Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am going nuts here trying to debug a problem.

So I need to connect this Linux Box to an AD Domain through Kerberos.

here is my krb5.conf:

   forwardable = true
   proxiable = true

       kdc = VSH002.OURDOMAIN.COM:88
       admin_server = VSH002.OURDOMAIN.COM:749
       default_domain = OURDOMAIN.COM


Now /etc/hosts: VSH002.OURDOMAIN.COM VSH002 vsh002

And resolv.conf:


The Command kinit user@OURDOMAIN.COM works just fine.

Also klist -ke shows the correct principal

kinit -V also connects successfully.

The Problem: After I generate the keytab with kpass on the Active Directory side and try to connect using

 kinit -k

I get:

Cannot resolve network address for KDC in realm while getting initial credentials.

Network Adress can not be resolved? How is that possible?

Someone to help?

Thank You, Eugene.

share|improve this question

When using kinit with a keytab it in necessary to provide the principle you wish to authenticate as. This is probably because keytabs can contain more than one principle.

[root@dhcp2 ~]# kinit -k
kinit(v5): Cannot resolve network address for KDC in realm  while getting initial credentials
[root@dhcp2 ~]# kinit -k  host/dhcp2.domain.tld
[root@dhcp2 ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: host/dhcp2.domain.tld@DOMAIN.TLD

Valid starting     Expires            Service principal
07/29/12 19:27:49  07/30/12 07:27:49  krbtgt/DOMAIN.TLD@DOMAIN.TLD
        renew until 07/30/12 19:27:49

Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached
share|improve this answer
thx! that indeed is a problem. But it does not solve my problem yet. This had to do with the keytab file, now I am not using it at all and it still fails. Can you please look at this:… – Eugene Jul 30 '12 at 15:04

dns_lookup_kdc=true means that kinit will lookup the SRV records in DNS.

Do you have the SRV records in DNS server that your server is using for the domain/domain controller?

_kerberos.VSH002.OURDOMAIN.COM for port 88
_ldap.VSH002.OURDOMAIN.COM for port 389

share|improve this answer
Wait what? The kinit -k is performed from a Linux machine, not windows. – Eugene Jul 27 '12 at 14:15
If you want to use DNS for these records, you may want to perform packet capture to determine if the machine is querying for the records. – Greg Askew Jul 27 '12 at 15:03
Of course I want to use DNS for these records, didn't I specify that in krb5.conf? :). This makes no sense, youre suggesting to use wireshark for example to see if Linux machine is even trying to access these records? If it was not, then how did kinit user@OURDOMAIN.COM work? Can you please bi a bit more verbose/specific? – Eugene Jul 27 '12 at 15:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.