[28078] in Kerberos
Re: Linux To ADS: correct time, but "Clock skew too great .."
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Fri Jul 20 10:19:54 2007
Message-ID: <46A0C47E.7070906@anl.gov>
Date: Fri, 20 Jul 2007 09:19:42 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Sonja Benz <sonja.benz@de.ibm.com>
In-Reply-To: <OFFAAA9CD3.6A12A20C-ONC125731E.00221543-C125731E.0022F031@de.ibm.com>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
In addition to timezone on both KDC and client , does the krb5.conf
have a clockskew parameter? The default is 300 seconds, or 5 minutes.
Sonja Benz wrote:
> Hello,
>
> I try to set ab Kerberos authentication for a Linux client to ADS. The
> behavior is strange: Obviously the client communicates with the ADS
> server, e.g. I get an "Preauthentication failed while getting initial
> credentials" if entering a wrong password and the password is locked after
> entering repeatedly a wrong password. However, "kinit" never successes,
> but when entering the correct password says "Clock skew too great while
> getting initial credentials". Surely we did check the time at client and
> server. It is correct!
>
> Any ideas, what else could be wrong and give this error message?
>
> Sonja
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
