Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Question: how can I influence the kerberos realm that Time Machine, or more specifically NetAuthSysAgent, uses?

Time Machine backups over the network are failing on OS X 10.7 / 10.8 clients except immediately after the clients have booted.

Some details on the setup:

  • Time Machine server has been set up on a Mac Mini running 10.7 Server, with working Open Directory and network home directory setups.
  • A separate network user 'tmuser' has been set up, and clients have the authentication credentials saved when the network Time Machine volume has been selected. This is verified with the 'tmutil' command.
  • After a fresh boot of the clients, backup succeeds.

Symptoms when things don't work:

  • The message from Time Machine is an unhelpful 'backup disk is not available'.
  • Client logs indicate that NetAuthSysAgent, presumably on behalf of backupd, is attempting to authenticate using the wrong kerberos realm:
    22/01/2013 14:54:45.055 NetAuthSysAgent[3460]: NAHSelectionAcquireCredential complete: iakerb D0AA44709194190C3ED5CD252FBD41EF - tmuser: GSSCred: 0x7fd63cc254a0 
    22/01/2013 14:54:45.174 NetAuthSysAgent[3460]: NAHSelectionAcquireCredential The operation couldn’t be completed. (com.apple.NetworkAuthenticationHelper error -1765328228 - acquire_kerberos failed tmuser@LOCAL: -1765328228 - unable to reach any KDC in realm LOCAL)
    22/01/2013 14:54:45.772 NetAuthSysAgent[3460]: NAHSelectionAcquireCredential complete: iakerb D0AA44709194190C3ED5CD252FBD41EF - tmuser: GSSCred: 0x7fd63ae14be0 
    22/01/2013 14:54:45.915 NetAuthSysAgent[3460]: NAHSelectionAcquireCredential The operation couldn’t be completed. (com.apple.NetworkAuthenticationHelper error -1765328228 - acquire_kerberos failed tmuser@LOCAL: -1765328228 - unable to reach any KDC in realm LOCAL)
  • However I am able to successfully 'kinit' for tmuser, whereupon the correct realm is used.

[ilo-robbie@cleveland:~]$ kinit tmuser
tmuser@ZOIDBERG.LOCAL's Password:
[ilo-robbie@cleveland:~]$ klist
Credentials cache: API:502:6
        Principal: tmuser@ZOIDBERG.LOCAL

  Issued                Expires               Principal
Jan 22 14:54:25 2013  Jan 23 00:54:20 2013  krbtgt/ZOIDBERG.LOCAL@ZOIDBERG.LOCAL
[ilo-robbie@cleveland:~]$
share|improve this question
add comment

1 Answer

I have the same problem my 10.7 Mac is okay but my wife's 10.8 Mac is refusing to connect to the time machine. When it attempts to mount the drive I get an OSStatus error 5 but on closer inspection in the console I can see we have the following error:

30/01/2013 21:26:54.097 NetAuthSysAgent[3722]: NAHSelectionAcquireCredential The operation couldn’t be completed. (com.apple.NetworkAuthenticationHelper error -1765328228 - acquire_kerberos failed xxxx@LOCAL: -1765328228 - unable to reach any KDC in realm LOCAL) Blockquote

We had an earlier problem where we couldn't mount any drives on the server, which I solved with help from another superuser post. But the password database synchronisation seems to have left the Time Machine out.

The Time Machine server is a 10.6 Mac Mini Server.

Any ideas would be appreciated.

share|improve this answer
1  
This is not really an answer and would be better as a comment –  Dave M Jan 30 '13 at 22:36
    
Sorry a new user mistake I thought I was adding it as a comment. –  MattF Feb 5 '13 at 8:23
    
I have resolved my problem by resetting the affected user's password as per my referred post and restarting both the client and the server. This seems to have cleared the Kerberos password caches and reset them to the same value. –  MattF Feb 5 '13 at 8:25
    
As mentioned in the OP, the clients have always successfully backed up after a fresh boot. Are your backups working after sleeps / a long period of time has passed? –  sohocoke Apr 24 '13 at 19:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.