pam_krb5 can't locate my KDC

sayali k sayali_s_kulkarni at
Mon Aug 21 00:02:06 EDT 2006

Hi Michael,
  From what I know about Kerberos and the configurations for the same, ideally there is one more section which I feel should be included in the krb5.conf file. It is called the libdefaults section where we can specify the default values for some of the parameters like the domain name, ticket lifetime etc. The section looks something like this:
        ticket_lifetime = 24000
        default_realm = MYDOMAIN.COM

  So you need to have 3 sections in your krb5.conf - libdefaults, realms and domain_realms.
  Normally they do provide a template for the Kerberos config file with the installation for every OS. 
  E.g. for AIX the default file looks as : 
  # krb5.conf template
# In order to complete this configuration file
# you will need to replace the __<name>__ placeholders
# with appropriate values for your network.
        default_realm = ___default_realm___
        ___default_realm___ = {
                kdc = ___master_kdc___
                admin_server = ___master_kdc___
        default = FILE:/var/krb5/kdc.log
        kdc = FILE:/var/krb5/kdc.log
        kdc_rotate = {
  # How often to rotate kdc.log. Logs will get rotated no more
# often than the period, and less often if the KDC is not used
# frequently.
                  period = 1d
  # how many versions of kdc.log to keep around (kdc.log.0, kdc.log.1, ...)
                  versions = 10
        kinit = {
                renewable = true
                forwardable= true
  This is the same for all the UNIX flavours. 
  Can you try adding the libdefaults section as well in the krb5.conf file?
  All the best,

Michael B Allen <mba2000 at> wrote:
  I was just trying pam_krb5 for kicks but it can't find my KDC. My
/etc/krb5.conf is just:

kdc =

[domain_realm] = WIN.NET = WIN.NET

I would think this should be sufficient no?

>From looking at a capture I can see it trying a TXT
lookup but even if I add a record for this with "WIN.NET" I see no
communication with the KDC.

Obviously I don't know what I'm doing. Can someone enlighten me?


Michael B Allen
PHP Active Directory SSO
Kerberos mailing list Kerberos at

 The all-new Yahoo! Mail goes wherever you go - free your email address from your Internet provider.

More information about the Kerberos mailing list