Q: GSSAPI miscellaneous error - server not found?
In my effort to eliminate frequent "rainbow beachball of doom" for my users since upgrading to 10.8.5, I've been tracking down and eliminating several config errors on my server. I'm down to just a couple now and here's one I haven't been able to get to the source of that appears to be causing a few hangs (Note that in all places where my server is mentioned, I've substituted "fqdn.myserver" for the actual fqdn):
GSSAPI Error: Miscellaneous failure (see text (Server (ldap/<fqdn.myserver.lowercase@FQDN.MYSERVER.UPPERCASE) unknown while looking up 'ldap/fqdn.myserver.lowercase@FQDN.MYSERVER.UPPERCASE' (cached result, timeout in 1200 sec) (negative cache))
Possibly related: check out the results of nslookup from a client machine:
pauls-laptop:~ paul$ nslookup fqdn.myserver.net
Server: 10.23.0.7
Address: 10.23.0.7#53
Name: fqdn.myserver.net
Address: 10.23.0.7
pauls-laptop:~ paul$ nslookup -type=NS fqdn.myserver.net
Server: 10.23.0.7
Address: 10.23.0.7#53
*** Can't find fqdn.myserver.net: No answer
Two things: first, I note that the IP address of my server is being returned as the server name. Also, even though my server correctly handles DNS queries both forward and reverse, and I've created NS records for my name server AND
sudo changeip -checkhostname
returns correct results at the server, nslookup still can't find the NS record... Perhaps I'm misusing nslookup though - I don't have much experience with that tool.
Thoughts anyone?
MAC MINI SERVER (LATE 2012), OS X Server, 10.8.5
Posted on Aug 5, 2014 1:48 PM
Linc to the rescue, again. Thanks much. I'll check these out in order over the next few days and let you know what I find. Here's what I know so far:
1. OD Master does have a unique static IP.
2. NB I'm using Server 2.2.1 (169) managing a 10.8.5 server (incorrect listing on my account, which I corrected after this post), so the available screens and options are somewhat different from what you've described. Any idea where in this version I would access the "the Accessing your Server" sheet?
For what it's worth, changeip -checkhostname returns:
The names match. There is nothing to change.
dirserv:success = "success"
3. I set the primary DNS server for the server itself to 127.0.0.1 via the network connections prefs in System Preferences. Previously it had been set to the primary static address . Most of our clients are assigned statically and bound to the OD. We have been using a secondary local server as a backup local DNS service (forwarders only) so clients can still access external sites when we take our main down for maintenance. Consequently we've populated the DNS settings of those clients with both addresses. I'll work on cleaning those up over the next couple of days.
4. This step looks highly likely to be the magic bullet. In the last year we've both upgraded from 10.6.8 to 10.7 to 10.8.5 and migrated from an XServe to a mini. It seems likely to me that our Kerberos records need to be updated. I plan to run this step tonight after I do a little more research to make sure I know exactly what those commands are going to do.
5. Another likely culprit. We are using a wildcard cert that covers our whole domain, likely we'll need to replace this with one that's specific to this server. I'll check into this if step 4 doesn't clear things up.
6. Probably not needed, as we used the FQDN in all of our binds anyway - but if need be we can redo this.
7. Never a bad idea.
8. We never do this.
9. Long ago and far away (in my 10.3 days) I've had to do this. Glad that's a last resort and hope it doesn't come to that.
Thanks again, Linc.
-Paul
PS - A little tidbit for you: one of the many errors I've run down in the last week was:
collabpp[88328]: CFPreferences: user home directory for user kCFPreferencesCurrentUser at /var/teamsserver is unavailable. User domains will be volatile.
As some posters have noted, this directory technically does not exist (at least not as of 10.8.5) - but admins who actually look in /var will find a directory that *looks* like it's supposed to be the teamsserver home directory - but it's misspelled: teamserver (note the single "s"). This buggered me for quite a while trying to fix it with -chown and Workgroup Manager - until I took a good look at the directory. Easy to see how Apple developers might have overlooked that one.
Cheers!
Posted on Aug 6, 2014 10:29 AM