Solved

kerberos "client and server clocks must be synchronized"

Posted on 2004-09-28
7
578 Views
Last Modified: 2013-11-17
Hello,
I am having an issue on AIX 4.3.3 with kerberos and sp complex,

after I built new keys on the control workstation which are under /tftpboot and place the new krb-srvtab files on all the systems I start haveing errors show up like the following:
(the xxx has been put in place of real names)

rcmdtgt:  2502-052 Error getting service ticket for rcmd.xxx@xxx.COM
2504-037 Kerberos error: client and server clocks must be synchronized.
2502-603 You do not have Kerberos credentials.
kdestroy: 2502-000 No tickets to destroy.

checking the date shows i was off by as much as 40 minutes apart on 3 systems.. out of 10.
2 nodes on frame 1 and 1 of the nodes on frame 2, so its not frame specific.

after issuing the command on the cws  # dsh -av date 09281200.0004 to synchronize all the times and dates, I noticed after 15 minutes that those 3 systems are now 2 minutes behind still.

I issued the command on those nodes
# ntpdate –d <CWS en0 IP address>
# xntpdc -p
(they all came back with no errors)

still now after 30 minutes i show 3 minutes lost and counting on those nodes.
xntp is running on the cws. as well as all the nodes.
they were all rebooted 13 hours ago.

I also noticed that the /etc/ntp.drift file shows a very large negative number like
-28527.43530 and -28527.42709 and -28527.43530 for those 3 nodes.
versus a node that is stiill in sync. with a ntp.drift of 8.23453

can someone help???


0
Comment
Question by:magnixus
  • 3
  • 2
7 Comments
 
LVL 62

Expert Comment

by:gheist
ID: 12177966
You need to set up ntp to work perfectly:
One or two master servers where:
- ntp.conf points to server 127.127.1.0 (local clock), which is unstable and free
- ntp.conf gathers time signals over internet, which is free and fairly accurate
- ntp feeds from some other GPS receiver or so (http://www.eecis.udel.edu/~mills/ntp/html/refclock.html), which is a bit more accurate and costs some money
All others have ntp.conf pointing to those servers
Windows use w32tm service (aka "Windows Time", set by net time /setsntp:10.0.0.9, checked by w32tm /once)
0
 

Author Comment

by:magnixus
ID: 12182190
Thanks gheist , but we do not use the internet to gather signals, we have a company the SP nodes pull there signals from thier internal clock or the control workstation and the the control workstation pulls its signals from a company DNS server, which in turn gets a clock update from an atomic clock a via stratum system.

However I did fix it..

here is what I did.
- On each node I ran the following:
1. I edited the /etc/ntp.drift files by removing the negative -2xxxx.xxxxx number and added a 8.xxxx number in its place and saved it. ( i simply found a node who's clock was in constant sync and used the data from its ntp.drift file which was a 8.xxxxx number)

2. I killed the xntpd process

3. I ran the ntpdate -d 127.30.1.1 (this updates the clock timestamps from the control workstation 127.30.1.1)

4. I then restarted the xntpd process by running  rc.ntp

5. I then ran xntpdc -p

- Then on the control workstation I ran
#dsh -av date 09281715.00.04  
this syncs all the nodes clocks.
Its been 17 some hours and all is still in sync problem fixed.
(problem resolved myself) thanks for the input.
0
 
LVL 62

Accepted Solution

by:
gheist earned 500 total points
ID: 12206102
1. 0.0 can be put in drift file, ntp then recalulates drifts, so nodes can run without ntp source for some time without external source
2. stopsrc/startsrc is correct way of restarting daemons
3. this was necessary because time offset on SP nodes was too big and xntpd was not syncing anymore
4. read 2
5. read 2

to sync date stopsrc xntpd ; ntpdate ntp_server ; echo 0.0 > /etc/ntp.drift ; startsrc xntpd is more than enough

older AIX has old xntpd, whish exits randomly when source is lost for prolonged period. adding server 127.0.0.1 (always nonworking) will fix that exit problem, just as patching xntpd using ML patches
0
 

Author Comment

by:magnixus
ID: 12842622
Venabili,

I commented that I fixed it anyhow. see Date: 09/29/2004 10:28AM PDT

I explain in detail what I did.

can I get my points back or however that works?

thanks.
0
 
LVL 62

Expert Comment

by:gheist
ID: 12844250
I tried to point you to "correct" way of starting ntpd on AIX, nothing more.
0

Featured Post

ScreenConnect 6.0 Free Trial

Discover new time-saving features in one game-changing release, ScreenConnect 6.0, based on partner feedback. New features include a redesigned UI, app configurations and chat acknowledgement to improve customer engagement!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Hello fellow BSD lovers, I've created a patch process for patching openjdk6 for BSD (FreeBSD specifically), although I tried to keep all BSD versions in mind when creating my patch. Welcome to OpenJDK6 on BSD First let me start with a little …
Let's say you need to move the data of a file system from one partition to another. This generally involves dismounting the file system, backing it up to tapes, and restoring it to a new partition. You may also copy the file system from one place to…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question