Some principals not replicating
Adam Lewenberg <[email protected]> Fri, 15 Jun 2018 14:31:15 -0700
| Newsgroups | gmane.comp.encryption.kerberos.heimdal.general |
|---|---|
| Message-ID | <[email protected]> |
I have a kerberos master running version 7.1. I am attempting to
replicate to slaves some of which run version 7.1 and some of which run
version 1.5.2.
PROBLEM: Some of the principals will not replicate.
If I go on the master and change the password of one of these
problematic principals, I see this in the replica's logs:
--------------------------------------------------------------
(version 1.5.2)
2018-06-15T21:17:47 replaying entry 131870
2018-06-15T21:17:47 kadm5_log_replay: 131870. Lost entry entry, Database
out of sync ?: No such entry in the database (36150275)
2018-06-15T21:17:47 Ignoring command 8
(version 7.1)
2018-06-15T14:17:47.138560-07:00 kdc-test1 ipropd-slave[18033]: slave
status change: up-to-date with version: 131870 at 2018-06-15T14:17:47
--------------------------------------------------------------
In both cases, the principal is not in either replica's database. That
is, using a 'get' command returns "Principal does not exist".
On the master, the principal looks like this:
--------------------------------------------------------------
Principal: [email protected]
Principal expires: never
Password expires: 2019-06-15 21:17:47 UTC
Last password change: 2018-06-15 21:17:47 UTC
Max ticket life: 1 day 1 hour
Max renewable life: 1 week
Kvno: 7
Mkvno: unknown
Last successful login: never
Last failed login: never
Failed login count: 0
Last modified: 2018-06-15 21:17:47 UTC
Modifier: kadmin/[email protected]
Attributes: disallow-svr, requires-pre-auth
Keytypes: aes256-cts-hmac-sha1-96(pw-salt)[7],
aes128-cts-hmac-sha1-96(pw-salt)[7], des3-cbc-sha1(pw-salt)[7],
arcfour-hmac-md5(pw-salt)[7]
PK-INIT ACL:
Aliases:
--------------------------------------------------------------
One extra piece of information. The master's database came by hprop'ing
to it from a 1.5.2 master.
QUESTION: What could be a reason for this principal not to replicate?
Adam Lewenberg