This chapter provides resolutions for error messages that you might receive when you use the Kerberos service. This chapter also provides some troubleshooting tips for various problems. This is a list of the error message and troubleshooting information in this chapter.SEAM Administration Tool Error Messages Common Kerberos Error Messages (A-M) Common Kerberos Error Messages (N-Z) Problems With the Format of the krb5.conf File Problems Propagating the Kerberos Database Problems Mounting a Kerberized NFS File System Problems Authenticating as root Observing Mapping from GSS Credentials to UNIX Credentials error messagesKerberos Kerberoserror messages This section provides information about Kerberos error messages, including why each error occurs and a way to fix it.Unable to view the list of principals or policies; use the Name field. The admin principal that you logged in with does not have the list privilege (l) in the Kerberos ACL file (kadm5.acl). So, you cannot view the principal list or policy list. You must type the principal and policy names in the Name field to work on them, or you need to log in with a principal that has the appropriate privileges. JNI: Java array creation failedJNI: Java class lookup failedJNI: Java field lookup failedJNI: Java method lookup failedJNI: Java object lookup failedJNI: Java object field lookup failedJNI: Java string access failedJNI: Java string creation failed A serious problem exists with the Java Native Interface that is used by the SEAM Administration Tool (gkadmin). Exit gkadmin and restart it. If the problem persists, please report a bug. This section provides an alphabetical list (A-M) of common error messages for the Kerberos commands, Kerberos daemons, PAM framework, GSS interface, the NFS service, and the Kerberos library.All authentication systems disabled; connection refused This version of rlogind does not support any authentication mechanism. Make sure that rlogind is invoked with the k option. Another authentication mechanism must be used to access this host Authentication could not be done. Make sure that the client is using Kerberos V5 mechanism for authentication. Authentication negotiation has failed, which is required for encryption. Good bye. Authentication could not be negotiated with the server. Start authentication debugging by invoking the telnet command with the toggle authdebug command and look at the debug messages for further clues. Also, make sure that you have valid credentials. Bad krb5 admin server hostname while initializing kadmin interface An invalid host name is configured for admin_server in the krb5.conf file. Make sure that the correct host name for the master KDC is specified on the admin_server line in the krb5.conf file. Bad lifetime value The lifetime value provided is not valid or incorrectly formatted. Make sure that the value provided is consistent with the Time Formats section in the kinit1 man page. Bad start time value The start time value provided is not valid or incorrectly formatted. Make sure that the value provided is consistent with the Time Formats section in the kinit1 man page. Cannot contact any KDC for requested realm No KDC responded in the requested realm. Make sure that at least one KDC (either the master or a slave) is reachable or that the krb5kdc daemon is running on the KDCs. Check the /etc/krb5/krb5.conf file for the list of configured KDCs (kdc = kdc-name). Cannot determine realm for host Kerberos cannot determine the realm name for the host. Make sure that there is a default realm name, or that the domain name mappings are set up in the Kerberos configuration file (krb5.conf). Cannot find KDC for requested realm No KDC was found in the requested realm. Make sure that the Kerberos configuration file (krb5.conf) specifies a KDC in the realm section. cannot initialize realm realm-name The KDC might not have a stash file. Make sure that the KDC has a stash file. If not, create a stash file by using the kdb5_util command, and try restarting the krb5kdc command. Cannot resolve KDC for requested realm Kerberos cannot determine any KDC for the realm. Make sure that the Kerberos configuration file (krb5.conf) specifies a KDC in the realm section. Cannot reuse password The password that you specified has been used before by this principal. Choose a password that has not been chosen before, at least not within the number of passwords that are kept in the KDC database for each principal. This policy is enforced by the principal's policy. Can't get forwarded credentials Credential forwarding could not be established. Make sure that the principal has forwardable credentials. Can't open/find Kerberos configuration file The Kerberos configuration file (krb5.conf) was unavailable. Make sure that the krb5.conf file is available in the correct location and has the correct permissions. This file should be writable by root and readable by everyone else. Client did not supply required checksum--connection rejected Authentication with checksum was not negotiated with the client. The client might be using an old Kerberos V5 protocol that does not support initial connection support. Make sure that the client is using a Kerberos V5 protocol that supports initial connection support. Client/server realm mismatch in initial ticket request A realm mismatch between the client and server occurred in the initial ticket request. Make sure that the server you are communicating with is in the same realm as the client, or that the realm configurations are correct. Client or server has a null key The principal has a null key. Modify the principal to have a non-null key by using the cpw command of kadmin. Communication failure with server while initializing kadmin interface The host that was specified for the admin server, also called the master KDC, did not have the kadmind daemon running. Make sure that you specified the correct host name for the master KDC. If you specified the correct host name, make sure that kadmind is running on the master KDC that you specified. Credentials cache file permissions incorrect You do not have the appropriate read or write permissions on the credentials cache (/tmp/krb5cc_uid). Make sure that you have read and write permissions on the credentials cache. Credentials cache I/O operation failed XXX Kerberos had a problem writing to the system's credentials cache (/tmp/krb5cc_uid). Make sure that the credentials cache has not been removed, and that there is space left on the device by using the df command. Decrypt integrity check failed You might have an invalid ticket. Verify both of these conditions:Make sure that your credentials are valid. Destroy your tickets with kdestroy, and create new tickets with kinit. Make sure that the target host has a keytab file with the correct version of the service key. Use kadmin to view the key version number of the service principal (for example, host/FQDN-hostname) in the Kerberos database. Also, use klist k on the target host to make sure that it has the same key version number. Encryption could not be enabled. Goodbye. Encryption could not be negotiated with the server. Start authentication debugging by invoking the telnet command with the toggle encdebug command and look at the debug messages for further clues. failed to obtain credentials cache During kadmin initialization, a failure occurred when kadmin tried to obtain credentials for the admin principal. Make sure that you used the correct principal and password when you executed kadmin. Field is too long for this implementation The message size that was being sent by a Kerberized application was too long. This error could be generated if the transport protocol is UDP. which has a default maximum message size 65535 bytes. In addition, there are limits on individual fields within a protocol message that is sent by the Kerberos service. Verify that you have not restricted the transport to UDP in the KDC server's /etc/krb5/kdc.conf file. GSS-API (or Kerberos) error This message is a generic GSS-API or Kerberos error message and can be caused by several different problems. Check the /var/krb5/kdc.log file to find the more specific error message that was logged when this error occurred. Hostname cannot be canonicalized Kerberos cannot make the host name fully qualified. Make sure that the host name is defined in DNS and that the host-name-to-address and address-to-host-name mappings are consistent. Illegal cross-realm ticket The ticket sent did not have the correct cross-realms. The realms might not have the correct trust relationships set up. Make sure that the realms you are using have the correct trust relationships. Improper format of Kerberos configuration file The Kerberos configuration file has invalid entries. Make sure that all the relations in the krb5.conf file are followed by the “=” sign and a value. Also, verify that the brackets are present in pairs for each subsection. Inappropriate type of checksum in message The message contained an invalid checksum type. Check which valid checksum types are specified in the krb5.conf and kdc.conf files. Incorrect net address There was a mismatch in the network address. The network address in the ticket that was being forwarded was different from the network address where the ticket was processed. This message might occur when tickets are being forwarded. Make sure that the network addresses are correct. Destroy your tickets with kdestroy, and create new tickets with kinit. Invalid credential was suppliedService key not available The service ticket in the credentials cache may be incorrect. Destroy current credential cache and rerun kinit before trying to use this service. Invalid flag for file lock mode An internal Kerberos error occurred. Please report a bug. Invalid message type specified for encoding Kerberos could not recognize the message type that was sent by the Kerberized application. If you are using a Kerberized application that was developed by your site or a vendor, make sure that it is using Kerberos correctly. Invalid number of character classes The password that you specified for the principal does not contain enough password classes, as enforced by the principal's policy. Make sure that you specify a password with the minimum number of password classes that the policy requires. KADM err: Memory allocation failure There is insufficient memory to run kadmin. Free up memory and try running kadmin again. kadmin: Bad encryption type while changing host/<FQDN>'s key More default encryption types are included in the base release in the Solaris 10 8/07 release. Clients can request encryption types that may not be supported by a KDC running an older version of the Solaris software. Several solutions exist to fix this problem. The easiest one to implement is listed first:Add the SUNWcry and SUNWcryr packages to the KDC server. This increases the number of encryption types supported by the KDC. Set permitted_enctypes in krb5.conf on the client to not include the aes256 encryption type. This step will need to be done on each new client. KDC can't fulfill requested option The KDC did not allow the requested option. A possible problem might be that postdating or forwardable options were being requested, and the KDC did not allow them. Another problem might be that you requested the renewal of a TGT, but you didn't have a renewable TGT. Determine if you are either requesting an option that the KDC does not allow or a type of ticket that is not available. KDC policy rejects request The KDC policy did not allow the request. For example, the request to the KDC did not have an IP address in its request. Or forwarding was requested, but the KDC did not allow it. Make sure that you are using kinit with the correct options. If necessary, modify the policy that is associated with the principal or change the principal's attributes to allow the request. You can modify the policy or principal by using kadmin. KDC reply did not match expectations The KDC reply did not contain the expected principal name, or other values in the response were incorrect. Make sure that the KDC you are communicating with complies with RFC1510, that the request you are sending is a Kerberos V5 request, or that the KDC is available. kdestroy: Could not obtain principal name from cache The credentials cache is missing or corrupted. Check that the cache location provided is correct. Remove and obtain a new TGT using kinit, if necessary. kdestroy: No credentials cache file found while destroying cache The credentials cache (/tmp/krb5c_uid) is missing or corrupted. Check that the cache location provided is correct. Remove and obtain a new TGT using kinit, if necessary. kdestroy: TGT expire warning NOT deleted The credentials cache is missing or corrupted. Check that the cache location provided is correct. Remove and obtain a new TGT using kinit, if necessary. Kerberos authentication failed The Kerberos password is either incorrect or the password might not be synchronized with the UNIX password. If the password are not synchronized, then you must specify a different password to complete Kerberos authentication. It is possible that the user has forgotten their original password. Kerberos V5 refuses authentication Authentication could not be negotiated with the server. Start authentication debugging by invoking the telnet command with the toggle authdebug command and look at the debug messages for further clues. Also, make sure that you have valid credentials. Key table entry not found No entry exists for the service principal in the network application server's keytab file. Add the appropriate service principal to the server's keytab file so that it can provide the Kerberized service. Key version number for principal in key table is incorrect A principal's key version in the keytab file is different from the version in the Kerberos database. Either a service's key has been changed, or you might be using an old service ticket. If a service's key has been changed (for example, by using kadmin), you need to extract the new key and store it in the host's keytab file where the service is running. Alternately, you might be using an old service ticket that has an older key. You might want to run the kdestroy command and then the kinit command again. kinit: gethostname failed An error in the local network configuration is causing kinit to fail. Make sure that the host is configured correctly. login: load_modules: can not open module /usr/lib/security/pam_krb5.so.1 Either the Kerberos PAM module is missing or it is not a valid executable binary. Make sure that the Kerberos PAM module is in the /usr/lib/security directory and that it is a valid executable binary. Also, make sure that the /etc/pam.conf file contains the correct path to pam_krb5.so.1. Looping detected inside krb5_get_in_tkt Kerberos made several attempts to get the initial tickets but failed. Make sure that at least one KDC is responding to authentication requests. Master key does not match database The loaded database dump was not created from a database that contains the master key. The master key is located in /var/krb5/.k5.REALM. Make sure that the master key in the loaded database dump matches the master key that is located in /var/krb5/.k5.REALM. Matching credential not found The matching credential for your request was not found. Your request requires credentials that are unavailable in the credentials cache. Destroy your tickets with kdestroy, and create new tickets with kinit. Message out of order Messages that were sent using sequential-order privacy arrived out of order. Some messages might have been lost in transit. You should reinitialize the Kerberos session. Message stream modified There was a mismatch between the computed checksum and the message checksum. The message might have been modified while in transit, which can indicate a security leak. Make sure that the messages are being sent across the network correctly. Because this message can also indicate the possible tampering of messages while they are being sent, destroy your tickets using kdestroy and reinitialize the Kerberos services that you are using. This section provides an alphabetical list (N-Z) of common error messages for the Kerberos commands, Kerberos daemons, PAM framework, GSS interface, the NFS service, and the Kerberos library.No credentials cache file found Kerberos could not find the credentials cache (/tmp/krb5cc_uid). Make sure that the credential file exists and is readable. If it isn't, try performing kinit again. No credentials were supplied, or the credentials were unavailable or inaccessibleNo credential cache found The user's credential cache is incorrect or does not exist. The user should run kinit before trying to start the service. No credentials were supplied, or the credentials were unavailable or inaccessibleNo principal in keytab matches desired name An error occurred while trying to authenticate the server. Make sure that the host or service principal is in the server's keytab file. Operation requires “privilege” privilege The admin principal that was being used does not have the appropriate privilege configured in the kadm5.acl file. Use a principal that has the appropriate privileges. Or, configure the principal that was being used to have the appropriate privileges by modifying the kadm5.acl file. Usually, a principal with /admin as part of its name has the appropriate privileges. PAM-KRB5 (auth): krb5_verify_init_creds failed: Key table entry not found The remote application tried to read the host's service principal in the local /etc/krb5/krb5.keytab file, but one does not exist. Add the host's service principal to the host's keytab file. Password is in the password dictionary The password that you specified is in a password dictionary that is being used. Your password is not a good choice for a password. Choose a password that has a mix of password classes. Permission denied in replay cache code The system's replay cache could not be opened. Your server might have been first run under a user ID different than your current user ID. Make sure that the replay cache has the appropriate permissions. The replay cache is stored on the host where the Kerberized server application is running. The replay cache file is called /var/krb5/rcache/rc_service_name_uid for non-root users. For root users the replay cache file is called /var/krb5/rcache/root/rc_service_name. Protocol version mismatch Most likely, a Kerberos V4 request was sent to the KDC. The Kerberos service supports only the Kerberos V5 protocol. Make sure that your applications are using the Kerberos V5 protocol. Request is a replay The request has already been sent to this server and processed. The tickets might have been stolen, and someone else is trying to reuse the tickets. Wait for a few minutes, and reissue the request. Requested principal and ticket don't match The service principal that you are connecting to and the service ticket that you have do not match. Make sure that DNS is functioning properly. If you are using another vendor's software, make sure that the software is using principal names correctly. Requested protocol version not supported Most likely, a Kerberos V4 request was sent to the KDC. The Kerberos service supports only the Kerberos V5 protocol. Make sure that your applications are using the Kerberos V5 protocol. Server refused to negotiate authentication, which is required for encryption. Good bye. The remote application is not capable or has been configured not to accept Kerberos authentication from the client. Provide a remote application that can negotiate authentication or configure the application to use the appropriate flags to turn on authentication. Server refused to negotiate encryption. Good bye. Encryption could not be negotiated with the server. Start authentication debugging by invoking the telnet command with the toggle encdebugcommand and look at the debug messages for further clues. Server rejected authentication (during sendauth exchange) The server that you are trying to communicate with rejected the authentication. Most often, this error occurs during Kerberos database propagation. Some common causes might be problems with the kpropd.acl file, DNS, or the keytab file. If you get this error when you are running applications other than kprop, investigate whether the server's keytab file is correct. The ticket isn't for usTicket/authenticator don't match There was a mismatch between the ticket and the authenticator. The principal name in the request might not have matched the service principal's name. Either because the ticket was being sent with an FQDN name of the principal while the service expected a non-FQDN name, or a non-FDQN name was sent when the service expected an FQDN name. If you get this error when you are running applications other than kprop, investigate whether the server's keytab file is correct. Ticket expired Your ticket times have expired. Destroy your tickets with kdestroy, and create new tickets with kinit. Ticket is ineligible for postdating The principal does not allow its tickets to be postdated. Modify the principal with kadmin to allow postdating. Ticket not yet valid The postdated ticket is not valid yet. Create a new ticket with the correct date, or wait until the current ticket is valid. Truncated input file detected The database dump file that was being used in the operation is not a complete dump file. Create the dump file again, or use a different database dump file. Unable to securely authenticate user ... exit Authentication could not be negotiated with the server. Start authentication debugging by invoking the telnet command with the toggle authdebug command and look at the debug messages for further clues. Also, make sure that you have valid credentials. Wrong principal in request There was an invalid principal name in the ticket. This error might indicate a DNS or FQDN problem. Make sure that the principal of the service matches the principal in the ticket. troubleshootingKerberosKerberostroubleshootingThis section provides troubleshooting information for the Kerberos software.If the krb5.conf file is not formatted properly, the telnet command will fail. However, the dtlogin and login commands will still succeed, even if the krb5.conf file is specified as required for the commands. If this problem occurs, the following error message is displayed: Error initializing krb5: Improper format of Kerberos configurationIn addition, an incorrectly formatted krb5.conf file, prevents the applications that use the GSSAPI from using the krb5 mechanisms.If there is a problem with the format of the krb5.conf file, you are vulnerable to security breaches. You should fix the problem before you allow Kerberos features to be used. If propagating the Kerberos database fails, try /usr/bin/rlogin x between the slave KDC and master KDC, and from the master KDC to the slave KDC server. If the KDCs have been set up to restrict access, rlogin is disabled and cannot be used to troubleshoot this problem. To enable rlogin on a KDC, you must enable the eklogin service.# svcadm enable svc:/network/login:ekloginAfter you finish troubleshooting the problem, you need to disable the eklogin service..If rlogin does not work, problems are likely because of the keytab files on the KDCs. If rlogin does work, the problem is not in the keytab file or the name service, because rlogin and the propagation software use the same host/host-name principal. In this case, make sure that the kpropd.acl file is correct. If mounting a Kerberized NFS file system fails, make sure that the /var/rcache/root file exists on the NFS server. If the file system is not owned by root, remove it and try the mount again. If you have a problem accessing a Kerberized NFS file system, make sure that the gssd service is enabled on your system and the NFS server. If you see either the invalid argument or bad directory error message when you are trying to access a Kerberized NFS file system, the problem might be that you are not using a fully qualified DNS name when you are trying to mount the NFS file system. The host that is being mounted is not the same as the host name part of the service principal in the server's keytab file.This problem might also occur if your server has multiple Ethernet interfaces, and you have set up DNS to use a “name per interface” scheme instead of a “multiple address records per host” scheme. For the Kerberos service, you should set up multiple address records per host as followsKen Hornstein, “Kerberos FAQ,” [], accessed 11 December 1998.:my.host.name. A 1.2.3.4 A 1.2.4.4 A 1.2.5.4 my-en0.host.name. A 1.2.3.4 my-en1.host.name. A 1.2.4.4 my-en2.host.name. A 1.2.5.4 4.3.2.1 PTR my.host.name. 4.4.2.1 PTR my.host.name. 4.5.2.1 PTR my.host.name. In this example, the setup allows one reference to the different interfaces and a single service principal instead of three service principals in the server's keytab file. If authentication fails when you try to become superuser on your system and you have already added the root principal to your host's keytab file, there are two potential problems to check. First, make sure that the root principal in the keytab file has a fully qualified host name as its instance. If it does, check the /etc/resolv.conf file to make sure that the system is correctly set up as a DNS client. To be able to monitor the credential mappings, first uncomment this line from the /etc/gss/gsscred.conf file.SYSLOG_UID_MAPPING=yesNext instruct the gssd service to get information from the /etc/gss/gsscred.conf file.# pkill -HUP gssdNow you should be able to monitor the credential mappings as gssd requests them. The mappings are recorded by syslogd, if the syslog.conf file is configured for the auth system facility with the debug severity level.