Bursts of errors "Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client (...) not found in Kerberos database."
1
vote
0
answers
744
views
I have set up some RHEL9 servers to authenticate through the AD for the domain EXAMPLE.XYZ; this is done via Ansible playbooks, and so far all works well. (It's the same setup as this previous question: https://unix.stackexchange.com/questions/786569/joining-domain-via-ansible-returns-error-already-joined-to-this-domain-while-v)
However, every few minutes, on each host (let's say on myhost42) there are bursts of error messages, several times per second, in
However, I'm using the same configuration as another server farm, which works correctly.
This is the output of
/var/log/messages
:
Feb 19 15:23:32 myhost42 ldap_child: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'MYHOST42$@EXAMPLE.XYZ' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.
This is the /etc/krb5.conf
file:
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
rdns = false
forwardable = true
default_realm = EXAMPLE.XYZ
default_ccache_name = KEYRING:persistent:%{uid}
udp_preference_limit = 0
[realms]
[domain_realm]
What can be done to troubleshoot the issue?
---
EDIT #1: Based on a comment below and my researches, it might be due to a missing association between the AD domain and the Kerberos realm and/or missing entries in the Kerberos keytab.However, I'm using the same configuration as another server farm, which works correctly.
This is the output of
klist -kt /etc/krb5.keytab
:
Keytab name: FILE:/etc/krb5.keytab
KVNO Timestamp Principal
---- ------------------- ------------------------------------------------------
3 02/25/2025 15:53:24 MYHOST42$@EXAMPLE.XYZ
3 02/25/2025 15:53:24 MYHOST42$@EXAMPLE.XYZ
3 02/25/2025 15:53:24 host/MYHOST42@EXAMPLE.XYZ
3 02/25/2025 15:53:24 host/MYHOST42@EXAMPLE.XYZ
3 02/25/2025 15:53:24 host/myhost42.EXAMPLE.XYZ@EXAMPLE.XYZ
3 02/25/2025 15:53:24 host/myhost42.EXAMPLE.XYZ@EXAMPLE.XYZ
3 02/25/2025 15:53:24 RestrictedKrbHost/MYHOST42@EXAMPLE.XYZ
3 02/25/2025 15:53:24 RestrictedKrbHost/MYHOST42@EXAMPLE.XYZ
3 02/25/2025 15:53:24 RestrictedKrbHost/myhost42.EXAMPLE.XYZ@EXAMPLE.XYZ
3 02/25/2025 15:53:24 RestrictedKrbHost/myhost42.EXAMPLE.XYZ@EXAMPLE.XYZ
Asked by dr_
(32068 rep)
Feb 19, 2025, 02:45 PM
Last activity: Feb 26, 2025, 10:57 AM
Last activity: Feb 26, 2025, 10:57 AM