Repeated secd.unexpectedFailure alerts during CIFS password reset/change operations
Applies to
- ONTAP 9
- CIFS
Issue
Getting repeated alerts:
[cluster: secd: secd.unexpectedFailure:error]: Unexpected SecD failure in Vserver "svm01". Details: Error: CIFS server password change procedure failed [1 ms] TCP connection to ip 10.xx.xx.210, port 88 failed: Network is unreachable.[4] TCP connection to ip 10.xx.xx.211, port 88 failed: Network is unreachable.[6] TCP connection to ip 10.xx.xx.212, port 88 failed: Network is unreachable.[8] TCP connection to ip 10.xx.xx.198, port 88 failed: Network is unreachable. **[10] FAILURE: CIFS server could not authenticate as 'svm01$@domain.com': Cannot contact any KDC for requested realm (KRB5_KDC_UNREACH)
secd.unexpectedFailure: Unexpected SecD failure in Vserver "fra_svm_data01". Details: Error: CIFS server password reset procedure failed [0ms] TCP connection to ip 10.xx.xx.210 , port 88 failed: Network is unreachable. [0] TCP connection to ip 10.xx.xx.211 , port 88 failed: Network is unreachable. [0] TCP connection to ip 10.xx.xx.212, port 88 failed: Network is unreachable. [1] TCP connection to ip 10.xx.xx.198, port 88 failed: Network is unreachable.
Audit M logs show API calls to modify CIFS server security from a specific external server:
00000013.01209ae7 0593d26f [kern_audit:info:2302] 8503e800013f1f2f :: cluster:ontapi :: 10.xx.xx.230:63224 :: svm01:admin :: <netapp version='1.7' xmlns='http://www.netapp.com/filer/admin' vfiler='svm01'><cifs-security-modify>^M <admin-password>XXX</admin-password>^M <admin-username>username-</admin-username>^M <is-aes-encryption-enabled>true</is-aes-encryption-enabled>^M <is-password-complexity-required>true</is-password-complexity-required>^M <is-signing-required>false</is-signing-required>^M <is-smb-encryption-required>false</is-smb-encryption-required>^M <kerberos-clock-skew>5</kerberos-clock-skew>^M <kerberos-renew-age>7</kerberos-renew-age>^M <kerberos-ticket-age>10</kerberos-ticket-age>^M <lm-compatibility-level>lm_ntlm_ntlmv2_krb</lm-compatibility-level>^M <session-security-for-ad-ldap>none</session-security-for-ad-ldap>^M <smb1-enabled-for-dc-... :: Pending:
00000013.01209b43 0593d270 [kern_audit:info:2302] 8503e800013f1f2f :: cluster:ontapi :: 10.xx.xx.230:63224 :: svm01:admin :: cifs-security-modify :: Error: Password update failed. Reason: Kerberos Error: KDC Unreachable.