Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to run kerberos with ldap back-end on Centos 6.3 After creating Realm with:

kdb5_ldap_util -D "cn=admin,dc=example,dc=com" create -sscope sub -sf /var/kerberos/krb5kdc/example_stash.keyfile -r EXAMPLE.COM -s

I'm trying to run kdc and got:

Starting Kerberos 5 KDC: krb5kdc: cannot initialize realm EXAMPLE.COM - see log file for details

Logs shows such error:

krb5kdc: Error reading password from stash:  Bind DN entry missing in stash file - while initializing database for realm EXAMPLE.COM

krb5.conf file:

default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
kdc =
admin_server =
master_kdc =
default_domain =
database_module = ldap_example
pam = {
debug = true
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
ldap_example = {
db_library = kldap
## DN for the global Kerberos container entry
ldap_kerberos_container_dn = ou=kerberos,ou=Services,dc=example,dc=com
ldap_kdc_dn = cn=krbadmin,ou=Services,dc=example,dc=com       ## this object needs to have READ rights on the realm container, principal container and realm sub-trees
ldap_kadmind_dn = "cn=krbadmin,ou=Services,dc=example,dc=com" ## this object needs to have READ and WRITE rights on the realm container, principal container and realm sub-trees
ldap_service_password_file = /var/kerberos/krb5kdc/example_stash.keyfile
ldap_servers = ldap://
ldap_conns_per_server = 5

Both ou=kerberos,ou=Services,dc=example,dc=com and cn=krbadmin,ou=Services,dc=example,dc=com exists. Realm is under ou=kerberos. kdb5_ldap_util can list it:

kdb5_ldap_util -D cn=admin,dc=example,dc=com list -r EXAMPLE.COM
Password for "cn=admin,dc=example,dc=com": 

Stash file is freshly created it didn't existed before creating realm. I already tried to ask Uncle, but without luck.

share|improve this question
up vote 0 down vote accepted

The stash file created along with realm isn't useful while using OpenLDAP back-end as it doesn't contain DN. It looks like standalone stash file.

You have to create stash file with:

kdb5_ldap_util -D "cn=admin,dc=example,dc=com" stashsrvpw -f /var/kerberos/krb5kdc/example_stash.keyfile "cn=krbadmin,ou=Services,dc=example,dc=com"

Another thing that krb5.conf doesn't support inline comments.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.