2

When trying 

kinit [email protected]

I get

[email protected]'s Password: 
kinit: krb5_get_init_creds: Clock skew too great

What to do?

Here is my timedatectl status

$ timedatectl status
      Local time: C  2018-03-01 14:28:48 EET
  Universal time: C  2018-03-01 12:28:48 UTC
        RTC time: S  2018-02-24 23:48:07
       Time zone: Europe/Riga (EET, +0200)
 Network time on: yes
NTP synchronized: yes
 RTC in local TZ: no
Improve this question

1 Answer 1

Reset to default
4

Best practice

Because Kerberos is very time sensitive you should configure your client machines to use one of your domain controllers as an NTP server. The DigitalOcean link further down recommends using ntp instead of systemd-timesyncd due to some optimized "smoothing" algorithms that prevent weird clock jumps that can break some applications "timestamp in the future, session aborted, etc".

If on a system with systemd and timedatectl

Run sudo gedit /etc/systemd/timesyncd.conf and uncomment NTP= and set your list of space separated servers to try, if you have laptops that may not be on VPN to access the domain controllers you should also set the FallbackNTP= to include something like pool.ntp.org or other public NTP servers.

Example /etc/systemd/timesyncd.conf

[Time]
NTP=domaincontroller.pithoslabs.com
FallbackNTP=ntp.ubuntu.com pool.ntp.org

Then sudo systemctl restart systemd-timesyncd to put the new changes into effect without rebooting.

If on a system without systemd

sudo apt install ntpdate
ntpdate domaincontroller.yourdomain.com
sudo gedit /etc/default/ntpdate

You will probably need to add a cron entry to run this daily for long running machines. You could also use ntp directly per this excellent DigitalOcean document, https://www.digitalocean.com/community/tutorials/how-to-set-up-time-synchronization-on-ubuntu-16-04

If you also have ntp installed, ntpdate-debian (ntpdate package with some tweaks from the upstream for debian/ubuntu) can also use /etc/ntp.conf, see the /etc/default/ntpdate file's comments.

Improve this answer
2
  • The clock skew remained after applying changes for a system with systemd and timedatectl.
    – Viesturs
    Mar 14, 2018 at 7:59
  • 1
    @Viesturs if you are on a domain and your machines are bound to that domain you should point to it as your NTP/SNTP server (assuming they are inside the same network as the domain or access it frequently via VPN).
    – dragon788
    Nov 6, 2019 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .