kinit: KDC can‘t fulfill requested option while renewing credentials

kinit: KDC can’t fulfill requested option while renewing credentials

背景

在测试集群上装上了kerberos，今天同事需要使用kinit -R 命令，在执行时报错

kinit -R
kinit: KDC can't fulfill requested option while renewing credentials

解决

1，检查配置文件/var/kerberos/krb5kdc/kdc.conf，在[realms]下需要有max_renewable_life = 7d

完整配置如下：

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 AM.COM = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  max_renewable_life = 7d #这个必须有
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

2.修改配置后需要重启

systemctl restart krb5kdc

3.klist 查看cache文件 或者在/etc/krb5.conf中查看相应的配置文件，推荐使用klist

 klist
Ticket cache: FILE:/tmp/krb5cc_0 #这里是cache文件位置
Default principal: root@AM.COM

Valid starting       Expires              Service principal
09/22/2022 09:53:48  09/23/2022 09:53:48  krbtgt/AM.COM@AM.COM

/etc/krb5.conf

4.执行以下命令修改maxrenewlife
为啥推荐使用klist，执行命令需要和和klist中的Default principal: root@AM.COM对应

kadmin.local -q 'modprinc -maxrenewlife "1 week" +allow_renewable root@AM.COM'

5.清除cache

rm -rf /tmp/krb5cc_*

6.重新认证

kinit -kt /tmp/root.keytab root

7.klist查看出现 renew until字样说明成功

klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: root@AM.COM

Valid starting       Expires              Service principal
09/22/2022 09:56:58  09/23/2022 09:56:58  krbtgt/AM.COM@AM.COM
        renew until 09/29/2022 09:56:58

8.重新执行kinit -R成功

[root@master tmp]# kinit -R
You have new mail in /var/spool/mail/root
[root@master tmp]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: hbase@AM.COM

Valid starting       Expires              Service principal
09/22/2022 10:24:32  09/23/2022 10:24:32  krbtgt/AM.COM@AM.COM
        renew until 09/29/2022 09:59:04