Problems With the Format of the krb5.conf File
If the krb5.conf file is not formatted properly, the telnet command will fail. However, the dtlogin and login commands will still succeed, even if the krb5.conf file is specified as required for the commands. If this problem occurs, the following error message is displayed:
Error initializing krb5: Improper format of Kerberos configuration
In addition, an incorrectly formatted krb5.conf file, prevents the applications that use the GSSAPI from using the krb5 mechanisms.
If there is a problem with the format of the krb5.conf file, you are vulnerable to security breaches. You should fix the problem before you allow Kerberos features to be used.
Problems Propagating the Kerberos Database
If propagating the Kerberos database fails, try /usr/bin/rlogin -x between the slave KDC and master KDC, and from the master KDC to the slave KDC server.
If the KDCs have been set up to restrict access, rlogin is disabled and cannot be used to troubleshoot this problem. To enable rlogin on a KDC, you must enable the eklogin service.
# svcadm enable svc:/network/login:eklogin
After you finish troubleshooting the problem, you need to disable the eklogin service..
If rlogin does not work, problems are likely because of the keytab files on the KDCs. If rlogin does work, the problem is not in the keytab file or the name service, because rlogin and the propagation software use the same host/host-name principal. In this case, make sure that the kpropd.acl file is correct.
Problems Mounting a Kerberized NFS File System
In this example, the setup allows one reference to the different interfaces and a single service principal instead of three service principals in the server's keytab file.
Problems Authenticating as root
If authentication fails when you try to become superuser on your system and you have already added the root principal to your host's keytab file, there are two potential problems to check. First, make sure that the root principal in the keytab file has a fully qualified host name as its instance. If it does, check the /etc/resolv.conf file to make sure that the system is correctly set up as a DNS client.
Observing Mapping from GSS Credentials to UNIX Credentials
To be able to monitor the credential mappings, first uncomment this line from the /etc/gss/gsscred.conf file.
Next instruct the gssd service to get information from the /etc/gss/gsscred.conf file.
# pkill -HUP gssd
Now you should be able to monitor the credential mappings as gssd requests them. The mappings are recorded by syslogd, if the syslog.conf file is configured for the auth system facility with the debug severity level.