Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Question: how can I influence the kerberos realm that Time Machine, or more specifically NetAuthSysAgent, uses?

Time Machine backups over the network are failing on OS X 10.7 / 10.8 clients except immediately after the clients have booted.

Some details on the setup:

  • Time Machine server has been set up on a Mac Mini running 10.7 Server, with working Open Directory and network home directory setups.
  • A separate network user 'tmuser' has been set up, and clients have the authentication credentials saved when the network Time Machine volume has been selected. This is verified with the 'tmutil' command.
  • After a fresh boot of the clients, backup succeeds.

Symptoms when things don't work:

  • The message from Time Machine is an unhelpful 'backup disk is not available'.
  • Client logs indicate that NetAuthSysAgent, presumably on behalf of backupd, is attempting to authenticate using the wrong kerberos realm:
    22/01/2013 14:54:45.055 NetAuthSysAgent[3460]: NAHSelectionAcquireCredential complete: iakerb D0AA44709194190C3ED5CD252FBD41EF - tmuser: GSSCred: 0x7fd63cc254a0 
    22/01/2013 14:54:45.174 NetAuthSysAgent[3460]: NAHSelectionAcquireCredential The operation couldn’t be completed. (com.apple.NetworkAuthenticationHelper error -1765328228 - acquire_kerberos failed tmuser@LOCAL: -1765328228 - unable to reach any KDC in realm LOCAL)
    22/01/2013 14:54:45.772 NetAuthSysAgent[3460]: NAHSelectionAcquireCredential complete: iakerb D0AA44709194190C3ED5CD252FBD41EF - tmuser: GSSCred: 0x7fd63ae14be0 
    22/01/2013 14:54:45.915 NetAuthSysAgent[3460]: NAHSelectionAcquireCredential The operation couldn’t be completed. (com.apple.NetworkAuthenticationHelper error -1765328228 - acquire_kerberos failed tmuser@LOCAL: -1765328228 - unable to reach any KDC in realm LOCAL)
  • However I am able to successfully 'kinit' for tmuser, whereupon the correct realm is used.

[ilo-robbie@cleveland:~]$ kinit tmuser
tmuser@ZOIDBERG.LOCAL's Password:
[ilo-robbie@cleveland:~]$ klist
Credentials cache: API:502:6
        Principal: tmuser@ZOIDBERG.LOCAL

  Issued                Expires               Principal
Jan 22 14:54:25 2013  Jan 23 00:54:20 2013  krbtgt/ZOIDBERG.LOCAL@ZOIDBERG.LOCAL
[ilo-robbie@cleveland:~]$
share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.