When I run ktutil list, I get a list of several clients. However, when I run kinit for any of the listed clients, I always get client unknown. Any ideas?
The KDC(s) you're communicating with doesn't have any records for the principal you are requesting. This could be for a couple of reasons.
- The principal has been deleted. (Check with
- You are communicating with the wrong KDC. (
SRV recordis incorrect.)
- The KDC you are communicating with is misconfigured to load an incorrect database. (This only matters if init scripts have been changed, maybe by update.)
- The KDC you are communicating with is no longer serving the correct realm. (By default this is the local realm, if the KDC relies on DNS for it's default realm and it's
PTRhas changed this could be the issue.)
- The KDC you are communicating with is a replica, but propagation failed before the principal was created on the master.
Did you check any of these things or try anything else before asking? Your question demonstrates no effort by you to solve your problem. This isn't to say that you haven't taken any steps to solve it, just that it is impossible for any reader to know if you have done so.
Can you acquire tickets for at least one principal of that realm?
What is the actual command are you running to acquire tickets?
kinit $principal -k -t $keytab?
What are the server and client?