bibliography.md is spelt wrong

Author: steveloughran

SUMMARY.md

@@ -19,5 +19,5 @@
 * [The Limits of Hadoop Security](sections/the_limits_of_hadoop_security.md)
 * [Checklists](sections/checklists.md)
 * [Glossary](sections/glossary.md)
-* [Bibliography](sections/biblography.md)
+* [Bibliography](sections/bibliography.md)
 * [Acknowledgements](sections/acknowledgements.md)

sections/biblography.md renamed to sections/bibliography.md

@@ -13,12 +13,7 @@
 -->
 # Bibliography
 
-1. IETF [RFC 4120](https://www.ietf.org/rfc/rfc4120.txt)
-1. [Adding Security to Apache Hadoop](http://hortonworks.com/wp-content/uploads/2011/10/security-design_withCover-1.pdf)
-1. [The Role of Delegation Tokens in Apache Hadoop Security](http://hortonworks.com/blog/the-role-of-delegation-tokens-in-apache-hadoop-security/)
-1. [Chapter 8. Secure Apache HBase](http://hbase.apache.org/book/security.html)
-1. Hadoop Operations p135+
-1. [OMalley14] [Hadoop Security Architecture](http://www.slideshare.net/oom65/hadoop-security-architecture?)
+1. [IETF RFC 4120](https://www.ietf.org/rfc/rfc4120.txt)
 1. [Java 7 Kerberos Requirements](http://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/KerberosReq.html)
 1. [Java 8 Kerberos Requirements](http://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/tutorials/KerberosReq.html)
 1. [Troubleshooting Kerberos on Java 7](http://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/Troubleshooting.html)
@@ -31,7 +26,19 @@
 1. [Kerberos FAQ](http://www.cmf.nrl.navy.mil/krb/kerberos-faq.html). Dates from 2000; many of the links are worthless
 1. [Kerberos With Clocks Adrift: History, Protocols, and Implementation](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.204.9216&rep=rep1&type=pdf)
 
-### Kerberos, Active Directory and Apache Hadoop
+
+## Hadoop Security
+
+1. [Adding Security to Apache Hadoop](http://hortonworks.com/wp-content/uploads/2011/10/security-design_withCover-1.pdf)
+1. [The Role of Delegation Tokens in Apache Hadoop Security](http://hortonworks.com/blog/the-role-of-delegation-tokens-in-apache-hadoop-security/)
+1. [Chapter 8. Secure Apache HBase](http://hbase.apache.org/book/security.html)
+1. Hadoop Operations p135+
+1. [Hadoop Security Architecture](http://www.slideshare.net/oom65/hadoop-security-architecture)
+1. [HADOOP-9621] Document/analyze current Hadoop security model, [HADOOP-9621)(https://issues.apache.org/jira/browse/HADOOP-9621)
+
+
+
+## Kerberos, Active Directory and Apache Hadoop
 
 1. [Microsoft Technet Introduction to Kerberos](https://technet.microsoft.com/en-us/library/cc772815(v=ws.10).aspx)
 1. [Kabakov14], Kabakov,

sections/errors.md

@@ -41,6 +41,24 @@ Here are some of the common ones seen in Hadoop stack traces *and what we think
 That is: on one or more occasions, the listed cause was the one which, when corrected, made
 the stack trace go away.
 
+
+## `GSS initiate failed` —no further details provided
+
+```
+WARN  ipc.Client (Client.java:run(676)) - Couldn't setup connection for [email protected] to /172.22.97.127:8020
+org.apache.hadoop.ipc.RemoteException(javax.security.sasl.SaslException): GSS initiate failed
+	at org.apache.hadoop.security.SaslRpcClient.saslConnect(SaslRpcClient.java:375)
+	at org.apache.hadoop.ipc.Client$Connection.setupSaslConnection(Client.java:558)
+```
+
+This is widely agreed to be one of the most useless of error messages you can see. The only
+ones that are worse than this are those which disguise a Kerberos problem, such as when ZK
+closes the connection rather than saying "it couldn't authenticate".
+
+If you see this connection, work out which service it was trying to talk to —and look in its
+logs instead. Maybe, just maybe, there will be more information there.
+
+
 ## `Server not found in Kerberos database (7)` or `service ticket not found in the subject`
 
 * DNS is a mess and your machine does not know its own name.