When I run ktutil list, I get a list of several clients. However, when I run kinit for any of the listed clients, I always get client unknown. Any ideas?


The KDC(s) you're communicating with doesn't have any records for the principal you are requesting. This could be for a couple of reasons.

  • The principal has been deleted. (Check with kadmin.)
  • You are communicating with the wrong KDC. (/etc/krb5.conf or SRV record is incorrect.)
  • The KDC you are communicating with is misconfigured to load an incorrect database. (This only matters if init scripts have been changed, maybe by update.)
  • The KDC you are communicating with is no longer serving the correct realm. (By default this is the local realm, if the KDC relies on DNS for it's default realm and it's PTR has changed this could be the issue.)
  • The KDC you are communicating with is a replica, but propagation failed before the principal was created on the master.

Did you check any of these things or try anything else before asking? Your question demonstrates no effort by you to solve your problem. This isn't to say that you haven't taken any steps to solve it, just that it is impossible for any reader to know if you have done so.

Can you acquire tickets for at least one principal of that realm?
What is the actual command are you running to acquire tickets? kinit $principal -k -t $keytab?
What are the server and client? mit, heimdal, microsoft?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.