Resolving frequent problems
***************************

Problems compiling Kerberos
===========================

Many compilers require a switch to become ANSI compliant. Since kth-krb is written in ANSI C it is necessary to specify the name of the compiler to be used and the required switch to make it ANSI compliant. This is most easily done when running configure using the env command. For instance to build under HP-UX using the native compiler do:

     datan$ env CC="cc -Ae" ./configure

In general gcc works. The following combinations have also been verified to successfully compile the distribution:

HP-UX
     cc -Ae

Digital UNIX
     cc -std1

AIX
     xlc

Solaris 2.x
     cc (unbundled one)

IRIX
     cc

Linux problems
--------------

Some systems have lost /usr/include/ndbm.h which is necessary to build kth-krb correctly. There is a ndbm.h.Linux right next to the source distribution.

There has been reports of non-working libdb on some Linux distributions.  If that happens, use the --without-berkeley-db when configuring.

HP-UX problems
--------------

The shared library /usr/lib/libndbm.sl doesn't exist on all systems.  To make problems even worse, there is never an archive version for static linking either. Therefore, when building ``truly portable'' binaries first install GNU gdbm or Berkeley DB, and make sure that you are linking against that library.

Cray problems
-------------

rlogind won't work on Crays until forkpty() has been ported, in the mean time use telnetd.

AIX problems
------------

gcc version 2.7.2.1 has a bug which makes it miscompile appl/telnet/telnetd/sys_term.c (and possibily appl/bsd/forkpty.c), if used with too much optimization.

C2 problems
-----------

The programs that checks passwords works with passwd, OTP, and Kerberos paswords. This is problem if you use C2 security (or use some other password database), that normally keeps passwords in some obscure place. If you want to use Kerberos with C2 security you will have to think about what kind of changes are necessary. See also the discussion about Digital's SIA and C2 security, see Digital SIA.

Common error messages
=====================

These are some of the more obscure error messages you might encounter:

Time is out of bounds

     The time on your machine differs from the time on either the kerberos server or the machine you are trying to login to. If it isn't obvious that this is the case, remember that all times are compared in UTC.

     On unix systems you usually can find out what the local time is by doing telnet machine daytime. This time (again, usually is the keyword) is with correction for time-zone and daylight savings.

     If you have problem keeping your clocks synchronized, consider using a time keeping system such as NTP (see also the discussion in Install the client programs).

Ticket issue date too far in the future

     The time on the kerberos server is more than five minutes ahead of the time on the server.

Can't decode authenticator

     This means that there is a mismatch between the service key in the kerberos server and the service key file on the specific machine. Either:

       * the server couldn't find a service key matching the request

       * the service key (or version number) does not match the key the packet was encrypted with

Incorrect network address

     The address in the ticket does not match the address you sent the request from. This happens on systems with more than one network address, either physically or logically. You can list addresses which should be considered equal in /etc/krb.equiv on your servers.

     A note to programmers: a server should not pass * as the instance to krb_rd_req. It should try to figure out on which interface the request was received, for instance by using k_getsockinst.

     If you change addresses on your computer you invalidate any tickets you might have. The easiest way to fix this is to get new tickets with the new address.

Message integrity error

     The packet is broken in some way:

       * the lengths does not match the size of the packet, or

       * the checksum does not match the contents of the packet

Can't send request
     There is some problem contacting the kerberos server. Either the server is down, or it is using the wrong port (compare the entries for kerberos-iv in /etc/services). The client might also have failed to guess what kerberos server to talk to (check /etc/krb.conf and /etc/krb.realms).

kerberos: socket: Unable to open socket...

     The kerberos server has to open four sockets for each interface.  If you have a machine with lots of virtual interfaces, you run the risk of running out of file descriptors.  If that happens you will get this error message.

ftp: User foo access denied

     This usually happens because the user's shell is not listed in /etc/shells.  Note that ftpd checks this file even on systems where the system version does not and there is no /etc/shells.

Generic kerberos error
     This is a generic catch-all error message.