I'm seeing this error message:

NEEDED_PREAUTH: admin@THIS.LAN for for kadmin/admin@THIS.LAN, Additional pre-authentication required

How do I disable Kerberos pre-authentication? The server and client do not have access to UDP on port 123, i.e., NTP, and I cannot change that -- and this is important for syncing the times as required by Kerberos.

Following up on a reference inspired by the answer below, the answer is to use modify_principal *user* -requires_preauth in kadmin.

  • Kerberos clients should automatically failover to TCP if UDP doesn't work. What's the error you're seeing? – Bratchley Aug 7 '15 at 18:44
  • Is this related to your home directory question? If so, what are you using for Kerberos? – Bratchley Aug 7 '15 at 18:47
  • this one – Bratchley Aug 7 '15 at 20:09
  • They are related. – Donnied Aug 8 '15 at 20:49

Based on the kadmin/admin part of your output, I'm going to assume you're trying to run kadmin.

It's impossible to run kadmin without entering a password. Even though it's possible to disable the requires_preauth attribute with the modprinc command inside kadmin, kadmin itself does not honour that attribute and always requires authentication.

If you need to be able to run some kadmin commands without entering a password (e.g., in a script or something), use kadmin.local. That can only be done as root on your master KDC, though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.