X-MS-Exchange-Crosstenant-ID: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b Arc-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7GHOADnpCXq/sdesRsIASzrd0Egt6f+jg5sC7fBRsCc=; b=W8A96VQlPOQQz2vep6PUclERSxKaZMhM/C/r+qXyiJ3kxwxYjINKDOKlPkPMxTxbCKBCvx2EmbFA9AL3Qc5khDict3Cqs70IcXwLXGWToT+zWeYgSqSFmRGIt1bEvuDaxpvnlnvX5map6Qc0YNGJYno0Ac+wC7MpWAW0OfVp6EYMQ4cm++Ri3RR8qaT1Iyb+rVI0I050uO6ei+DadUKOVoWkbHl1e+4te19i6LbHHm53/MT/USkujAHaP8Gg9RaEG8g8FyMDKIGpZJKt4qBN/gcxsiRCriMC70Ehom1LWMoCIqcmFJxaXMOgYfKbH+g9C7o2RLNBZkKNQc55m0VbyQ== X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: /GWnJzAty0JWJxU5ckfDDrvHnccTC2q4rbFE4/Mh/ylpZTb9RgGibLLXtcXeZ6DzBe026dMUU/zw8bloH440tfKlGVCj/avTwCSfa9bR/fZq22QKnJ8sChijRTl8vMNkYQqTRSBZOQvyks6lrpagR+ko2IdTsSTZgtqrwXpTNai23M5voxZM+gZrLB6qE6WDukiXY+tvOuM67ZKaSbqGLSLq5Bies2kwpGrai0cXw7RDSomloGCJWyLLF6odwavEiFMzC6hWhmP69LA99xXwxdkVegu8rA7oUycddtOf0xMhxJmUXAXCLABOWzKxOX+IQ3TNrAcpaomkch2st57Df5UOH5Xk5jqUO6skrHAxO59uS+eXVf1xioBUQ1qI7I1wvmv3ZVZSrtkp122bWPHigTE94S+m6iUnsx3ymWm0Zc0= Subject: Re: [krbdev.mit.edu #8837] kprop replication does not work due to wrong DNS domain handling In-Reply-To: Received-SPF: None (protection.outlook.com: Hoeft-online.de does not designate permitted sender hosts) From krb5-bugs-incoming-bounces@PCH.mit.edu Sat Oct 5 10:22:12 2019 Content-Language: en-US X-Auto-Response-Suppress: DR, OOF, AutoReply Errors-To: krb5-bugs-incoming-bounces@PCH.mit.edu X-Eoptenantattributedmessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0 Return-Path: X-RT-Interface: Email X-MS-Exchange-Crosstenant-Network-Message-ID: dba8f9d8-b940-4754-fe81-08d749772ce3 X-MS-Exchange-Senderadcheck: 2 Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7GHOADnpCXq/sdesRsIASzrd0Egt6f+jg5sC7fBRsCc=; b=VSpYvla5O32kb2e6X+StbfT0dStHOGyxVAIMGwGzDlcs4F26s2ieu1L0w+nCugaQZJNGoTXQ9OZBnnbc9f52TkhQ/SCJa26f860PHk3PdDeUTqwRzkhj4qsY2vkUyV93W1j3/tdF4PG9FKMQHu2tQDBV/tdNf/GSm23NoKJksPo= X-Mailman-Version: 2.1.6 content-type: text/plain; charset="utf-8" X-Microsoft-Antispam-PRVS: X-Originatororg: mitprod.onmicrosoft.com X-RT-Original-Encoding: utf-8 X-Spam-Flag: NO To: krb5-bugs@mit.edu Authentication-Results: spf=none (sender IP is 212.227.126.133) smtp.mailfrom=Hoeft-online.de; mit.edu; dkim=none (message not signed) header.d=none; mit.edu; dmarc=none action=none header.from=Hoeft-online.de; X-RT-Incoming-Encryption: Not encrypted X-MS-Exchange-Transport-Forked: True X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr Sender: krb5-bugs-incoming-bounces@PCH.mit.edu Received: from PCH.mit.edu (PCH.MIT.EDU [18.7.21.50]) by krbdev.mit.edu (Postfix) with ESMTPS id 544F841903; Sat, 5 Oct 2019 10:22:11 -0400 (EDT) Received: from PCH.MIT.EDU (localhost.localdomain [127.0.0.1]) by PCH.mit.edu (8.14.7/8.12.8) with ESMTP id x95EMBcZ012599; Sat, 5 Oct 2019 10:22:11 -0400 Received: from outgoing-exchange-5.mit.edu (OUTGOING-EXCHANGE-5.MIT.EDU [18.9.28.59]) by PCH.mit.edu (8.14.7/8.12.8) with ESMTP id x959YEcP004212 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Sat, 5 Oct 2019 05:34:15 -0400 Received: from w92exedge4.exchange.mit.edu (W92EXEDGE4.EXCHANGE.MIT.EDU [18.7.73.16]) by outgoing-exchange-5.mit.edu (8.14.7/8.12.4) with ESMTP id x959YqA3013887 for ; Sat, 5 Oct 2019 05:34:52 -0400 Received: from oc11expo17.exchange.mit.edu (18.9.4.48) by w92exedge4.exchange.mit.edu (18.7.73.16) with Microsoft SMTP Server (TLS) id 15.0.1293.2; Sat, 5 Oct 2019 05:34:12 -0400 Received: from oc11exhyb8.exchange.mit.edu (18.9.1.113) by oc11expo17.exchange.mit.edu (18.9.4.48) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Sat, 5 Oct 2019 05:34:12 -0400 Received: from NAM03-BY2-obe.outbound.protection.outlook.com (104.47.42.58) by oc11exhyb8.exchange.mit.edu (18.9.1.113) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Sat, 5 Oct 2019 05:34:12 -0400 Received: from BL0PR01CA0029.prod.exchangelabs.com (2603:10b6:208:71::42) by BYAPR01MB3639.prod.exchangelabs.com (2603:10b6:a02:81::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2305.20; Sat, 5 Oct 2019 09:34:10 +0000 Received: from DM3NAM03FT042.eop-NAM03.prod.protection.outlook.com (2a01:111:f400:7e49::204) by BL0PR01CA0029.outlook.office365.com (2603:10b6:208:71::42) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2305.20 via Frontend Transport; Sat, 5 Oct 2019 09:34:10 +0000 Received: from mout.kundenserver.de (212.227.126.133) by DM3NAM03FT042.mail.protection.outlook.com (10.152.83.174) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2327.20 via Frontend Transport; Sat, 5 Oct 2019 09:34:09 +0000 Received: from [192.168.10.69] ([84.152.104.41]) by mrelayeu.kundenserver.de (mreue012 [212.227.15.167]) with ESMTPSA (Nemesis) id 1McIYO-1hgXHw1db2-00cgVe for ; Sat, 05 Oct 2019 11:34:08 +0200 Precedence: list From: "Ingo" X-MS-Traffictypediagnostic: BYAPR01MB3639: References: <6c56e0de-8d72-5b83-eb8e-4a0d924daa5f@Hoeft-online.de> Message-ID: MIME-Version: 1.0 X-Ui-Out-Filterresults: notjunk:1;V03:K0:qZQ7ZrgKcBg=:fMoI0SYzEl1+Fb2S4k8ANE XN4FR1JiSQ9AqEmZHW99+pBN+ciLrM0yt/HT0UTHd64TBf8deZrcmPPD5OGIgq3njhLKb6TR+ JuebKH82Cb2iQW9/wlRpGQKMOE8tnf8OALLW08tidXBdIm4tZVHjoPAizXpTnRFW71VjLEPQO 2ybNgieSRm0YygReelhY8ol2doLM+c4yZIiyOZiMMfNC//BPcCiiz233FIzE2neoaBerfJYyq Beibi3pWInOw4EST9NDEWeCiOnJYWoV4Owp9ZXDWAFgsQmlbt6eDpuRUKPs7/f5+9dLjy8vhB rHtupx23aB2K/rUNT4Ynrnk6nxPFx1CFNmGM72+2LFz3ZVvoC0dta2BbIqTwR2tiMNX6nys6b +Hyz7nkLlaIZL1lRtzGviwm8m+Kb2UD7ZsJFkd1guleoV1rATut+qLw5/H6C6pKJMU8mSDFeP MuxwW0lq6NjzCk6UNGudFx+TxisOAmH001c+qJBdpfh8EEdg+57ZKHKP4oo7MH6PH2tRUqAkg 2sxuN6lp+hQsJJfD3VVRpIOO+ZiPvVtMorOV7WqwEPT6sT1x6JfY6ZyNC/7S21KtJ8PwFjpjr gO4IPnidjw/RSRbqFDQRbUNznUnKv6OXFWRoqJjm7jwEnfBVvmQecMc0Bu35Ppx/HfTzFcuZz URcbRRhSBd0alD4igfLb+arfCVk3me8Hify5v7eHEl1lE5mPll6OOFdo4NOqfqxsFamuIG+AW g24T9hFLhbF8cd3eEPInP8YhpMIqYeEBVUUK3cawog4Co0WRCM0wDiS2eIx7NWIjSljz+Zi3H pV0LExMnzzAEz4NLmoYKRS2XmdeYuTfArPYFnU0Oa5Y/fgCPaD3UjPxvWbU4XuDInN4RDPudm +T00mSDj5cp69l8VgdwN7srZlE/7kfZohdy/3nLD0= Arc-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none X-MS-Exchange-Crosstenant-Originalarrivaltime: 05 Oct 2019 09:34:09.6526 (UTC) Autocrypt: addr=Ingo@Hoeft-online.de; prefer-encrypt=mutual; keydata= mQENBE6TdW8BCADAHqV+5rhJmkU3vZDM/SAYqM1PKy+p2JnNYO4RJeI93E+ChZePPSGv40ho sPzBdUycqelpsE4agLwcj4l0McKYichPyzO7jVwm8mOwiaQ29zYbLtFHDMYpGviro0NxbNk8 8JAwSMkuVfHs+nr91bt638NkDMld8foWhuGhok5CWrc2eOxzziYAoFpdFgm6HVwZjS2UFYJg WhDQQgNZHa1XocN0E4spZtNCMez23RVfG4dSoyu2bv3AX8w50hJwe/719NxEv5TBw+DKDlaM MPacIDYEYPB6+S5gY0Noqp9Q45uY8zHd1XSxw27to9jdKqx66w5JIjK+TGrOvgVT1H3jABEB AAG0KEluZ28gSG9lZnQgT25saW5lIDxJbmdvQEhvZWZ0LW9ubGluZS5kZT6JATgEEwECACIF AlHSpyECGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEL4J6vd9+ANEMXUH/2gmljFN RKZ2H5hBvwJvF9d44R1/L7ZqonKkn+UsCjIz7q2+VslUtyqm3Wh00ysDDq8ZCEPiu85Gtut7 HjU8KJ67KpBcMdM/IGJ61K3wXk+fM4jIdaZM+gKI+OXoO/VUfo85B0P61Jk8GraIUrIH8yoh w4gBYNfaQudkMrX+9TKuVw6E0cKJtO6In1+rAsn4ks7eB0RF/mbSJoj/f4NNw8zO3uhmE2E6 dVqfTsHMOfj7M+tfOMgiAbYiE6fdS+EWosCNf82MCdeNzTBQDAwasqzZiJf+eklyCgjfECAn z7TeBcsqQheASo6WKXJZmzLlTqd7Sd9r+Ps78YJbgRGdKtK5AQ0ETpN1bwEIAMDCVhlzb3uX xi1/V+KMKObYBaX1YPO/PcBpn8HSTkNHByqnCAR67HtDrMqtYezvsflVDPpdCiOUTCS0XY+z gDkT64qJxq61+rkMD2xJ4xRgGaaYqFtAzbB1MEAQv2+ySoO2uHVqrxMUkRnCK7SJmDPxHSvS C81Xq7V0YoCivCh9t+p0Gm5nIgQw+24faXfVrXjoU16/+qSfXvlcatZTi7kMdZhMAapiypXp yXlBdQCT+VO2Wq00XffrCFaoqJR6O+hD9xvyKF8Ima24y4Ex5hKq559asltubg2/fXjF3GoQ QM54XXhKqMSm2C30otIJHqSrgWLJULf8iUsFMLQ/N7EAEQEAAYkBHwQYAQIACQUCTpN1bwIb DAAKCRC+Cer3ffgDRD9ZCACiTsblInSD/jteZfLgdYQD/s1Pu9LN62E+Yi7VIAAztCm6Kvn7 /iWqfGj7jUb6lWma18iZYLsDiLjaXAB6jBjMVotDniPS9dM+1GblYcyDH+lVOMr7tgnqKZlj NSVrwtS+RCQ0k8VN5J03dHM2t5+00PLacKF0BJ+wriv0EQmCAnrRUh+KHjNK8ej4KUQPlh47 c029lxZJA4vt7rKmrTwYdeIJCQOhOx+eKFGGDTodJUFvI6hD4ehCJub/GMTUWgIN/VzXsHAe S7yM+MNSvX3Wor1UsP4hKB/RMpFRn4+D6nUaoACV/V7r8wenz1jykrAFt6822QutRaZ8UXkL vVXF Arc-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=a6QH8pFMuGzS1CV7vrhPW/LhV+bK38rxWXPrTHMdEemTCye+eKqKuher1GxqlIN2eFCn5ra/XijbqtYeK8GcTNMcNpf2FShk2ZNNObrgjprDg9f7t/7apNIwjLnRAsreEMlo7eDuK00kk4YRJ/taMZfxTVuGH3xL+ebd/j0aGSIqLbBbmimrKPn2Ec8L0xZcqVkB8Ndij72ZqM2/eWUfwRJiRcxHeZnyGR7wgiAdUlEqHvFcuAs1kmbf8LX5eecUxHmKM8kYP2z77eZrxiB6Zu/C6yt6S4kioaTSn3I3JF3AUqTnNkaOSUvQ9IwDnj4pf8CRoHKrRrJjoMoSGImxfg== X-Forefront-PRVS: 0181F4652A X-Eopattributedmessage: 0 X-Mailman-Approved-At: Sat, 05 Oct 2019 10:22:09 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 X-Beenthere: krb5-bugs-incoming@mailman.mit.edu X-Provags-ID: V03:K1:uq67edheRyh5m/OG+oHAsCcWW/UdS8EqVtezTB0txdncDAX04Iy FbHyNymhcG+8Sr94jysbWisCHf3DJ4kKh2cW+L323NCKNx48I/w1m/cgdZHE2+ktTzxeKzE pRxkEHAaIHyQZOs4HRkh8COB/Z8AMyXYRmy2X+f+AekImCS9/qIas8BOJdtsVHC1siqYhcb sTlAA1r515PpS7nTTSf7Q== X-MS-Publictraffictype: Email X-MS-Exchange-Transport-Crosstenantheadersstamped: BYAPR01MB3639 Content-Transfer-Encoding: 8bit X-Forefront-Antispam-Report: CIP:212.227.126.133; IPV:NLI; CTRY:DE; EFV:NLI; SFV:NSPM; SFS:(10019020)(4636009)(136003)(396003)(39860400002)(346002)(376002)(428003)(189003)(199004)(8156004)(446003)(956004)(2361001)(246002)(47776003)(122186004)(476003)(126002)(23676004)(486006)(2616005)(11346002)(31686004)(50466002)(5660300002)(336012)(229853002)(70586007)(68406010)(2486003)(76176011)(53546011)(26005)(31696002)(80792005)(2160300002)(58126008)(4744005)(316002)(786003)(356004)(2171002)(2906002)(34206002)(7636002)(6246003)(2870700001)(8676002)(2351001)(86362001)(305945005)(7596002)(16003)(36756003)(498600001)(65956001)(65806001); DIR:OUT; SFP:1102; SCL:1; SRVR:BYAPR01MB3639; H:mout.kundenserver.de; FPR:; SPF:None; LANG:en; PTR:mout.kundenserver.de; MX:1; A:1; X-MS-Exchange-Crosstenant-Fromentityheader: Internet X-MS-Oob-TLC-Oobclassifiers: OLM:529; Openpgp: preference=signencrypt Date: Sat, 5 Oct 2019 11:34:08 +0200 X-MS-Office365-Filtering-Correlation-ID: dba8f9d8-b940-4754-fe81-08d749772ce3 X-MS-Exchange-Atpmessageproperties: SA RT-Message-ID: Content-Length: 978 On 2019-10-03 17:56, Greg Hudson via RT wrote: > Do you have a setting for dns_canonicalize_hostname in krb5.conf? This is what I use, same on master and replica KDC: ~$ cat /etc/krb5.conf [libdefaults] default_realm = EXAMPLE.COM forwardable = true proxiable = true [realms] EXAMPLE.COM = { kdc = kdc10-1.example.com kdc = kdc10-2.example.com master_kdc = kdc10-1.example.com admin_server = kdc10-1.example.com } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM ~$ sudo cat /etc/krb5kdc/kdc.conf [kdcdefaults] [realms] EXAMPLE.COM = { database_name = /var/lib/krb5kdc/principal admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab acl_file = /etc/krb5kdc/kadm5.acl key_stash_file = /etc/krb5kdc/stash max_life = 10h 0m 0s max_renewable_life = 7d 0h 0m 0s master_key_type = des3-hmac-sha1 default_principal_flags = +preauth }