I've set up a version of ghettoHostShutdownESXi41 to shut down my VMs and hosts when my Dell UPS's lose power. I'm using adauth, and everything works as planned (shuts all VMs, sends email, shuts hosts on UPS power fail) IF I've recently logged in as the active directory user whose credentials are being used to shut down the hosts. So, my assumption is that my kerberos ticket renewal is not working correctly. This has taken a ridiculous amount of time, really, and I've gotten many tips from this forum, but now I'm stuck. Kerberos in Windows is a bit of a mystery to me.
If someone knows exactly what is wrong that would be fantastic, but failing that, I'm curious
Has ANYONE gotten the kinit renewal working correctly in vMa 4.1?
If so, did you get the "unable to set SPN mapping data" below when you ran ktpass?
Any idea what setting such mapping data via other means entails?
Do I just need to edit the servicePrincipleName ldap attribute for the user in question? Can you show me an example of a working SPN for this purpose?
What do you see in your /var/log/messages when your cron kinit runs?
Details:
DCs are Server 2008R2
vMA is 4.1
hosts are ESXi 4.1
Here is how I create keytab on 2008R2 domain controller (with ktpass which came with DC):
=============================
C:\Temp>ktpass /out kerbtestadmin.keytab /princ kerbtest@OURDOMAIN.VIRGINIA.EDU /pas
s kerbtestpass /ptype KRB5_NT_PRINCIPAL -mapuser OURDOMAIN\kerbtestadmin
Targeting domain controller: DC1.OURDOMAIN.virginia.edu
Failed to set property 'servicePrincipalName' to 'kerbtestadmin' on Dn 'CN=Bob KerbTe
stGuy,OU=Server Users,OU=Servers,DC=OURDOMAIN,DC=virginia,DC=edu': 0x13.
WARNING: Unable to set SPN mapping data.
If kerbtestadmin already has an SPN mapping installed for kerbtestadmin, this is no cause
for concern.
Password succesfully set!
Key created.
Output keytab to kerbtest1.keytab:
Keytab version: 0x502
keysize 65 kerbtestadmin@OURDOMAIN.VIRGINIA.EDU ptype 1 (KRB5_NT_PRINCIPAL) vno 7 ety
pe 0x17 (RC4-HMAC) keylength 16 (0x13b33acd1c17316933ac009712673c27)
Here is what is in cron.hourly on vMA, note I've included the -V parameter, so I get a result on "success". The result I get is the apparently positive-looking "Authenticated to Kerberos v5"
=======================================================
su - OURDOMAIN\\kerbtestadmin -c '/usr/kerberos/bin/kinit -k -V -t /home/local/OURDOMAIN/kerbtestadmin/kerbtestadmin.keytab kerbtestadmin@OURDOMAIN.VIRGINIA.EDU'
Authenticated to Kerberos v5
But in /var/log/messages, I see this every hour--
Oct 14 10:01:01 law47-s lsassd[2065]: 0x488ec940:Caught LDAP_SERVER_DOWN Error on ldap search
Oct 14 10:01:01 law47-s lsassd[2065]: 0x488ec940:Error code 32902 occurred during attempt 0 of a ldap search. Retrying.
Oct 14 10:01:01 law47-s lsassd[2065]: 0x488ec940:Clearing ldap DC connection list for domain 'OURDOMAIN.VIRGINIA.EDU' du
e to a network error.
Oct 14 10:01:01 law47-s su: [module:pam_lsass]pam_notify_user_logon failed [login:OURDOMAIN\kerbtestadmin][error code: 3282
5]