Common Kerberos Error Messages (A-M)

This section provides an alphabetical list (A-M) of common error messages for the Kerberos commands, Kerberos daemons, PAM framework, GSS interface, the NFS service, and the Kerberos library.

All authentication systems disabled; connection refused

Cause:

This version of rlogind does not support any authentication mechanism.

Solution:

Make sure that rlogind is invoked with the -k option.

Another authentication mechanism must be used to access this host

Cause:

Authentication could not be done.

Solution:

Make sure that the client is using Kerberos V5 mechanism for authentication.

Authentication negotiation has failed, which is required for encryption. Good bye.

Cause:

Authentication could not be negotiated with the server.

Solution:

Start authentication debugging by invoking the telnet command with the toggle authdebug command and look at the debug messages for further clues. Also, make sure that you have valid credentials.

Bad krb5 admin server hostname while initializing kadmin interface

Cause:

An invalid host name is configured for admin_server in the krb5.conf file.

Solution:

Make sure that the correct host name for the master KDC is specified on the admin_server line in the krb5.conf file.

Bad lifetime value

Cause:

The lifetime value provided is not valid or incorrectly formatted.

Solution:

Make sure that the value provided is consistent with the Time Formats section in the kinit(1) man page.

Bad start time value

Cause:

The start time value provided is not valid or incorrectly formatted.

Solution:

Make sure that the value provided is consistent with the Time Formats section in the kinit(1) man page.

Cannot contact any KDC for requested realm

Cause:

No KDC responded in the requested realm.

Solution:

Make sure that at least one KDC (either the master or a slave) is reachable or that the krb5kdc daemon is running on the KDCs. Check the /etc/krb5/krb5.conf file for the list of configured KDCs (kdc = kdc-name).

Cannot determine realm for host

Cause:

Kerberos cannot determine the realm name for the host.

Solution:

Make sure that there is a default realm name, or that the domain name mappings are set up in the Kerberos configuration file (krb5.conf).

Cannot find KDC for requested realm

Cause:

No KDC was found in the requested realm.

Solution:

Make sure that the Kerberos configuration file (krb5.conf) specifies a KDC in the realm section.

cannot initialize realm realm-name

Cause:

The KDC might not have a stash file.

Solution:

Make sure that the KDC has a stash file. If not, create a stash file by using the kdb5_util command, and try restarting the krb5kdc command.

Cannot resolve KDC for requested realm

Cause:

Kerberos cannot determine any KDC for the realm.

Solution:

Make sure that the Kerberos configuration file (krb5.conf) specifies a KDC in the realm section.

Cannot reuse password

Cause:

The password that you specified has been used before by this principal.

Solution:

Choose a password that has not been chosen before, at least not within the number of passwords that are kept in the KDC database for each principal. This policy is enforced by the principal's policy.

Can't get forwarded credentials

Cause:

Credential forwarding could not be established.

Solution:

Make sure that the principal has forwardable credentials.

Can't open/find Kerberos configuration file

Cause:

The Kerberos configuration file (krb5.conf) was unavailable.

Solution:

Make sure that the krb5.conf file is available in the correct location and has the correct permissions. This file should be writable by root and readable by everyone else.

Client did not supply required checksum--connection rejected

Cause:

Authentication with checksum was not negotiated with the client. The client might be using an old Kerberos V5 protocol that does not support initial connection support.

Solution:

Make sure that the client is using a Kerberos V5 protocol that supports initial connection support.

Client/server realm mismatch in initial ticket request

Cause:

A realm mismatch between the client and server occurred in the initial ticket request.

Solution:

Make sure that the server you are communicating with is in the same realm as the client, or that the realm configurations are correct.

Client or server has a null key

Cause:

The principal has a null key.

Solution:

Modify the principal to have a non-null key by using the cpw command of kadmin.

Communication failure with server while initializing kadmin interface

Cause:

The host that was specified for the admin server, also called the master KDC, did not have the kadmind daemon running.

Solution:

Make sure that you specified the correct host name for the master KDC. If you specified the correct host name, make sure that kadmind is running on the master KDC that you specified.

Credentials cache file permissions incorrect

Cause:

You do not have the appropriate read or write permissions on the credentials cache (/tmp/krb5cc_uid).

Solution:

Make sure that you have read and write permissions on the credentials cache.

Credentials cache I/O operation failed XXX

Cause:

Kerberos had a problem writing to the system's credentials cache (/tmp/krb5cc_uid).

Solution:

Make sure that the credentials cache has not been removed, and that there is space left on the device by using the df command.

Decrypt integrity check failed

Cause:

You might have an invalid ticket.

Solution:

Verify both of these conditions:

• Make sure that your credentials are valid. Destroy your tickets with kdestroy, and create new tickets with kinit.

• Make sure that the target host has a keytab file with the correct version of the service key. Use kadmin to view the key version number of the service principal (for example, host/FQDN-hostname) in the Kerberos database. Also, use klist -k on the target host to make sure that it has the same key version number.

Encryption could not be enabled. Goodbye.

Cause:

Encryption could not be negotiated with the server.

Solution:

Start authentication debugging by invoking the telnet command with the toggle encdebug command and look at the debug messages for further clues.

failed to obtain credentials cache

Cause:

During kadmin initialization, a failure occurred when kadmin tried to obtain credentials for the admin principal.

Solution:

Make sure that you used the correct principal and password when you executed kadmin.

Field is too long for this implementation

Cause:

The message size that was being sent by a Kerberized application was too long. This error could be generated if the transport protocol is UDP. which has a default maximum message size 65535 bytes. In addition, there are limits on individual fields within a protocol message that is sent by the Kerberos service.

Solution:

Verify that you have not restricted the transport to UDP in the KDC server's /etc/krb5/kdc.conf file.

GSS-API (or Kerberos) error

Cause:

This message is a generic GSS-API or Kerberos error message and can be caused by several different problems.

Solution:

Check the /var/krb5/kdc.log file to find the more specific error message that was logged when this error occurred.

Hostname cannot be canonicalized

Cause:

Kerberos cannot make the host name fully qualified.

Solution:

Make sure that the host name is defined in DNS and that the host-name-to-address and address-to-host-name mappings are consistent.

Illegal cross-realm ticket

Cause:

The ticket sent did not have the correct cross-realms. The realms might not have the correct trust relationships set up.

Solution:

Make sure that the realms you are using have the correct trust relationships.

Improper format of Kerberos configuration file

Cause:

The Kerberos configuration file has invalid entries.

Solution:

Make sure that all the relations in the krb5.conf file are followed by the “=” sign and a value. Also, verify that the brackets are present in pairs for each subsection.

Inappropriate type of checksum in message

Cause:

The message contained an invalid checksum type.

Solution:

Check which valid checksum types are specified in the krb5.conf and kdc.conf files.

Incorrect net address

Cause:

There was a mismatch in the network address. The network address in the ticket that was being forwarded was different from the network address where the ticket was processed. This message might occur when tickets are being forwarded.

Solution:

Make sure that the network addresses are correct. Destroy your tickets with kdestroy, and create new tickets with kinit.

Invalid credential was supplied

Service key not available

Cause:

The service ticket in the credentials cache may be incorrect.

Solution:

Destroy current credential cache and rerun kinit before trying to use this service.

Invalid flag for file lock mode

Cause:

An internal Kerberos error occurred.

Solution:

Please report a bug.

Invalid message type specified for encoding

Cause:

Kerberos could not recognize the message type that was sent by the Kerberized application.

Solution:

If you are using a Kerberized application that was developed by your site or a vendor, make sure that it is using Kerberos correctly.

Invalid number of character classes

Cause:

The password that you specified for the principal does not contain enough password classes, as enforced by the principal's policy.

Solution:

Make sure that you specify a password with the minimum number of password classes that the policy requires.

KADM err: Memory allocation failure

Cause:

There is insufficient memory to run kadmin.

Solution:

Free up memory and try running kadmin again.

kadmin: Bad encryption type while changing host/<FQDN>'s key

Cause:

More default encryption types are included in the base release in the Solaris 10 8/07 release. Clients can request encryption types that may not be supported by a KDC running an older version of the Solaris software.

Solution:

Several solutions exist to fix this problem. The easiest one to implement is listed first:

1. Add the SUNWcry and SUNWcryr packages to the KDC server. This increases the number of encryption types supported by the KDC.

2. Set permitted_enctypes in krb5.conf on the client to not include the aes256 encryption type. This step will need to be done on each new client.

KDC can't fulfill requested option

Cause:

The KDC did not allow the requested option. A possible problem might be that postdating or forwardable options were being requested, and the KDC did not allow them. Another problem might be that you requested the renewal of a TGT, but you didn't have a renewable TGT.

Solution:

Determine if you are either requesting an option that the KDC does not allow or a type of ticket that is not available.

KDC policy rejects request

Cause:

The KDC policy did not allow the request. For example, the request to the KDC did not have an IP address in its request. Or forwarding was requested, but the KDC did not allow it.

Solution:

Make sure that you are using kinit with the correct options. If necessary, modify the policy that is associated with the principal or change the principal's attributes to allow the request. You can modify the policy or principal by using kadmin.

KDC reply did not match expectations

Cause:

The KDC reply did not contain the expected principal name, or other values in the response were incorrect.

Solution:

Make sure that the KDC you are communicating with complies with RFC1510, that the request you are sending is a Kerberos V5 request, or that the KDC is available.

kdestroy: Could not obtain principal name from cache

Cause:

The credentials cache is missing or corrupted.

Solution:

Check that the cache location provided is correct. Remove and obtain a new TGT using kinit, if necessary.

kdestroy: No credentials cache file found while destroying cache

Cause:

The credentials cache (/tmp/krb5c_uid) is missing or corrupted.

Solution:

Check that the cache location provided is correct. Remove and obtain a new TGT using kinit, if necessary.

kdestroy: TGT expire warning NOT deleted

Cause:

The credentials cache is missing or corrupted.

Solution:

Check that the cache location provided is correct. Remove and obtain a new TGT using kinit, if necessary.

Kerberos authentication failed

Cause:

The Kerberos password is either incorrect or the password might not be synchronized with the UNIX password.

Solution:

If the password are not synchronized, then you must specify a different password to complete Kerberos authentication. It is possible that the user has forgotten their original password.

Kerberos V5 refuses authentication

Cause:

Authentication could not be negotiated with the server.

Solution:

Start authentication debugging by invoking the telnet command with the toggle authdebug command and look at the debug messages for further clues. Also, make sure that you have valid credentials.

Key table entry not found

Cause:

No entry exists for the service principal in the network application server's keytab file.

Solution:

Add the appropriate service principal to the server's keytab file so that it can provide the Kerberized service.

Key version number for principal in key table is incorrect

Cause:

A principal's key version in the keytab file is different from the version in the Kerberos database. Either a service's key has been changed, or you might be using an old service ticket.

Solution:

If a service's key has been changed (for example, by using kadmin), you need to extract the new key and store it in the host's keytab file where the service is running.

Alternately, you might be using an old service ticket that has an older key. You might want to run the kdestroy command and then the kinit command again.

kinit: gethostname failed

Cause:

An error in the local network configuration is causing kinit to fail.

Solution:

Make sure that the host is configured correctly.

login: load_modules: can not open module /usr/lib/security/pam_krb5.so.1

Cause:

Either the Kerberos PAM module is missing or it is not a valid executable binary.

Solution:

Make sure that the Kerberos PAM module is in the /usr/lib/security directory and that it is a valid executable binary. Also, make sure that the /etc/pam.conf file contains the correct path to pam_krb5.so.1.

Looping detected inside krb5_get_in_tkt

Cause:

Kerberos made several attempts to get the initial tickets but failed.

Solution:

Make sure that at least one KDC is responding to authentication requests.

Master key does not match database

Cause:

The loaded database dump was not created from a database that contains the master key. The master key is located in /var/krb5/.k5.REALM.

Solution:

Make sure that the master key in the loaded database dump matches the master key that is located in /var/krb5/.k5.REALM.

Matching credential not found

Cause:

The matching credential for your request was not found. Your request requires credentials that are unavailable in the credentials cache.

Solution:

Destroy your tickets with kdestroy, and create new tickets with kinit.

Message out of order

Cause:

Messages that were sent using sequential-order privacy arrived out of order. Some messages might have been lost in transit.

Solution:

You should reinitialize the Kerberos session.

Message stream modified

Cause:

There was a mismatch between the computed checksum and the message checksum. The message might have been modified while in transit, which can indicate a security leak.

Solution:

Make sure that the messages are being sent across the network correctly. Because this message can also indicate the possible tampering of messages while they are being sent, destroy your tickets using kdestroy and reinitialize the Kerberos services that you are using.