0

I installed it following instructions from digital ocean how-to-install-postgresql-on-ubuntu-20-04-quickstart:

% sudo apt install postgresql postgresql-contrib

I also did a 'show all' in psql and didn't see anything that suggested it was other than the krb_server_keyfile = /etc/krb5.keytab that I configured in postgresql.conf

These are the errors I see in the log:

2021-05-07 21:58:49.990 UTC [1434] postgres@postgres LOG:  accepting GSS security context failed
2021-05-07 21:58:49.990 UTC [1434] postgres@postgres DETAIL:  Unspecified GSS failure.  Minor code may provide more information: Key table entry not found
2021-05-07 21:58:49.990 UTC [1434] postgres@postgres FATAL:  GSSAPI authentication failed for user "postgres"
2021-05-07 21:58:49.990 UTC [1434] postgres@postgres DETAIL:  Connection matched pg_hba.conf line 114: "host postgres     postgres           172.31.93.176/24                              gs\
s include_realm=0"
2021-05-07 21:58:49.993 UTC [1435] postgres@postgres LOG:  accepting GSS security context failed
2021-05-07 21:58:49.993 UTC [1435] postgres@postgres DETAIL:  Unspecified GSS failure.  Minor code may provide more information: Key table entry not found
2021-05-07 21:58:49.993 UTC [1435] postgres@postgres FATAL:  GSSAPI authentication failed for user "postgres"
2021-05-07 21:58:49.993 UTC [1435] postgres@postgres DETAIL:  Connection matched pg_hba.conf line 114: "host postgres     postgres           172.31.93.176/24                              gs\
s include_realm=0"
1
  • 1
    You get this rather unhelpful error when the keytab file does not exist or cannot be read or cannot be parsed. Did you create a /etc/krb5.keytab and does it work? You didn't describe doing so, and the tutorial you link to doesn't either. – jjanes May 9 at 2:44
1

First, let me add some more description of the environment where this problem was observed.

This excellent series of articles describes setting up kerberos and postgresql

PostgreSQL GSSAPI Authentication with Kerberos

  1. Part-1
  2. Part-2
  3. Part-3

If you do this in AWS, you should also setup elastic-ip addresses (so you can stop and start your servers). I also setup rt53 for the host names and have those map to the elastic-ip addresses you setup.

Note: in my case I am using postgresql v13 and after my initial failure, I followed these instructions on the postgressql for installing postgresql.

You would think that would be enough. However, if you don't tweak the /etc/hosts file so that you have entries for your servers (as David did in his example, that was on 'in-house' hardware) you get this error:

postgres@jl-krb5dev-client:~$ psql -U postgres -d postgres -h
jl-krb5dev-postgres.matlabonlineserver.com psql: error: could not
initiate GSSAPI security context: Unspecified GSS failure.  Minor code
may provide more information: Server
krbtgt/COMPUTE-1.AMAZONAWS.COM@MATLABONLINESERVER.COM not found in
Kerberos database FATAL:  no pg_hba.conf entry for host "52.70.13.95",
user "postgres", database "postgres", SSL on FATAL:  no pg_hba.conf
entry for host "52.70.13.95", user "postgres", database "postgres",
SSL off

But if you add entries in the /etc/hosts file on your client machine for the kerberos and postgresql machines (using the elastic-ip addresses you setup earlier) everything works fine.

Note: this does require that you properly configured postgres with a keytab file. For v13 of postgresql, I put it in /etc/postgresql/13/main/conf.d/krb5.keytab AND adjusted the postgresql.conf file (in /etc/postgresql/13/main) so that it has an entry like this: krb_server_keyfile = 'FILE:/etc/postgresql/13/main/conf.d/krb5.keytab

A Big Thanks to @jjanes for getting me on the right path in the comment to my initial question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.