Sample Header Ad - 728x90

Bursts of errors "Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client (...) not found in Kerberos database."

1 vote
0 answers
744 views
I have set up some RHEL9 servers to authenticate through the AD for the domain EXAMPLE.XYZ; this is done via Ansible playbooks, and so far all works well. (It's the same setup as this previous question: https://unix.stackexchange.com/questions/786569/joining-domain-via-ansible-returns-error-already-joined-to-this-domain-while-v) However, every few minutes, on each host (let's say on myhost42) there are bursts of error messages, several times per second, in /var/log/messages: Feb 19 15:23:32 myhost42 ldap_child: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'MYHOST42$@EXAMPLE.XYZ' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. This is the /etc/krb5.conf file: includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false dns_lookup_kdc = true ticket_lifetime = 24h renew_lifetime = 7d rdns = false forwardable = true default_realm = EXAMPLE.XYZ default_ccache_name = KEYRING:persistent:%{uid} udp_preference_limit = 0 [realms] [domain_realm] What can be done to troubleshoot the issue? --- EDIT #1: Based on a comment below and my researches, it might be due to a missing association between the AD domain and the Kerberos realm and/or missing entries in the Kerberos keytab.
However, I'm using the same configuration as another server farm, which works correctly.
This is the output of klist -kt /etc/krb5.keytab: Keytab name: FILE:/etc/krb5.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 3 02/25/2025 15:53:24 MYHOST42$@EXAMPLE.XYZ 3 02/25/2025 15:53:24 MYHOST42$@EXAMPLE.XYZ 3 02/25/2025 15:53:24 host/MYHOST42@EXAMPLE.XYZ 3 02/25/2025 15:53:24 host/MYHOST42@EXAMPLE.XYZ 3 02/25/2025 15:53:24 host/myhost42.EXAMPLE.XYZ@EXAMPLE.XYZ 3 02/25/2025 15:53:24 host/myhost42.EXAMPLE.XYZ@EXAMPLE.XYZ 3 02/25/2025 15:53:24 RestrictedKrbHost/MYHOST42@EXAMPLE.XYZ 3 02/25/2025 15:53:24 RestrictedKrbHost/MYHOST42@EXAMPLE.XYZ 3 02/25/2025 15:53:24 RestrictedKrbHost/myhost42.EXAMPLE.XYZ@EXAMPLE.XYZ 3 02/25/2025 15:53:24 RestrictedKrbHost/myhost42.EXAMPLE.XYZ@EXAMPLE.XYZ
Asked by dr_ (32068 rep)
Feb 19, 2025, 02:45 PM
Last activity: Feb 26, 2025, 10:57 AM