由于 NTP 被拒绝,CIFS 因 KRB5KRB_AP_ERR_SKEW 而无法访问
适用于
- ONTAP 9
- CIFS
- Kerberos
问题
- 所有 Windows 客户端都失去了对 CIFS 共享的访问权限。
- 在 SECD 中发现错误:
Sun Jul 19 2020 16:49:44 [kern_secd:info:8268] | info : Cluster and Domain Controller times differ by more than the configured clock skew (KRB5KRB_AP_ERR_SKEW)- NTP 状态显示,由于时间偏差过大,两个已配置的 NTP 服务器均被拒绝:
NODE01::> set -privilege advanced
NODE01*::> cluster time-service ntp status show -node * -instance Node: NODE01
NTP Server Host Name, IPv4 or IPv6 Address: 10.1.2.2
Server IP Address: 10.1.2.2
Is Peer Reachable and Responding to Polls?: true
Is Peer Selected as Clock Source?: true
State of Server Selection: sys_peer
Description of Server Selection State: Server Rejected for Excessive Skew
Time from Last Poll (secs): 422
Offset from Server Time (ms): 13.77
Delay Time to Server (ms): 0.363
Maximum Offset Error (ms): 9.495
Reachability of Server: ff
Stratum of Server Clock: 2
Reference Clock at Server: 10.1.10.10
Reported Packet and Peer Errors: -
Node: NODE01
NTP Server Host Name, IPv4 or IPv6 Address: 10.1.1.3
Server IP Address: 10.1.1.3
Is Peer Reachable and Responding to Polls?: true
Is Peer Selected as Clock Source?: false
State of Server Selection: outlyer
Description of Server Selection State: Server Rejected for Excessive Skew
Poll Interval (secs): 524
Time from Last Poll (secs): 345
Offset from Server Time (ms): 15.796
Delay Time to Server (ms): 0.426
Maximum Offset Error (ms): 8.861
Reachability of Server: ff
Stratum of Server Clock: 3
Reference Clock at Server: 10.1.10.10
Reported Packet and Peer Errors: -