Decrypt integrity check failed while getting initial ticket

[Greg Hudson]

On 12/9/19 1:04 PM, Stephen Carville (Kerberos List) wrote:
> Recently I migrated the kerberos master and one slave to another 
> location using tool called "Zerto".  Perhaps coincidentally, replication 
> broke with the above error message. I checked that DNS A and PTR records 
> for all the servers are correct.  I can get a ticket using kinit (kinit 
> -k host/<hostname>). I finally recreated the keytab file 
> (/etc/krb5.keytab) and propagated it to the other three servers.  Still 
> no replication.

I suggest running "KRB5_TRACE=/dev/stdout kprop ..." to get a better
idea of what ticket it's trying to get.  It should be doing something
similar to "kinit -k host/hostname", but if you've just migrated hosts,
there could be a difference in the canonical hostname as it appears to
libkrb5.