0

Hello I'm trying to create keytab. This client system is already joined to domain.

Below I have a flurry of errors. Looks like 2 main errors though, most notably:

create_local_private_krb5_conf_for_domain: smb_mkstemp failed, for
file /var/lib/samba/lock/smb_tmp_krb5.S7p77o. Errno Permission denied

.

ads_connect: No logon servers are currently available to service the logon request.

. and

kerberos_kinit_password user@something.com failed: Client not found in Kerberos database

.

$ net ads keytab create
create_local_private_krb5_conf_for_domain: smb_mkstemp failed, for file /var/lib/samba/lock/smb_tmp_krb5.3KhTHs. Errno Permission denied
Enter user's password:
create_local_private_krb5_conf_for_domain: smb_mkstemp failed, for file /var/lib/samba/lock/smb_tmp_krb5.S7p77o. Errno Permission denied
ads_connect: No logon servers are currently available to service the logon request.
create_local_private_krb5_conf_for_domain: smb_mkstemp failed, for file /var/lib/samba/lock/smb_tmp_krb5.njsTEl. Errno Permission denied
kerberos_kinit_password user@something.com failed: Client not found in Kerberos database
create_local_private_krb5_conf_for_domain: smb_mkstemp failed, for file /var/lib/samba/lock/smb_tmp_krb5.hwnaei. Errno Permission denied
ads_connect: No logon servers are currently available to service the logon request.

With sudo:

[user@hostname ~]$ sudo net ads keytab create
Enter root's password:
ads_connect: No logon servers are currently available to service the logon request.
kerberos_kinit_password root@something.com failed: Client not found in Kerberos database
ads_connect: No logon servers are currently available to service the logon request.

Does anyone know at least which error is most important right now?

bluesquare
  • 37
  • 1
  • 8
  • The leading `$` in your command line and the permission denied errors suggest that you are running the commands as an unprivileged user. Log in as root or run the commands with `sudo` – Bob Sep 16 '20 at 15:04
  • I also tried with being root tho. sudo or as root results in a lot of the same. Ill update my quesiton sorry – bluesquare Sep 16 '20 at 15:23

1 Answers1

0

Did you run kinit YOURADMINUSER?

That fixed it for me. From https://web.mit.edu/kerberos/krb5-1.12/doc/user/user_commands/kinit.html

kinit obtains and caches an initial ticket-granting ticket for principal.

Which is required to create keytab because keytab,

A keytab (short for “key table”) stores long-term keys for one or more principals. https://web.mit.edu/kerberos/krb5-devel/doc/basic/keytab_def.html

and we need a FIRST ticket to store.

bluesquare
  • 37
  • 1
  • 8