ROBODAROBODA
Registered ServicePrincipalNames for CN=ROBODAROBODA,CN=Computers,DC=example,DC=com:
        host/[email protected]
        HOST/robodaroboda.example.com
        HOST/ROBODAROBODA

在数据包跟踪中，观察到未知的主要错误。要求：

    Kerberos AS-REQ
        Record Mark: 202 bytes
            0... .... .... .... .... .... .... .... = Reserved: Not set
            .000 0000 0000 0000 0000 0000 1100 1010 = Record Length: 202
        Pvno: 5
        MSG Type: AS-REQ (10)
        padata: Unknown:149
            Type: Unknown (149)
                Value: <MISSING>
        KDC_REQ_BODY
            Padding: 0
            KDCOptions: 00000010 (Renewable OK)
                .0.. .... .... .... .... .... .... .... = Forwardable: Do NOT use forwardable tickets
                ..0. .... .... .... .... .... .... .... = Forwarded: This is NOT a forwarded ticket
                ...0 .... .... .... .... .... .... .... = Proxiable: Do NOT use proxiable tickets
                .... 0... .... .... .... .... .... .... = Proxy: This ticket has NOT been proxied
                .... .0.. .... .... .... .... .... .... = Allow Postdate: We do NOT allow the ticket to be postdated
                .... ..0. .... .... .... .... .... .... = Postdated: This ticket is NOT postdated
                .... .... 0... .... .... .... .... .... = Renewable: This ticket is NOT renewable
                .... .... ...0 .... .... .... .... .... = Opt HW Auth: False
                .... .... .... ..0. .... .... .... .... = Constrained Delegation: This is a normal request (no constrained delegation)
                .... .... .... ...0 .... .... .... .... = Canonicalize: This is NOT a canonicalized ticket request
                .... .... .... .... .... .... ..0. .... = Disable Transited Check: Transited checking is NOT disabled
                .... .... .... .... .... .... ...1 .... = Renewable OK: We accept RENEWED tickets
                .... .... .... .... .... .... .... 0... = Enc-Tkt-in-Skey: Do NOT encrypt the tkt using the skey
                .... .... .... .... .... .... .... ..0. = Renew: This is NOT a request to renew a ticket
                .... .... .... .... .... .... .... ...0 = Validate: This is NOT a request to validate a postdated ticket
 Client Name (Principal): host/ROBODAROBODA
            Name-type: Principal (1)
            Name: host
            Name: ROBODAROBODA
            Server Name (Service and Instance): krbtgt/EXAMPLE.COM
                Name-type: Service and Instance (2)
                Name: krbtgt
                Name: EXAMPLE.COM
            till: 2020-04-05 18:37:06 (UTC)
            Nonce: 407713677
            Encryption Types: aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des-cbc-md5-nt 19 des3-cbc-sha1 rc4-hmac 25 26
                Encryption type: aes256-cts-hmac-sha1-96 (18)
                Encryption type: aes128-cts-hmac-sha1-96 (17)
                Encryption type: des-cbc-md5-nt (20)
                Encryption type: Unknown (19)
                Encryption type: des3-cbc-sha1 (16)
                Encryption type: rc4-hmac (23)
                Encryption type: Unknown (25)
                Encryption type: Unknown (26)

回复：

Kerberos KRB-ERROR
    Record Mark: 112 bytes
        0... .... .... .... .... .... .... .... = Reserved: Not set
        .000 0000 0000 0000 0000 0000 0111 0000 = Record Length: 112
    Pvno: 5
    MSG Type: KRB-ERROR (30)
    stime: 2020-04-04 18:37:06 (UTC)
    susec: 931508
    error_code: KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN (6)
    Realm: EXAMPLE.COM
    Server Name (Service and Instance): krbtgt/EXAMPLE.COM
        Name-type: Service and Instance (2)
        Name: krbtgt
        Name: EXAMPLE.COM

谁能帮我理解为什么我看到未知的主要错误？

由于一个专有内核模块，我没有源代码并且对它将加载到哪些内核版本非常挑剔（即使使用 modprobe --f），我发现自己需要运行 2.6.16.XX 内核在我的 Debian5 机器上。机器使用 2.6.26-2 库存内核启动良好，我通过制作 .deb 和 ndoing dpkg -i 成功构建并启动了基于 2.6.26 和 2.6.31 的内核。

但是，当我对 2.6.16 执行相同的方法时，内核会在启动时挂起。我正在 VMWare 映像中对此进行测试，因此我认为这不是旧内核不支持的新硬件的问题。

对于一个工作内核，在启动时我得到：

Uncompressing Linux.. OK booting the kernel
Loading, please wait...
mdadm: No devices listed in the conf file were found
kinit name_to_dev_t /dev/hda5 (dev5,3)
...

在 2.6.16.60 中，我从未收到 kinit 消息。它挂在 mdadm 行之后。这台机器上没有 mdadm 数组，所以我怀疑它是 mdadm 东西内部的问题，这应该只是像上面的 2.6.26 案例中那样出错，但由于某种原因，我陷入了 kinit .

我一直在用头撞墙，所以我非常愿意接受有关如何解决此问题的建议。