Reason kerberos error kdc has no support for encryption type. 123 1 1 4. ws. Press Win and R to open the run box, and type “ services. domain. NET. Configuration impacket version: v0. 110 [0 ms] Login attempt by domain user 'domain\john. Frequently seen errors; Errors seen by admins. Getting this error message:- "KDC has no support for encryption type while getting initial credentials" Dec 26, 2023 · To determine whether a problem is occurring with Kerberos authentication, check the System event log for errors from any services (such as Kerberos, kdc, LsaSrv, or Netlogon) on the client, target server, or domain controller that provide authentication. Some of the settings pertaining to Kerberos encryption types in Active Directory are covered in the Disabling Weaker Encryption Types article. gov) to make sure you can reach the server at the other end. 4 VM Jul 21, 2012 · I have defined a new realm as follows: • Global security>JAAS – Application logins • Created a new login named “client” and allocated the com. asked Dec 7, 2022 at 16:13. The default_tkt_enctypes lists combinations of the encryption type, such as checksum, available for service tickets encryption and hashing. Reset the computer account password of the source domain controller. x. 1 Answer. Apr 28, 2017 · 5. 2. com My krb5 KRB5_WRONG_ETYPE: Requested encryption type not used in message KRB5_PROG_SUMTYPE_NOSUPP: Program lacks support for checksum type KRB5_REALM_UNKNOWN: Cannot find KDC for requested realm KRB5_SERVICE_UNKNOWN: Kerberos service unknown KRB5_KDC_UNREACH: Cannot contact any KDC for requested realm KRB5_NO_LOCALNAME: No local name found for principal The session key: the KDC randomly chooses this key and places one copy inside the ticket and the other copy inside the encrypted part of the reply. To resolve this problem, update the registry on each computer that participates in the Kerberos authentication process, including the client computers. TL;DR one has to remember to unlock the user and set their password when using adtool instead of the MMC. Nov 11, 2022 · Removing the patch and rebooting the DCs resolves the issue. Note: The name of the user account is identified in the event message log. 0x13. internal. A valid Kerberos key is required to get a Kerberos ticket from the Kerberos Key Distribution Center (KDC). As a workaround I tried applying a Group Policy to permit RC4_HMAC_MD5 and higher & future encryption types on the DCs but that didn't have any impact. Content may vary, for example: When configuring Kerberos authentication on the TIBCO Spotfire Server, running kinit results in KrbException: KDC has no support for encryption type (14) Print the salt, by list -e command. May 2, 2023 · Reason: Kerberos Error: KDC has no support for encryption type Details: Error: Machine account creation procedure failed [nnn]Loaded the preliminary configuration. Have a problem where have SSSD installed on a remote desktop (running CentOS7) and occasionally have problems logging in (including via ssh) using my AD credentials. For information here is what I did - Installed the suggested Kerberos packages in the Ubuntu server; Edited the configuration files as suggested To eliminate the “KDC has no support for encryption type while getting initial credentials” issue change the default encryption type in the libdefaults section of the /etc/krb5. xx. If any such errors exist, there might be errors associated with the Kerberos protocol as well. Does this mean that the delegation is not working? The client here would be referring to a missing SPN in your KDC. Stop the cluster through CM. kdc kerberos. The reply-encrypting key: the KDC uses this to encrypt the reply it sends to the client. The november security updates introduced bugs in kerberos that may be the reason for this behavior. I got problem with this auth. 132] warn : No matching EMS message for Kerberos error: KDC has no support for encryption Mar 18, 2021 · Stop the KDC service on the destination domain controller. To resolve this issue, you must reset the password of the user account that has corrupt Kerberos keys. 0), but client tools and CMC work fine. com servertest01 -S dc. Error: command failed: Failed to create the Active Directory machine account "DEPTA". SQL1365N db2start or db2stop failed in processing the plugin "IBMkrb5". the output will tell you the name of the account. com Apr 3, 2015 · This is most generic problem while configuring kerberos, Please resolve this by doing the following, 1) vi /var/kerberos/krb5kdc/kdc. Sep 20, 2023 · ::> vserver cifs security modify -vserver vs1 -is-aes-encryption-enabled true Error: command failed: Password update failed. add_entry -key -p <my SAMAccountName>@<MY DOMAIN IN CAPS> -k 1 -e aes256-cts-hmac-sha1-96. 2 - Right-click the object, select Properties, and then select Trusts. ibm. jar for unlimited strenght (JCE) so that it gets overlay while unpacking in PCF. Step 2. Kerberos data is stored inside LDAP. NAS storage management. conf and the server kdc. kerberos. SERVICE_REVOKED. [@mylaptop ~]$ telnet krb-fnal-1. LOCAL". The settings of SQL server and AD are the same as the question asked before, and the user used to login has enabled "This account supports Kerberos AES 128 bit encryption" and "This account supports Kerberos AES 256 bit encryption". To be clear, every ticket has a unique session key and the domain controller does not attempt to remember each session key. And then try NTLM. setProperty(java. This basically works, but there is a strange side effect. gov 88. The result is that the computer is unable to decrypt the ticket. Error: Failed to create the Active Directory machine account "NetApp-3318". Add the default_tgs_enctypes and default_tkt_enctypes to your config. Symptoms . This can also happen while starting a service where the enctypes in the krbtgt principal do not match those Nov 23, 2022 · K40933118: KDC has no support for encryption type after patching Domain Controllers. Generally I suggest to try to run update-crypto-policies --set DEFAULT:AD-SUPPORT or LEGACY but I don’t know if these would work for you. DOMAIN. First, I get the kerberos ticket with kinit. This value indicates what information the KDC will write to Feb 15, 2023 · Step 1. KRB5_WRONG_ETYPE: Requested encryption type not used in message KRB5_PROG_SUMTYPE_NOSUPP: Program lacks support for checksum type KRB5_REALM_UNKNOWN: Cannot find KDC for requested realm KRB5_SERVICE_UNKNOWN: Kerberos service unknown KRB5_KDC_UNREACH: Cannot contact any KDC for requested realm KRB5_NO_LOCALNAME: No local name found for principal Issue. However, it is advisable to review Microsoft's documentation on the topic - and discuss with Microsoft if needed. Include the encryption types supported by your KDC. x) but client tools, . [000. Feb 4, 2022 · Ask Question. Enter the salt. conf and tell use what OS the clients are. APM Active Directory Authentication fails. We recommend that you update all of your Windows-based systems, especially if your users have to log on across multiple domains or forests. Please check if the KDC has setting restricting specific encryption types. Dec 8, 2022 at 5:53. When configuring Kerberos authentication on the TIBCO Spotfire Server, running kinit results in KrbException: KDC has no support for encryption type (14) Details: While setting up Kerberos authentication on the TIBCO Spotfire Server, running the "kinit" command might show the following exception. For AS replies, this is a long-term key of the client principal. com works on server-side but on a Linux client I get: $ kvno HTTP/server. Volume administration. Reapplying the patch and rebooting the DCs and the problem repeats. Some or all users cannot login to java Infoview or Java CMC (XI 3. Once it is done with a session key it will discard it. Reason: SecD Error: no server available. Oct 10, 2023 · The default and common encryption settings that both Windows Kerberos and MIT Kerberos (Java implementation) supports are RC4-HMAC, DES-CBC-CRC and DES-CBC-MD5. To solve the problem, add default_tkt_enctypes entry to [libdefaults] section of Kerberos configuration file. Ensure that the keytab file contains the service principal for Db2®. default_realm = SUBDOMAIN. 2. Ask your AD administrator to enable support for AES-256 encryption types on the AD account associated with the keytab. Dec 13, 2022 · # kinit -k 'RHEL-HOST$@AD. $ sudo python3 /opt/ With all the above observations that refer to KDC not having support for the enctype, it was noticed on the AD box that the node user account didn't have AES256 encryption at the user profile level: In ActiveDirectory server > Edit Node user account properties > Account > Account Options > " This account supports kerberos aes 256 bit encryption A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more. 4 - On on the Trust General tab check box next to "The other domain supports AES Nov 18, 2020 · Stack Exchange Network. old and new KDC. xx, port 88 failed: Network is unreachable. Another possibility is that the Service Account(WebAgent and the Policy Server service account) has "Use Kerberos DES encryption types for this account Feb 8, 2024 · Learn more about our award-winning Support Create Account NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any Dec 13, 2022 · Hello, Chris here from Directory Services support team with part 3 of the series. [ 20387] Loaded the preliminary configuration. Jul 28, 2018 · Check the " Kerberos Encryption Types" under CM > Administration > Security > Kerberos Credentials > Configuration. (-1765328370) Environment. Nov 17, 2021 · ** for encryption type (KRB5KDC_ERR_ETYPE_NOSUPP) Error: command failed: Failed to create the Active Directory machine account "FURFARO01". com': KDC has no support for encryption type (KRB5KDC_ERR_ETYPE_NOSUPP) Apr 15, 2024 · Kerberos library reports: "Additional pre-authentication required" In kerberos_send_request ***** START: KERBEROS PACKET DECODE ***** Kerberos: Message type KRB_AS_REQ Kerberos: Preauthentication type encrypt timestamp Kerberos: Option forwardable Kerberos: Option renewable Kerberos: Option renewable accepted Kerberos: Client Name myUsername Dec 5, 2023 · Issue. For TGS replies, this is either the session OAM11gR2 : Kerberos : kinit: KDC Has No Support For Encryption Type While Getting Initial Credentials (Doc ID 1565077. Both 3DES and RC4 are weak encryption Sep 7, 2021 · KDC_ERR_SUMTYPE_NOSUPP: KDC has no support for checksum type: The KDC, server, or client receives a packet for which it doesn't have a key of the appropriate encryption type. Krb5LoginModuleWrapperClient resource. LOCAL. Aug 5, 2020 · the "kinit: KDC has no support for encryption type while getting initial credentials" usually occurs after configuring encryption types that do not match the ones present in the tgt principal (such as krbtgt/CLOUDERA@CLOUDERA) in the KDC. com -D specifies the domain -S specifies a domain controller Sep 2, 2020 · The domain controller will then use the KRBTGT password to decrypt the TGT, extract the session key then decrypt the authenticator. The session key enctype must be present in (1) the enctypes listed in. Oct 30, 2015 · 1) Why encryption types does the client support? 1) Why encryption types does the KDC support? Post your the clients krb5. KDC_ERR_ETYPE_NOTSUPP: KDC has no support for encryption type: The KDC or client received a packet that it can’t decrypt. Mar 7, 2008 · The main thing I see is: Kerberos: Error-Code = 14 (KDC has no support for encr… Still having issues getting SSO to work. com: Either get rid of the colon or add the port that the kdc is running on. the KDC request, (2) the KDC's permitted_enctypes if set, and (3) the. To find that account, run this command: setspn -Q nn/myserver01@TOTO. Enter your user ID: administrator Enter your password: Error: command failed: Password update failed. 16 (decimal) or 0x10 (hexadecimal): Log audit events on encryption type (ETYPE) and bad options errors. Enable "Manage krb5. 0. msc ” to open Services. Red Hat Enterprise Linux 8 Reason: Kerberos Error: KDC has no support for encryption type Details: Error: Machine account creation procedure failed [nnn]Loaded the preliminary configuration. Oct 15, 2021 · My first thought is that old ciphers are being used, but you are using a mostly recent Windows Server version. 0x10: KDC_ERR_PADATA_TYPE_NOSUPP: KDC has no support for PADATA type (pre-authentication data) 8 (decimal) or 0x8 (hexadecimal): Log a KDC warning event ID 25 in the system log when the user who asks for the S4U2Self ticket doesn't have sufficient access to the target user. Sorted by: 2. Install updates on the remote PC. Enter the username and password for the CIFS domain "NASLAB. If I'm wrong I'd love to be corrected. Apr 25, 2024 · Error: command failed: Password update failed. SECD log: SVM changes its machine account password in the AD when the AES security option is modified. You switched accounts on another tab or window. [ 9611] Loaded the preliminary configuration. Ssh'ing in as root and checking the status of the sssd process, I see [root@airflowetl tmp]# systemctl status sssd. Some of all users cannot login to BI Launchpad (BI 4. You signed out in another tab or window. Solution 3. I’ve had one of our network engineers sniff the traffic and they came back with the attached PDF. 9. Network management. Improve this question. . 19. fnal. SAN storage management. Reason code = "10". Use AD Sites and Services or Repadmin. Also check the local host(s) krb5. KRB_TGS_REQ will always fail when the SPN can't be found. Sign in to view the entire content of this KB article. Dec 17, 2020 · Check the " Kerberos Encryption Types" under CM > Administration > Security > Kerberos Credentials > Configuration. Hope this resolves the problem. I get this ERROR. Reason: Kerberos Error: KDC has no support for encryption type Sep 7, 2021 · KDC_ERR_ETYPE_NOSUPP: KDC has no support for encryption type: 0xf: KDC_ERR_SUMTYPE_NOSUPP: KDC has no support for checksum type: 0x10: KDC_ERR_PADATA_TYPE_NOSUPP: KDC has no support for PADATA type (pre-authentication data) Smart card logon is being attempted and the proper certificate cannot be located. 11, port 445 using TCP [6] Successfully connected to ip 10. This is due to a workstation restriction on the account, or a logon time restriction, or logon attempt outside logon hours, or accout disabled, expired, or locked out. I'm running a Kerberos / LDAP authentication server for many years. Sep 5, 2016 · I'm setting up openLDAP with SASL authentification with kerberos. [nnn]Successfully connected to ip 10. You can modify certain CIFS server Kerberos security settings, including the maximum allowed Kerberos clock skew time, the Kerberos ticket lifetime, and the Sep 8, 2023 · KDC_ERR_ETYPE_NOSUPP: KDC has no support for encryption type: 0xf: KDC_ERR_SUMTYPE_NOSUPP: KDC has no support for checksum type: 0x10: KDC_ERR_PADATA_TYPE_NOSUPP: KDC has no support for PADATA type (pre-authentication data) Smart card logon is being attempted and the proper certificate cannot be located. [ 9628] TCP connection to ip 10. Share. 0 Build 20348 x64 (cme results) Using the KRBTGT ticket to generate an valid ticket. Important. Modified 2 years, 3 months ago. It will start with CN=xxx, where "xxx" is the name of the AD account. 0xF: KDC_ERR_SUMTYPE_NOSUPP: KDC has no support for checksum type: The KDC, server, or client received a packet that it doesn’t have an appropriate encryption key for, so it can’t decrypt the ticket. Kerberos typically permits a 5-minute time skew. krb5. example. Reason: Kerberos Error: KDC Unreachable Details: Error: Machine account creation procedure failed. Apr 23, 2021 · cluster1::> vserver cifs create -vserver Sales -cifs-server Sales -domain Test. Cluster administration. Jan 6, 2015 · This might be due to the mismatch of encryption types between clients and the KDC server. com My krb5 KDC Policy Rejects Request: Sub Rule: User Logon Failure: Authentication Failure: KDC Cannot Accommodate Request Option: Sub Rule: User Logon Failure: Authentication Failure: KDC Has No Support For Encryption Type: Sub Rule: User Logon Failure: Authentication Failure: KDC Has No Support For Checksum Type: Sub Rule: User Logon Failure Hello, I'm also interested in tips about this "no support for encryption type". Credentials for server have been revoked. So, no pr Feb 7, 2024 · Fails to initiate Kerberos authentication. KDC_ERR_. 3 - In the Domains that trust this domain (incoming trusts) box, select the trusting domain. Add a comment. Problem: JDK 17 Kerberos does not support rc4-hmac anymore, as is marked as non secured. The 2022 November security updates introduced bugs in Kerberos that may be the reason for the “encryption type not Oct 20, 2021 · KDC_ERR_SUMTYPE_NOSUPP: KDC has no support for checksum type: The KDC, server, or client receives a packet for which it does not have a key of the appropriate encryption type. conf, “KDC” path); Sep 30, 2022 · Delete the computer account in the domain (the account must already exist): # adcli delete-computer -D domain. I have 3 test machines: nfsserver, nfsclient, nfskerberos What I've got is: root@nfsclient:~# mount -v -t nfs4 -o sec=krb5 nfsserver. [ 94] Kerberos authentication failed with result: 7537. x, port 88 using TCP [nnn]FAILURE: Could not authenticate as 'contosa. microsoft. 11, port 88 using TCP [10] KDC has nosupport for encryption Apr 25, 2024 · Info: In order to disable CIFS AES encryption, the password for the CIFS server machine account must be reset. Viewed 2k times. Stack Exchange network consists of 183 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers. For TGS replies, this is either the session I am trying to get NFS4 + Kerberos to work on Debian Squeeze. May 10, 2023 · However, after we upgrade to Java 17 due to some security reasons, the Kerberos authentication failed. 6 Target OS: Windows 10. Aug 17, 2018 · I can't help with the kerberos issue, but you don't need to do this I have created my own buildpack for deployment to PCF and added the local_policy. com My krb5 KRB5_WRONG_ETYPE: Requested encryption type not used in message KRB5_PROG_SUMTYPE_NOSUPP: Program lacks support for checksum type KRB5_REALM_UNKNOWN: Cannot find KDC for requested realm KRB5_SERVICE_UNKNOWN: Kerberos service unknown KRB5_KDC_UNREACH: Cannot contact any KDC for requested realm KRB5_NO_LOCALNAME: No local name found for principal Oct 30, 2023 · KDC has no support for encryption type – Ensure supported enctypes match on client and KDC. When I make a klist, the ticket is displayed. gov. CIFS creation fails: ::>cifs create -vserver vserver1 -cifs-server COMP1 -domain domain -ou CN=Computers -default-site "" -status-admin up. KDC_ERR_TGT_REVOKED. Find Kerberos Key Distribution Center, right-click it, and then choose Restart. Authentication and access control. During a TGS request, "KDC has no support for encryption type" can mean. 2) check for supported_enctypes, use any encryption techniques mentioned in there. If fail, send us email at lqcd-admin@fnal. Hello, I'm also interested in tips about this "no support for encryption type". log to debug issues. If the Windows Kerberos client (Enforce side) is needed to handle other than the default encryption type DES3-CBC-SHA1. Matching the salt is important, since ktutil algorithm is different from Active Directory. security. that the KDC could not select an encryption type for the session key. Look at the Kerberos encryption types supported by the KDC and make sure that the Kerberos principal(s) being used comply with the supported/valid types. Dec 26, 2023 · Resolution. com': KDC has no support for encryption type (KRB5KDC_ERR_ETYPE_NOSUPP) Reason: Kerberos Error: KDC has no support for encryption type. 1. com kvno: KDC has no support for encryption type while getting credentials for HTTP/server. 1. With the November 2022 security update, some things were changed as to how the Kerberos Key Distribution Center (KDC) Service on the Domain Controller determines what encryption types are supported by the KDC and what encryption types are supported by default for users, computers, Group Managed Service Accounts The following table lists some possible errors and their solutions. COM Please verify Active Directory and DNS configuration. KDC has no support for encryption type while getting initial credentials; credential verification failed: KDC has no support for encryption type; Cannot create cert chain: certificate has expired; kprop: No route to host while connecting to server; kprop: Connection refused while connecting to server Jan 19, 2022 · 8. Select "Deploy Kerberos client configuration" from the drop-down near your cluster. doe' using NTLMv2 style security [0] Successfully connected to ip 10. auth. Now, I have a second site and want to mirror the server to the new site. Reload to refresh your session. Description. KRB5_WRONG_ETYPE: Requested encryption type not used in message KRB5_PROG_SUMTYPE_NOSUPP: Program lacks support for checksum type KRB5_REALM_UNKNOWN: Cannot find KDC for requested realm KRB5_SERVICE_UNKNOWN: Kerberos service unknown KRB5_KDC_UNREACH: Cannot contact any KDC for requested realm KRB5_NO_LOCALNAME: No local name found for principal May 3, 2016 · I have setup my Ansible Tower and Windows Kerberos / Active Directory authentication as specified here. At code level I am setting the path for the KDC: System. Step 1: Check your connectivity, as shown below, to one of the Fermilab Kerberos authentication servers (such as krb-fnal-1. 1) Last updated on MAY 09, 2023. Synchronize the time clocks on the Kerberos and GKLM servers. If successful move to step 2. Applies to: Oracle Access Manager - Version 11. Dec 7, 2022 · windows-11. See full list on learn. To do it, run the following command at a command prompt: Start replication on the destination domain controller from the source domain controller. Reason: Kerberos Error: KDC has no support for encryption type Error: User authentication procedure failed CIFS SMB2 Share mapping - Client Ip = 10. KDC has no support for encryption type while getting initial credentials; credential verification failed: KDC has no support for encryption type; Cannot create cert chain: certificate has expired; kprop: No route to host while connecting to server; kprop: Connection refused while connecting to server Feb 4, 2016 · RESOLUTION 1: 1 - In Active Directory Domains and Trusts, navigate to the trusted domain object. Adding in RC4 as a permissible encryption made it able to join. The session key: the KDC randomly chooses this key and places one copy inside the ticket and the other copy inside the encrypted part of the reply. Do you have a capture of the Kerberos requests (on udp&tcp port 88)? – u1686_grawity. Reason: Kerberos Error: KDC has no support for encryption type. Now, I can only speculate as to why the "KDC has no support for encryption type" message appeared: since there was no password, there wasn't an encryption type. com My krb5 Sep 27, 2019 · When configuring Kerberos authentication on the TIBCO Spotfire Server, the "kinit" KrbException: KDC has no support for encryption type (14) Solution: While setting up Kerberos authentication on the TIBCO Spotfire Server, running the "kinit" command might show the following exception. Asked 2 years, 3 months ago. lab. The Java buildpack has shipped with unlimited strength JCE for quite some time now. KDC has no support for encryption type while getting initial credentials; credential verification failed: KDC has no support for encryption type; Cannot create cert chain: certificate has expired; kprop: No route to host while connecting to server; kprop: Connection refused while connecting to server Jun 26, 2013 · The problem is likely the hanging colons at the end of the kdc line. NET Infoview, and CMC work fine. Unable to create SMB volume on the SVM in CVS for GCP. 0 and later Information in this document applies to any platform. KDC has no support for encryption type while getting initial credentials; credential verification failed: KDC has no support for encryption type; Cannot create cert chain: certificate has expired; kprop: No route to host while connecting to server; kprop: Connection refused while connecting to server Jul 30, 2021 · You signed in with another tab or window. Oct 10, 2023 · The message is evident that the KDC side is told to use a specific encryption type but it is not enabled or allowed. Backend its a CIFS setup. Common Kinit Errors and Solutions. Clients credentials have been revoked. Reason: Kerberos Error: KDC has no support for encryption type Error: command failed: Failed to create the Active Directory machine account "XXXXXX". Go to CM --> Administration --> Kerberos --> 'Kerberos Encryption Types', then add the following encryption types: des3-hmac-sha1. EXAMPLE. 24 Python version: Python 3. Suggested solution is here. Tried to join a RL8. AD module: authentication with 'auser' failed: KDC has no support for encryption type, principal name: auser@EXAMPLE. Reason: general failure. COM, Sname: SP_SVC_ACT. Error: Machine account creation procedure failed. Here are some specific examples of common kinit errors and how to resolve them: Kinit: Client ‘[email protected]‘ not found in Kerberos Hello, I'm also interested in tips about this "no support for encryption type". COM' kinit: KDC has no support for encryption type while getting initial credentials The issue still persists even after running this command on RHEL 8 clients: # update-crypto-policies --set DEFAULT:AD-SUPPORT Environment. Please follow the below steps and see if it helps. We would like to show you a description here but the site won’t allow us. conf through Cloudera Manager" from the same configuration page. Facing a very annyoing issue with JDK 17 upgrade and new Kerberos auth that is supported. Riguez. S3 object storage management. My ActiveDirectory administrator has created DES-CBC-MD5 keytab on 2003 server and $ kinit -k -t keytab HTTP/server. Apr 25, 2024 · Info: In order to disable CIFS AES encryption, the password for the CIFS server machine account must be reset. It is the same procedure explained in the official documentation too. 0x10: KDC_ERR_PADATA_TYPE_NOSUPP: KDC has no support for PADATA type (pre-authentication data) Jun 16, 2003 · 18. If I have time, I’ll spin up an AD lab and see if I can reproduce. conf file to make sure it complies with the KDC encryption types. Enable Kerberos logging and monitor /var/log/krb5libs. INFO: Kerberos Deprecate 3DES and RC4 in Kerberos 3DES and RC4 Kerberos encryption types have now been disabled by default. The Domain controllers are set to only use AES as per the group policy. conf file. write_kt <keytab name>. 10. conf. To verify that the Kerberos keys are valid and functioning Dec 23, 2016 · Kerberos Message : KRB_TGS_ERROR, KDC_ERR_C_PRINCIPAL_UNKNOWN: Client not found in Kerberos database, Cname: nothing, Realm: SUB. 009. am tg hl ob vh kn rf bv qo wy