Scenario | Cause | Troubleshooting Tips |
Permission
denied while initializing krb5. | The /opt/krb5/krb.conf file is set to read-only by root. | Reset the permissions to 644. |
Host name cannot be made canonical while selecting
the best principal. | The hostname is longer than 8 characters.
A uname -n returns the first 8 characters of the name. | Add the 8 character name to the /etc/hosts file (just tack it on to the end of the current
IP address or host name entry). |
ASN.1 failed call to system time library while
dispatching. | This message is usually displayed when
a client is requesting a krbtgt with a bad lifetime value. | |
Clock skew too great in KDC reply while
getting initial credentials. | This problem generally occurs because
the clock of the system deviates too much from the time on the authenticating KDC.
A clock skew time of up to 5 minutes is allowed. | You must run NTP or a similar service
to keep your system clock synchronize with the atomic clock of the
world. If you do not know how to do this, contact your system administrator to
resolve this problem. |
Requesting host principal without fully qualified
domain name. Server not found in the Kerberos database
while getting the credentials from KDC. Incorrect
network address while getting credentials from KDC. | The host uses the /etc/hosts file to resolve name lookups before using DNS.
This problem occurs when the entry for the host in the /etc/hosts file contains unqualified domain name before the
fully qualified domain name. This problem can also occur
if the /etc/hosts file has a different IP address for a host from what
the DNS server has. | |
The /opt/krb5/krb.conf file not found. | The krb.conf file has not been created. | Copy the sample file, krb.conf.sample, from /opt/krb5/example and edit accordingly. |
Cannot open or find the configuration
file while initializing the Kerberos code. | This problem occurs when you try to create the
database and the krb.conf file is not found in the /opt/krb5 directory. | Copy the sample file, krb.conf.sample, from /opt/krb5/example and edit accordingly. |
Required parameters in krb.realms missing while initializing the Kerberos context. | This problem occurs when the parameters
are missing or incorrect in the krb.realms file. | Ensure that the krb.realms file has the appropriate information. |
Stored master key is corrupted while initializing kadminl interface. | This message appears if the stash file
is corrupted. | Recreate the stash file. |
Cannot find or read stored master key
while getting the master key. | This problem occurs when the stash file
is missing. | Create the stash file |
Cannot open or find the Kerberos configuration file
while initializing the krb5 library. | This problem occurs when the krb.conf file does not exist. | |
Client/server realm mismatch in initial ticket
request while initializing the kadmin interface. | This problem occurs when you have an
old credential cache file, which has credentials for another realm. | Use the kdestroy utility to destroy your old credential cache or use the kadmin -p <pname> name. |
Cannot resolve network address for KDC
in the requested realm while getting initial credentials. | Check your resolv.conf file. | |
Decrypt integrity check failed while
verifying the master key. | This problem occurs when the passwords
do not match. | |
Decrypt integrity check failed while
initializing the kadminl interface. | This problem occurs when the passwords
do not match. | |
Cannot find/read stored master key while getting
master key. | This problem occurs when the stash file
is not found. | Provide the master key as a command-line option. You
can also create the stash file. |
Error verifying pre-authentication data type
2. | This problem occurs due to an incorrect password. | Enter the correct password. |
Service key not available while getting initial
credentials. | This problem can occur if your principal
has a 3DES key but not a DES key and the Kerberos client does not
support 3DES, or vice versa. | Create identical key types. |
Printable version
