/var/log/krb5kdc.log server not found, how to do a kinit or krb5.conf that freeipa likes better

[Jelle de Jong]

Hello everybody,

Can someone help how to do a kinit or change my krb5.conf so freeipa 
does not create "Server not found in Kerberos database" warnings 
flooding the logs?

After freeipa crashed because root / was 100% filled due to 
/var/log/krb5kdc.* total size being more then 30GB I found that the log 
is full with:

[root@freeipa01 ~]# tail -n 2 /var/log/krb5kdc.log
Mar 06 20:54:42 freeipa01.powercraft.lan krb5kdc[122009](info): TGS_REQ 
(6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), 
camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), 
aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 
192.168.25.22: UNKNOWN_SERVER: authtime 0, etypes {rep=UNSUPPORTED:(0)} 
nextcloud(a)POWERCRAFT.LAN for krbtgt/(null)(a)POWERCRAFT.LAN, Server not 
found in Kerberos database

[root@nextcloud01 ~]# sudo -u apache kinit -r 14d -l 7d 
nextcloud(a)POWERCRAFT.LAN

I create a kerberos ticket with the above command to create a ticket for 
apache with nextcloud to use to access samba (libsmbclient) with 
kerberos as user nextcloud (samba01 and nextcloud01 are both ipa clients)

[root@nextcloud01 ~]# sudo -u apache klist
Ticket cache: KEYRING:persistent:48:48
Default principal: nextcloud(a)POWERCRAFT.LAN

Valid starting     Expires            Service principal
03/06/21 19:04:04  03/07/21 19:03:14 
cifs/samba01.powercraft.lan(a)POWERCRAFT.LAN
	renew until 03/13/21 19:03:14
03/06/21 19:03:14  03/07/21 19:03:14  krbtgt/POWERCRAFT.LAN(a)POWERCRAFT.LAN
	renew until 03/13/21 19:03:14

[root@nextcloud01 ~]# cat /etc/krb5.conf
#File modified by ipa-client-install

includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/

[libdefaults]
   default_realm = POWERCRAFT.LAN
   dns_lookup_realm = true
   dns_lookup_kdc = true
   rdns = false
   dns_canonicalize_hostname = false
# ticket_lifetime = 24h
   forwardable = true
   udp_preference_limit = 0
   default_ccache_name = KEYRING:persistent:%{uid}
# krb5_ccname_template = FILE:%d/krb5cc_%U

[realms]
   POWERCRAFT.LAN = {
     pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
     pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem

   }

[domain_realm]
   .powercraft.lan = POWERCRAFT.LAN
   powercraft.lan = POWERCRAFT.LAN
   nextcloud01.powercraft.lan = POWERCRAFT.LAN
[

Thank you in advance,

Kind regards,

Jelle de Jong