CONTAP-179466: SecD unresponsive due to Multiple KRB5KRB_AP_ERR_MODIFIED errors
Issue
- Whenever CIFS authentication fails with KRB5KRB_AP_ERR_MODIFIED error, Certain memory chunks aree not cleard correctly within the Security daemon (SecD)
- Such continuous failures will eventually result in SecD becoming unresponsive
- EMS
Example:
Mon Mar 31 09:03:15 +0900 [XXX: secd: secd.cifsAuth.problem:error]: vserver (XXX) General CIFS authentication problem. Error: User authentication procedure failed CIFS SMB2 Share mapping - Client Ip = XXX
[ 0 ms] Login attempt by domain user 'XXX' using NTLMv2 style security
[ 11693] TCP connection to ip XXX, port 445 failed: Operation timed out.
[ 11693] Could not open a socket to 'XXX'
[ 11693] Unable to connect to NetLogon service on XXX (Error: RESULT_ERROR_SPINCLIENT_UNABLE_TO_RESOLVE_SERVER)
[ 13694] TCP connection to ip XXX, port 445 failed: Operation timed out.
[ 13694] Could not open a socket to 'XXX'
[ 13694] Unable to connect to NetLogon service on XXX (Error: RESULT_ERROR_SPINCLIENT_UNABLE_TO_RESOLVE_SERVER)
[ 13695] Successfully connected to ip XXX, port 445 using TCP
[ 13704] Encountered NT error (NT_STATUS_MORE_PROCESSING_REQUIRED) for SMB command SessionSetup
[ 13707] Message stream modified ({*}KRB5KRB_AP_ERR_MODIFIED{*})
[ 13707] Kerberos authentication failed with result: 7541.
[ 13713] Successfully connected to ip XXX, port 88 using TCP
[ 13720] Encountered NT error (NT_STATUS_MORE_PROCESSING_REQUIRED) for SMB command SessionSetup
[ 13721] Message stream modified (KRB5KRB_AP_ERR_MODIFIED)
[ 13721] Kerberos authentication failed with result: 7541.
[ 13721] Unable to connect to NetLogon service on XXX (Error: RESULT_ERROR_KERBEROS_MODIFIED)
[ 13722] No servers available for MS_NETLOGON, vserver: 10, domain: XXX. **
[ 13722] FAILURE: Unable to make a connection (NetLogon:XXX), Result: RESULT_ERROR_SECD_NO_SERVER_AVAILABLE
[ 13722] CIFS authentication failed
[ 13722] Retry requested, but the retry window (7000 ms) has expired; giving up.
Mon Mar 31 09:03:37 +0900 [XXX: secd: kern.vm.mmap.return:notice]: mmap(2) by secd (pid 10856) for size 201326592 failed: VMEM limit exceeded, limit 2139826585, error 12.