Suggestion when only able to connect to some services when using Kerberos.

Question

I had been having problems using Kerberos for authentication for some services. It worked fine when on a LAN and worked when I had a VPN (MS-CHAP). But when trying to connect normally, I was able to get a TGT, but often ran into issues when trying to connect to other services (e.g. IMAP / VPN). What's more, sometimes everything did work, but stopped again soon after.
My setup has one server providing all the services in question. There were several CNAMES linking the different services (e.g. ichat.mydomain, mail.mydomain etc).
I found a number of people who seemed to have similar issues, but the threads were archived so I couldn't post a reply. So I'm hoping they come across this message and it helps them.
Because of an unrelated problem, it was brought to my attention that there were some problems with the DNS records relating to my domain – not on my server, but on the net.
After some experimenting, I discovered that if I set the DNS (in System Preferences) on my client Mac to the server I was contacting most things worked.
It seems that the Kerberos system may do a reverse lookup at some point, or something similar.
When I do a "dig -x <my ip address>" I get different responses over time, and from different DNS servers. When I did "dig @<my own dns> -x <my ip address>" it always came back with the correct server name.
So perhaps the issue lies with the DNS that your machine is looking up? This would explain why it works on the lan (the DNS is probably your server) and over VPN (again your server is the DNS).
This may not be the answer to these people's problems, but if you were getting messages such as "Server not found in Kerberos database" in your logs, it may pay to check what is getting return by DNS servers outside your organisation.
HTH.
iMac G3   Mac OS X (10.4.8)  

Answer 1

CharlieJ wrote:
The problem is this: When any one of the computers is connected to the internet through the DSL none of the others computers is able to connect – I see the message “Connecting through WAN miniport (PPOE)…”, i.e. I am only able to connect to the internet 1 computer at a time.
As soon as I disconnect from the ‘connected’ computer (desktop or laptop) I am immediately able to successfully connect to the internet on either of the other 2 computers.
I’ve tried resetting everything – no luck.
I don’t recall having changed any of the settings and am baffled.
Any thoughts as to the problem?
Thanks in advance for any help.
Charlie
PS. I haven't called the Verizon DSL Tech Support team yet...but I will soon. I figured on asking here first.
Ok.
#1 You must get to the network control panel on your computer.
One of the ways, for Windows XP is:
a) Go to Start -> Control Panel -> Network Connections
b) The screen will look like steps 5 and 6, on http://portforward.com/networking/static-xp.htm
For Windows Vista:
a) Go to the globe icon (start button) -> Control Panel -> Network and Sharing Center -> Manage Network Connections.
b) The screen will look like steps 5, 6, and 7, on
http://portforward.com/networking/static-vista.htm
#2 Right click on the WAN miniport (PPPOE), and remove the check mark that says Set as Default Connection.
^^
If you are the original poster (OP) and your issue is solved, please remember to click the "Solution?" button so that others can more easily find it. If anyone has been helpful to you, please show your appreciation by clicking the "Kudos" button.