Kinit: KDC can't fulfill requested option while renewing credentials

Support
,
1

System Version NethServer release 6.10 (Final)
Kernel 2.6.32-754.35.1.el6.x86_64

Since December 3rd, 2020 I have been receiving the following error message via email from my server.
Not every hour, but several times a day:

/etc/cron.hourly/smbads_tgt:
kinit: KDC can’t fulfill requested option while renewing credentials

Nothing was changed on the Nethserver, nor on the Windows Active Directory.

The manual readout of the data via Winbind works.
The server is also properly in AD.

Does anyone here have any idea too?
Thanks in advance.

2

Out of my league, but an online search suggest the error is due to KDC failing to generate a renewable ticket-granting ticket and one of the solutions consists in increasing the max_renewable_life.

You might try to analyze kinit/klist or the verbose output of the command called by the hourly cronjob (which is trying to refresh TGT for any service with KrbStatus prop set to “enabled”):

/usr/libexec/nethserver/smbads -v tgt

A note about End Of Life of NethServer 6:

3 Likes
3

Thanks, I have completely doubled the values in krb5.conf.
Let’s see if it helps.
Everything works, but the error emails are annoying.
Since nothing was changed, did a Microsoft patch on the domain controllers cause this?

I have a Nethserver v7.9 and v6.10.
The v6.10 is the mail server.
When I have the time, I will redo this one and install a new one. An upgrade is probably not possible or not recommended, right?

Thanks for the information.

4

Here is the documentation referring to upgrade from Nethserver v6:

2 Likes
5

I have now set the verbose switch.
Then at least the reports will be gone.
/ usr / libexec / nethserver / smbads -v tgt

I think I’d rather not do an in-place upgrade.
Thanks to virtualization, everything is so easy.
I’ll just set up a new Nethserver 7.9 and transfer all settings cleanly.
I think then I’ll have a lean and pure system afterwards. And then I can switch over when everything is finished and tested.
Let’s see.

many thanks

3 Likes