Here is better detail:

We're having issue with kerberos and ipa client.

While running ipa-client-install, when prompted for user who is authorized to enroll we enter admin and his password but get "Preauthentication failed".

Same thing happens when we do "kinit admin".

output of klist -ke
klist -ke
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   9 kreso@XXXXXXX (aes256-cts-hmac-sha1-96)
   9 kreso@XXXXXXX (aes128-cts-hmac-sha1-96)
   4 admin@XXXXXXX (aes256-cts-hmac-sha1-96)
   4 admin@XXXXXXX (aes128-cts-hmac-sha1-96) 

part of krb5kdc.log on ipa server:
Feb 07 12:13:26 ipa1.practichem.com krb5kdc[1222](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 10.10.1.80: PREAUTH_FAILED: admin@XXXXXXX for krbtgt/XXXXXXX@XXXXXXX, Preauthentication failed

Output of KRB5_TRACE=/dev/stdout kinit -V admin:
[1626] 1581094962.274338: AS key obtained for encrypted timestamp: aes256-cts/AFA1
[1626] 1581094962.274340: Encrypted timestamp (for 1581094962.272672): plain 301AA011180F32303230303230373137303234325AA1050203042920, encrypted A8D14DBFED8FAF25AB7307B2D272A05D26FC7D59F4DE3024F34F545EFA1489146BA52C6B943B891DF4FF3DE1BB03141C5C7D6FBD9E07B0D0
[1626] 1581094962.274341: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
[1626] 1581094962.274342: Produced preauth for next request: 133, 2
[1626] 1581094962.274343: Sending request (412 bytes) to XXXXXXX
[1626] 1581094962.274344: Sending DNS URI query for _kerberos.XXXXXXX.
[1626] 1581094962.274345: No URI records found
[1626] 1581094962.274346: Sending DNS SRV query for _kerberos._udp.XXXXXXX.
[1626] 1581094962.274347: SRV answer: 0 100 88 "ipa2.XXXXXXX."
[1626] 1581094962.274348: SRV answer: 0 100 88 "ipa1.XXXXXXX."
[1626] 1581094962.274349: Sending DNS SRV query for _kerberos._tcp.XXXXXXX.
[1626] 1581094962.274350: SRV answer: 0 100 88 "ipa2.XXXXXXX."
[1626] 1581094962.274351: SRV answer: 0 100 88 "ipa1.XXXXXXX."
[1626] 1581094962.274352: Resolving hostname ipa2.XXXXXXX.
[1626] 1581094962.274353: Resolving hostname ipa1.XXXXXXX.
[1626] 1581094962.274354: Resolving hostname ipa2.XXXXXXX.
[1626] 1581094962.274355: Initiating TCP connection to stream 10.10.1.11:88
[1626] 1581094962.274356: Sending TCP request to stream 10.10.1.11:88
[1626] 1581094962.274357: Received answer (479 bytes) from stream 10.10.1.11:88
[1626] 1581094962.274358: Terminating TCP connection to stream 10.10.1.11:88
[1626] 1581094962.274359: Sending DNS URI query for _kerberos.XXXXXXX.
[1626] 1581094962.274360: No URI records found
[1626] 1581094962.274361: Sending DNS SRV query for _kerberos-master._tcp.XXXXXXX.
[1626] 1581094962.274362: SRV answer: 0 100 88 "ipa1.XXXXXXX."
[1626] 1581094962.274363: SRV answer: 0 100 88 "ipa2.XXXXXXX."
[1626] 1581094962.274364: Response was from master KDC
[1626] 1581094962.274365: Received error from KDC: -1765328360/Preauthentication failed
[1626] 1581094962.274368: Preauthenticating using KDC method data
[1626] 1581094962.274369: Processing preauth types: 16, 136, 19, 147, 151, 2, 133
[1626] 1581094962.274370: Selected etype info: etype aes256-cts, salt "U5.X"o/CaU^V,,i-", params ""
[1626] 1581094962.274371: Received cookie: MIT1\x00\x00\x00\x01\xf0\x09\xfen\x01i\xc1\xde\xffqH3ad=\xe4\xa3\x9a\x05\x0e"\x96\xcb\xc0\xcc;?\xfb\x01g\xa4\xb4\xd5+pZ\xcf[\xce\xce\x8cXl\xadk\xbe\xack\xb6\xc2\x91\x03\xdb.g\x1a\xa8|\xbd\x04\xd8v\x94\x9a\x13\xd1\xfc\xd5\xfa\xdb\xe0g\xd0\xe9\xff\x9c\xd9Z\x07\x84\x0b\xea\xbc\x9b\xbc2\xb2G\xdf\xa70\xc2\xa8`\x8a\x06Z\xfa\xe2\xe8\xf8U\x8b$\x0b\xb5W)\x7f\xe6\xd0\x07\xae\x9e\xb5\x17\xd4\xff\xfc\xa5\xf2|\x1c\xd5\xff*\xa9\xc1 #
kinit: Password incorrect while getting initial credentials

and output of KRB5_TRACE=/dev/stdout kinit -V kreso (that worked once)
[1625] 1581094927.991769: AS key obtained for encrypted timestamp: aes256-cts/5BC3
[1625] 1581094927.991771: Encrypted timestamp (for 1581094927.992360): plain 301AA011180F32303230303230373137303230375AA10502030F2468, encrypted 713051F0B09B27D4677F92DCEEA0856C3EA892747503CE1905D62CE072B0685E60DA1779FB69E6078E2CDE5DB985B0CDBC043559E007E9CC
[1625] 1581094927.991772: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
[1625] 1581094927.991773: Produced preauth for next request: 133, 2
[1625] 1581094927.991774: Sending request (412 bytes) to XXXXXXX
[1625] 1581094927.991775: Sending DNS URI query for _kerberos.XXXXXXX.
[1625] 1581094927.991776: No URI records found
[1625] 1581094927.991777: Sending DNS SRV query for _kerberos._udp.XXXXXXX.
[1625] 1581094927.991778: SRV answer: 0 100 88 "ipa2.XXXXXXX."
[1625] 1581094927.991779: SRV answer: 0 100 88 "ipa1.XXXXXXX."
[1625] 1581094927.991780: Sending DNS SRV query for _kerberos._tcp.XXXXXXX.
[1625] 1581094927.991781: SRV answer: 0 100 88 "ipa1.XXXXXXX."
[1625] 1581094927.991782: SRV answer: 0 100 88 "ipa2.XXXXXXX."
[1625] 1581094927.991783: Resolving hostname ipa2.XXXXXXX.
[1625] 1581094927.991784: Resolving hostname ipa1.XXXXXXX.
[1625] 1581094927.991785: Resolving hostname ipa1.XXXXXXX.
[1625] 1581094927.991786: Initiating TCP connection to stream 10.10.1.10:88
[1625] 1581094927.991787: Sending TCP request to stream 10.10.1.10:88
[1625] 1581094928.1010: Received answer (744 bytes) from stream 10.10.1.10:88
[1625] 1581094928.1011: Terminating TCP connection to stream 10.10.1.10:88
[1625] 1581094928.1012: Sending DNS URI query for _kerberos.XXXXXXX.
[1625] 1581094928.1013: No URI records found
[1625] 1581094928.1014: Sending DNS SRV query for _kerberos-master._tcp.XXXXXXX.
[1625] 1581094928.1015: SRV answer: 0 100 88 "ipa1.XXXXXXX."
[1625] 1581094928.1016: SRV answer: 0 100 88 "ipa2.XXXXXXX."
[1625] 1581094928.1017: Response was from master KDC
[1625] 1581094928.1018: Processing preauth types: 19
[1625] 1581094928.1019: Selected etype info: etype aes256-cts, salt ",{hC[Z|]0:YJj>=(", params ""
[1625] 1581094928.1020: Produced preauth for next request: (empty)
[1625] 1581094928.1021: AS key determined by preauth: aes256-cts/5BC3
[1625] 1581094928.1022: Decrypted AS reply; session key is: aes256-cts/C25F
[1625] 1581094928.1023: FAST negotiation: available
[1625] 1581094928.1024: Initializing KEYRING:persistent:0:0 with default princ kreso@XXXXXXX
[1625] 1581094928.1025: Storing kreso@XXXXXXX -> krbtgt/XXXXXXX@XXXXXXX in KEYRING:persistent:0:0
[1625] 1581094928.1026: Storing config in KEYRING:persistent:0:0 for krbtgt/XXXXXXX@XXXXXXX: fast_avail: yes
[1625] 1581094928.1027: Storing kreso@XXXXXXX -> krb5_ccache_conf_data/fast_avail/krbtgt\/XXXXXXX\@XXXXXXX@X-CACHECONF: in KEYRING:persistent:0:0
[1625] 1581094928.1028: Storing config in KEYRING:persistent:0:0 for krbtgt/XXXXXXX@XXXXXXX: pa_type: 2
[1625] 1581094928.1029: Storing kreso@XXXXXXX -> krb5_ccache_conf_data/pa_type/krbtgt\/XXXXXXX\@XXXXXXX@X-CACHECONF: in KEYRING:persistent:0:0
Authenticated to Kerberos v5

Only difference in those two outputs is that on second one it used Preauth type 19 and that made it successful.


Nick DeMarco
CEO, founder



On Fri, Feb 7, 2020 at 12:19 PM Nicholas DeMarco <ndemarco@practichem.com> wrote:
I'm having trouble with kerberos.

On ipa:

$ kinit <username>

[1625] 1581094928.1017: Response was from master KDC
[1625] 1581094928.1018: Processing preauth types: 19

-and-

$ kinit admin

[1626] 1581094962.274365: Received error from KDC: -1765328360/Preauthentication failed
[1626] 1581094962.274368: Preauthenticating using KDC method data

and from the logs:

Feb 07 12:13:19 ipa1.practichem.com krb5kdc[1224](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 10.10.1.80: NEEDED_PREAUTH: admin@practichem.com for krbtgt/practichem.com@practichem.com, Additional pre-authentication required