Return
-
Title
Upgrading from 4.1.x to 4.2.2 getting error KRB5KDC_ERR_BADOPTION (-1765328371): KDC can't fulfill requested option -
Description
Upgrading from 4.1.x to 4.2.2 getting error :
ERROR: VAS_ERR_NOT_FOUND: Not found
could not resolve Host: HOSTNAME$@DOMAIN.COM to DN: Credential neededCaused by:VAS_ERR_CRED_NEEDED: Credential neededticket for krbtgt/DOMAIN.COM@DOMAIN.COM is not a renewable credentialCaused by:VAS_ERR_KRB5: Kerberos errorFailed to obtain credentials.Caused by:KRB5KDC_ERR_BADOPTION (-1765328371): KDC can't fulfill requested optionJoining computer to the domain as host/ ... FailedERROR: Unable to join computer objectERROR: Could not join to the domainVAS_ERR_LDAP: LDAP errorGSS SASL bind failed. comment: AcceptSecurityContext error, data 80090342, v3839.Caused by:LDAP_INVALID_CREDENTIALS: Invalid credentials -
Cause
Kerberos encyryption mismatched. -
Resolution
WORKAROUND:
1 - On a test box, install 4.1.3 as normal or if already setup skip to step 2.
2 - Run the following command:/opt/quest/bin/vastool configure vas libdefaults default_etypes aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 arcfour-hmac-md53 - After running that command, then upgrade from 4.1.x to 4.2.2.
USEFUL COMMANDS TO HELP TROUBLESHOOT:
# ifconfig -a
Then use either Tcpdump or Snoop
# tcpdump -i -s 0 -w /tmp/packet.pcap
/opt/quest/bin/vastool -d5 -e4 -u host/ attrs host/In looking through the packet trace, we seen the following message:KRB5KDC_ERR_ETYPE_NOSUPP