Decrypt integrity check failed while getting initial ticket

Benjamin Kaduk kaduk at
Mon Dec 9 13:31:19 EST 2019

Answering only the unimportant part for lack of insight on the other one...

On Mon, Dec 09, 2019 at 10:04:17AM -0800, Stephen Carville (Kerberos List) wrote:
> Recently I migrated the kerberos master and one slave to another 
> location using tool called "Zerto".  Perhaps coincidentally, replication 
> broke with the above error message. I checked that DNS A and PTR records 
> for all the servers are correct.  I can get a ticket using kinit (kinit 
> -k host/<hostname>). I finally recreated the keytab file 
> (/etc/krb5.keytab) and propagated it to the other three servers.  Still 
> no replication.
> Any suggestions?
> BTW, while trying to fix it, I noticed that every time I use ktadd to 
> add a key to krb5.keytab the KVNO increments.  Is that normal?

Yes, that is normal.  Otherwise any administrator with "extract keytab"
permissions could ~silently fetch the currently in-use keys for a service
and start decrypting or forging traffic; requiring a kvno increment (and
new random key) makes the operation more noticeable and prevents the
exfiltration of the live, in-use, key material.


More information about the Kerberos mailing list