0

When authenticating to kadmin with one client of many, it fails with 

kadmin: GSS-API (or Kerberos) error while initializing kadmin interface.

The Kerberos host is specified with its subnet address.

I've seen this error attributed to NTPD sync errors, but I can't discern that the ntp(d) setup is any different on this one particular client. What should I check for? With regards to NTP? Kerberos? GSS? Whaty would be a quick way to compare the Kerberos / LDAP files for a working client with the non-working client? (Surely, there's a list of all the files affected/affecting LDAP/Kerberos authentication?)

Improve this question
1
  • Maybe DNS problem. Quote from FreeBSD guide: All hosts in the realm must be both forward and reverse resolvable in DNS or, at a minimum, exist in /etc/hosts. CNAMEs will work, but the A and PTR records must be correct and in place. The error message for unresolvable hosts is not intuitive: Kerberos5 refuses authentication because Read req failed: Key table entry not found.
    – yaegashi
    Jul 31, 2015 at 2:07

1 Answer 1

Reset to default
0

Note: kinit worked, kadmin -p admin didn't owing to NTP/time issues.

I can't be the only person who gets stuck behind a firewall blocking port 123 --- which will cause this sort of error. (Time sync is needed for Kerberos authentication).

The solution:

  1. Configure the Kerberos server (or other server on LAN) as NTP server.
  2. Configure that server to update from its own clock
  3. Have the failing client sync its time to the local host

To reconfigure the local time server: 1. Add its own clock as a time source and allow connections from the network (even broadcast):

system ntp stop

pico /etc/ntp.conf

Add:

server 0.us.pool.ntp.org iburst
 server 1.us.pool.ntp.org iburst
 server 2.us.pool.ntp.org iburst
 server 3.us.pool.ntp.org iburst
 server 127.127.1.0
 server 127.127.1.0 stratum 10

The subnet:

restrict 10.0.0.0 mask 255.255.255.0

Broadcast:

broadcast 10.0.0.255

As root, then:

system ntp start

On the client:

ntpdate -bs 10.0.0.1 #whatever the local ntp host is
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .