We're having issue with kerberos and ipa client.
While running ipa-client-install, when prompted for user who is authorized to enroll we enter admin and his password but get "Preauthentication failed".
Same thing happens when we do "kinit admin".
output of klist -ke
klist -ke
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
9 kreso@XXXXXXX (aes256-cts-hmac-sha1-96)
9 kreso@XXXXXXX (aes128-cts-hmac-sha1-96)
4 admin@XXXXXXX (aes256-cts-hmac-sha1-96)
4 admin@XXXXXXX (aes128-cts-hmac-sha1-96)
part of krb5kdc.log on ipa server:
Feb 07 12:13:26
ipa1.practichem.com krb5kdc[1222](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)})
10.10.1.80: PREAUTH_FAILED: admin@XXXXXXX for krbtgt/XXXXXXX@XXXXXXX, Preauthentication failed
Output of KRB5_TRACE=/dev/stdout kinit -V admin:
[1626] 1581094962.274338: AS key obtained for encrypted timestamp: aes256-cts/AFA1
[1626] 1581094962.274340: Encrypted timestamp (for 1581094962.272672): plain 301AA011180F32303230303230373137303234325AA1050203042920, encrypted A8D14DBFED8FAF25AB7307B2D272A05D26FC7D59F4DE3024F34F545EFA1489146BA52C6B943B891DF4FF3DE1BB03141C5C7D6FBD9E07B0D0
[1626] 1581094962.274341: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
[1626] 1581094962.274342: Produced preauth for next request: 133, 2
[1626] 1581094962.274343: Sending request (412 bytes) to XXXXXXX
[1626] 1581094962.274344: Sending DNS URI query for _kerberos.XXXXXXX.
[1626] 1581094962.274345: No URI records found
[1626] 1581094962.274346: Sending DNS SRV query for _kerberos._udp.XXXXXXX.
[1626] 1581094962.274347: SRV answer: 0 100 88 "ipa2.XXXXXXX."
[1626] 1581094962.274348: SRV answer: 0 100 88 "ipa1.XXXXXXX."
[1626] 1581094962.274349: Sending DNS SRV query for _kerberos._tcp.XXXXXXX.
[1626] 1581094962.274350: SRV answer: 0 100 88 "ipa2.XXXXXXX."
[1626] 1581094962.274351: SRV answer: 0 100 88 "ipa1.XXXXXXX."
[1626] 1581094962.274352: Resolving hostname ipa2.XXXXXXX.
[1626] 1581094962.274353: Resolving hostname ipa1.XXXXXXX.
[1626] 1581094962.274354: Resolving hostname ipa2.XXXXXXX.
[1626] 1581094962.274355: Initiating TCP connection to stream
10.10.1.11:88[1626] 1581094962.274356: Sending TCP request to stream
10.10.1.11:88[1626] 1581094962.274357: Received answer (479 bytes) from stream
10.10.1.11:88[1626] 1581094962.274358: Terminating TCP connection to stream
10.10.1.11:88[1626] 1581094962.274359: Sending DNS URI query for _kerberos.XXXXXXX.
[1626] 1581094962.274360: No URI records found
[1626] 1581094962.274361: Sending DNS SRV query for _kerberos-master._tcp.XXXXXXX.
[1626] 1581094962.274362: SRV answer: 0 100 88 "ipa1.XXXXXXX."
[1626] 1581094962.274363: SRV answer: 0 100 88 "ipa2.XXXXXXX."
[1626] 1581094962.274364: Response was from master KDC
[1626] 1581094962.274365: Received error from KDC: -1765328360/Preauthentication failed
[1626] 1581094962.274368: Preauthenticating using KDC method data
[1626] 1581094962.274369: Processing preauth types: 16, 136, 19, 147, 151, 2, 133
[1626] 1581094962.274370: Selected etype info: etype aes256-cts, salt "U5.X"o/CaU^V,,i-", params ""
[1626] 1581094962.274371: Received cookie: MIT1\x00\x00\x00\x01\xf0\x09\xfen\x01i\xc1\xde\xffqH3ad=\xe4\xa3\x9a\x05\x0e"\x96\xcb\xc0\xcc;?\xfb\x01g\xa4\xb4\xd5+pZ\xcf[\xce\xce\x8cXl\xadk\xbe\xack\xb6\xc2\x91\x03\xdb.g\x1a\xa8|\xbd\x04\xd8v\x94\x9a\x13\xd1\xfc\xd5\xfa\xdb\xe0g\xd0\xe9\xff\x9c\xd9Z\x07\x84\x0b\xea\xbc\x9b\xbc2\xb2G\xdf\xa70\xc2\xa8`\x8a\x06Z\xfa\xe2\xe8\xf8U\x8b$\x0b\xb5W)\x7f\xe6\xd0\x07\xae\x9e\xb5\x17\xd4\xff\xfc\xa5\xf2|\x1c\xd5\xff*\xa9\xc1 #
kinit: Password incorrect while getting initial credentials
and output of KRB5_TRACE=/dev/stdout kinit -V kreso (that worked once)
[1625] 1581094927.991769: AS key obtained for encrypted timestamp: aes256-cts/5BC3
[1625] 1581094927.991771: Encrypted timestamp (for 1581094927.992360): plain 301AA011180F32303230303230373137303230375AA10502030F2468, encrypted 713051F0B09B27D4677F92DCEEA0856C3EA892747503CE1905D62CE072B0685E60DA1779FB69E6078E2CDE5DB985B0CDBC043559E007E9CC
[1625] 1581094927.991772: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
[1625] 1581094927.991773: Produced preauth for next request: 133, 2
[1625] 1581094927.991774: Sending request (412 bytes) to XXXXXXX
[1625] 1581094927.991775: Sending DNS URI query for _kerberos.XXXXXXX.
[1625] 1581094927.991776: No URI records found
[1625] 1581094927.991777: Sending DNS SRV query for _kerberos._udp.XXXXXXX.
[1625] 1581094927.991778: SRV answer: 0 100 88 "ipa2.XXXXXXX."
[1625] 1581094927.991779: SRV answer: 0 100 88 "ipa1.XXXXXXX."
[1625] 1581094927.991780: Sending DNS SRV query for _kerberos._tcp.XXXXXXX.
[1625] 1581094927.991781: SRV answer: 0 100 88 "ipa1.XXXXXXX."
[1625] 1581094927.991782: SRV answer: 0 100 88 "ipa2.XXXXXXX."
[1625] 1581094927.991783: Resolving hostname ipa2.XXXXXXX.
[1625] 1581094927.991784: Resolving hostname ipa1.XXXXXXX.
[1625] 1581094927.991785: Resolving hostname ipa1.XXXXXXX.
[1625] 1581094927.991786: Initiating TCP connection to stream
10.10.1.10:88[1625] 1581094927.991787: Sending TCP request to stream
10.10.1.10:88[1625] 1581094928.1010: Received answer (744 bytes) from stream
10.10.1.10:88[1625] 1581094928.1011: Terminating TCP connection to stream
10.10.1.10:88[1625] 1581094928.1012: Sending DNS URI query for _kerberos.XXXXXXX.
[1625] 1581094928.1013: No URI records found
[1625] 1581094928.1014: Sending DNS SRV query for _kerberos-master._tcp.XXXXXXX.
[1625] 1581094928.1015: SRV answer: 0 100 88 "ipa1.XXXXXXX."
[1625] 1581094928.1016: SRV answer: 0 100 88 "ipa2.XXXXXXX."
[1625] 1581094928.1017: Response was from master KDC
[1625] 1581094928.1018: Processing preauth types: 19
[1625] 1581094928.1019: Selected etype info: etype aes256-cts, salt ",{hC[Z|]0:YJj>=(", params ""
[1625] 1581094928.1020: Produced preauth for next request: (empty)
[1625] 1581094928.1021: AS key determined by preauth: aes256-cts/5BC3
[1625] 1581094928.1022: Decrypted AS reply; session key is: aes256-cts/C25F
[1625] 1581094928.1023: FAST negotiation: available
[1625] 1581094928.1024: Initializing KEYRING:persistent:0:0 with default princ kreso@XXXXXXX
[1625] 1581094928.1025: Storing kreso@XXXXXXX -> krbtgt/XXXXXXX@XXXXXXX in KEYRING:persistent:0:0
[1625] 1581094928.1026: Storing config in KEYRING:persistent:0:0 for krbtgt/XXXXXXX@XXXXXXX: fast_avail: yes
[1625] 1581094928.1027: Storing kreso@XXXXXXX -> krb5_ccache_conf_data/fast_avail/krbtgt\/XXXXXXX\@XXXXXXX@X-CACHECONF: in KEYRING:persistent:0:0
[1625] 1581094928.1028: Storing config in KEYRING:persistent:0:0 for krbtgt/XXXXXXX@XXXXXXX: pa_type: 2
[1625] 1581094928.1029: Storing kreso@XXXXXXX -> krb5_ccache_conf_data/pa_type/krbtgt\/XXXXXXX\@XXXXXXX@X-CACHECONF: in KEYRING:persistent:0:0
Authenticated to Kerberos v5
Only difference in those two outputs is that on second one it used Preauth type 19 and that made it successful.