Pam_mount and laptop connected to wifi

Support and Help
21

maybe a detail…
when I execute host MYSERVER.fr
the result is

MYSERVER.fr is an alias for ANOTHERSERVER.fr
ANOTHERSERVER.fr has address XXX.XXX.XXX.XXX

I tested my conf with ANOTHERSERVER.fr in fstab/hosts, but I get the same error!!

22

MYSERVER was just a placeholder in my example!

The AD domain controller does not know that name.
Local /etc/hosts only maps IPs for your laptop, but Kerberos queries AD.

Error -1765328377 means no SPN exists for that name.

Ask your AD admins for the real hostname, or get it with this -

nmap -p 445 --script smb-os-discovery <IP>

Test it with kvno cifs/<hostname> first.

Once kvno returns a ticket, mount will work.

1 Like
23

I used MYSERVER as a placeholder in my previous posts, no worry, I used my real server name in the tests :wink:

the command nmap -p 445 --script smb-os-discovery XXX.XXX.XXX.XXX returned ANOTHERSERVER. XXX.LOCAL (I got ANOTHERSERVER.fr with the command host MYSERVER.fr stating MYSERVER.fr was an alias for ANOTHERSERVER.fr, in my previous tests)

unfortunaltely the command kvno cifs/ANOTHERSERVER returned
kvno: Server not found in kerberos database while getting credentials for cifs/ANOTHERSERVER@XXX.LOCAL
and the command kvno cifs/ANOTHERSERVER.XXX.LOCAL returned
kvno: Server not found in kerberos database while getting credentials for cifs/ANOTHERSERVER.XXX.LOCAL@XXX.LOCAL

I guess there is a configuration missing on the KDC part, a SPN for ANOTHERSERVER.XXX.LOCAL?

thank you very much for your help!
Gérald

24

Bingo, you nailed it :grinning_face: - your AD simply has no SPN for this box.

Before chasing your Windows admins though, try this -

kvno host/ANOTHERSERVER.XXX.LOCAL

Sometimes AD bundles CIFS under the generic HOST service class.

If that fails too, your admins really need to add the SPN to the server’s computer account-

setspn -s cifs/ANOTHERSERVER.XXX.LOCAL <computer_name>

Also, since MYSERVER is a CNAME alias, Kerberos will choke on it every time unless they also add an SPN for that alias:

setspn -s cifs/MYSERVER.fr <computer_name>
25

same error!
thank you for your help…I better understand kerberos now :wink:
it was interesting learning all that stuff…but not so easy

I’ll make a request to our admin guys…hope they will add these SPN…

Gérald

1 Like