Using a Debian system with a Kerberos/LDAP client - login fails on KDE as a user directory isn't being created. SSH is successful (and no directory is created); however, desktop login isn't. I've added the line:

session  required       pam_mkhomedir.so skel=/etc/skel/ umask=0022

to /etc/pam.d/common-session without success. In /var/log/auth.log on the Kerberos/LDAP server , I see:

NEEDED_PREAUTH: user@MY.LAN for krbtgt/MY.LAN@MY.LAN, Additional pre-authentication required

What's missing? I have other clients working. I'm not sure what the difference is.


The failure here a time sync issue. If times are off - a Preauth error is generated by Kerberos (the case here). Part of the problem was that NTP ports were blocked to the outside world.

The solution was to manually sync with the Kerberos host's time:

ntpdate -bs 10.x.x.x #whatever the local NTP server's address is

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.