(2025-12-03 8:41:55): [krb5_child[57584]] [get_and_save_tgt] (0x0020): [RID#209] 2009: [-1765328360][Preauthentication failed] ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2025-12-03 8:41:55): [krb5_child[57584]] [main] (0x0400): [RID#209] krb5_child started. * (2025-12-03 8:41:55): [krb5_child[57584]] [unpack_buffer] (0x1000): [RID#209] total buffer size: [96] * (2025-12-03 8:41:55): [krb5_child[57584]] [unpack_buffer] (0x0100): [RID#209] cmd [241 (auth)] uid [940000000] gid [940000000] validate [true] enterprise principal [false] offline [false] UPN [admin@OOO.TEST] * (2025-12-03 8:41:55): [krb5_child[57584]] [unpack_buffer] (0x2000): [RID#209] No old ccache * (2025-12-03 8:41:55): [krb5_child[57584]] [unpack_buffer] (0x0100): [RID#209] ccname: [KCM:] old_ccname: [not set] keytab: [/etc/krb5.keytab] * (2025-12-03 8:41:55): [krb5_child[57584]] [k5c_precreate_ccache] (0x4000): [RID#209] Recreating ccache * (2025-12-03 8:41:55): [krb5_child[57584]] [k5c_setup_fast] (0x0100): [RID#209] Fast principal is set to [host/np0005543227.ooo.test@OOO.TEST] * (2025-12-03 8:41:55): [krb5_child[57584]] [find_principal_in_keytab] (0x4000): [RID#209] Trying to find principal host/np0005543227.ooo.test@OOO.TEST in keytab. * (2025-12-03 8:41:55): [krb5_child[57584]] [match_principal] (0x1000): [RID#209] Principal matched to the sample (host/np0005543227.ooo.test@OOO.TEST). * (2025-12-03 8:41:55): [krb5_child[57584]] [check_fast_ccache] (0x0200): [RID#209] FAST TGT is still valid. * (2025-12-03 8:41:55): [krb5_child[57584]] [become_user] (0x0200): [RID#209] Trying to become user [940000000][940000000]. * (2025-12-03 8:41:55): [krb5_child[57584]] [main] (0x2000): [RID#209] Running as [940000000][940000000]. * (2025-12-03 8:41:55): [krb5_child[57584]] [set_lifetime_options] (0x0100): [RID#209] No specific renewable lifetime requested. * (2025-12-03 8:41:55): [krb5_child[57584]] [set_lifetime_options] (0x0100): [RID#209] No specific lifetime requested. * (2025-12-03 8:41:55): [krb5_child[57584]] [set_canonicalize_option] (0x0100): [RID#209] Canonicalization is set to [true] * (2025-12-03 8:41:55): [krb5_child[57584]] [main] (0x0400): [RID#209] Will perform auth * (2025-12-03 8:41:55): [krb5_child[57584]] [main] (0x0400): [RID#209] Will perform online auth * (2025-12-03 8:41:55): [krb5_child[57584]] [tgt_req_child] (0x1000): [RID#209] Attempting to get a TGT * (2025-12-03 8:41:55): [krb5_child[57584]] [get_and_save_tgt] (0x0400): [RID#209] Attempting kinit for realm [OOO.TEST] * (2025-12-03 8:41:55): [krb5_child[57584]] [sss_krb5_responder] (0x4000): [RID#209] Got question [password]. * (2025-12-03 8:41:55): [krb5_child[57584]] [get_and_save_tgt] (0x0020): [RID#209] 2009: [-1765328360][Preauthentication failed] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2025-12-03 8:41:55): [krb5_child[57584]] [map_krb5_error] (0x0020): [RID#209] 2138: [-1765328360][Preauthentication failed] (2025-12-03 8:46:24): [krb5_child[58450]] [get_and_save_tgt] (0x0020): [RID#240] 2009: [-1765328366][Client's credentials have been revoked] ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2025-12-03 8:46:24): [krb5_child[58450]] [main] (0x0400): [RID#240] krb5_child started. * (2025-12-03 8:46:24): [krb5_child[58450]] [unpack_buffer] (0x1000): [RID#240] total buffer size: [99] * (2025-12-03 8:46:24): [krb5_child[58450]] [unpack_buffer] (0x0100): [RID#240] cmd [241 (auth)] uid [940000000] gid [940000000] validate [true] enterprise principal [false] offline [false] UPN [admin@OOO.TEST] * (2025-12-03 8:46:24): [krb5_child[58450]] [unpack_buffer] (0x2000): [RID#240] No old ccache * (2025-12-03 8:46:24): [krb5_child[58450]] [unpack_buffer] (0x0100): [RID#240] ccname: [KCM:] old_ccname: [not set] keytab: [/etc/krb5.keytab] * (2025-12-03 8:46:24): [krb5_child[58450]] [k5c_precreate_ccache] (0x4000): [RID#240] Recreating ccache * (2025-12-03 8:46:24): [krb5_child[58450]] [k5c_setup_fast] (0x0100): [RID#240] Fast principal is set to [host/np0005543227.ooo.test@OOO.TEST] * (2025-12-03 8:46:24): [krb5_child[58450]] [find_principal_in_keytab] (0x4000): [RID#240] Trying to find principal host/np0005543227.ooo.test@OOO.TEST in keytab. * (2025-12-03 8:46:24): [krb5_child[58450]] [match_principal] (0x1000): [RID#240] Principal matched to the sample (host/np0005543227.ooo.test@OOO.TEST). * (2025-12-03 8:46:24): [krb5_child[58450]] [check_fast_ccache] (0x0200): [RID#240] FAST TGT is still valid. * (2025-12-03 8:46:24): [krb5_child[58450]] [become_user] (0x0200): [RID#240] Trying to become user [940000000][940000000]. * (2025-12-03 8:46:24): [krb5_child[58450]] [main] (0x2000): [RID#240] Running as [940000000][940000000]. * (2025-12-03 8:46:24): [krb5_child[58450]] [set_lifetime_options] (0x0100): [RID#240] No specific renewable lifetime requested. * (2025-12-03 8:46:24): [krb5_child[58450]] [set_lifetime_options] (0x0100): [RID#240] No specific lifetime requested. * (2025-12-03 8:46:24): [krb5_child[58450]] [set_canonicalize_option] (0x0100): [RID#240] Canonicalization is set to [true] * (2025-12-03 8:46:24): [krb5_child[58450]] [main] (0x0400): [RID#240] Will perform auth * (2025-12-03 8:46:24): [krb5_child[58450]] [main] (0x0400): [RID#240] Will perform online auth * (2025-12-03 8:46:24): [krb5_child[58450]] [tgt_req_child] (0x1000): [RID#240] Attempting to get a TGT * (2025-12-03 8:46:24): [krb5_child[58450]] [get_and_save_tgt] (0x0400): [RID#240] Attempting kinit for realm [OOO.TEST] * (2025-12-03 8:46:24): [krb5_child[58450]] [get_and_save_tgt] (0x0020): [RID#240] 2009: [-1765328366][Client's credentials have been revoked] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2025-12-03 8:46:24): [krb5_child[58450]] [map_krb5_error] (0x0020): [RID#240] 2138: [-1765328366][Client's credentials have been revoked] (2025-12-03 8:46:55): [krb5_child[58551]] [get_and_save_tgt] (0x0020): [RID#246] 2009: [-1765328366][Client's credentials have been revoked] ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2025-12-03 8:46:55): [krb5_child[58551]] [main] (0x0400): [RID#246] krb5_child started. * (2025-12-03 8:46:55): [krb5_child[58551]] [unpack_buffer] (0x1000): [RID#246] total buffer size: [99] * (2025-12-03 8:46:55): [krb5_child[58551]] [unpack_buffer] (0x0100): [RID#246] cmd [241 (auth)] uid [940000000] gid [940000000] validate [true] enterprise principal [false] offline [false] UPN [admin@OOO.TEST] * (2025-12-03 8:46:55): [krb5_child[58551]] [unpack_buffer] (0x2000): [RID#246] No old ccache * (2025-12-03 8:46:55): [krb5_child[58551]] [unpack_buffer] (0x0100): [RID#246] ccname: [KCM:] old_ccname: [not set] keytab: [/etc/krb5.keytab] * (2025-12-03 8:46:55): [krb5_child[58551]] [k5c_precreate_ccache] (0x4000): [RID#246] Recreating ccache * (2025-12-03 8:46:55): [krb5_child[58551]] [k5c_setup_fast] (0x0100): [RID#246] Fast principal is set to [host/np0005543227.ooo.test@OOO.TEST] * (2025-12-03 8:46:55): [krb5_child[58551]] [find_principal_in_keytab] (0x4000): [RID#246] Trying to find principal host/np0005543227.ooo.test@OOO.TEST in keytab. * (2025-12-03 8:46:55): [krb5_child[58551]] [match_principal] (0x1000): [RID#246] Principal matched to the sample (host/np0005543227.ooo.test@OOO.TEST). * (2025-12-03 8:46:55): [krb5_child[58551]] [check_fast_ccache] (0x0200): [RID#246] FAST TGT is still valid. * (2025-12-03 8:46:55): [krb5_child[58551]] [become_user] (0x0200): [RID#246] Trying to become user [940000000][940000000]. * (2025-12-03 8:46:55): [krb5_child[58551]] [main] (0x2000): [RID#246] Running as [940000000][940000000]. * (2025-12-03 8:46:55): [krb5_child[58551]] [set_lifetime_options] (0x0100): [RID#246] No specific renewable lifetime requested. * (2025-12-03 8:46:55): [krb5_child[58551]] [set_lifetime_options] (0x0100): [RID#246] No specific lifetime requested. * (2025-12-03 8:46:55): [krb5_child[58551]] [set_canonicalize_option] (0x0100): [RID#246] Canonicalization is set to [true] * (2025-12-03 8:46:55): [krb5_child[58551]] [main] (0x0400): [RID#246] Will perform auth * (2025-12-03 8:46:55): [krb5_child[58551]] [main] (0x0400): [RID#246] Will perform online auth * (2025-12-03 8:46:55): [krb5_child[58551]] [tgt_req_child] (0x1000): [RID#246] Attempting to get a TGT * (2025-12-03 8:46:55): [krb5_child[58551]] [get_and_save_tgt] (0x0400): [RID#246] Attempting kinit for realm [OOO.TEST] * (2025-12-03 8:46:55): [krb5_child[58551]] [get_and_save_tgt] (0x0020): [RID#246] 2009: [-1765328366][Client's credentials have been revoked] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2025-12-03 8:46:55): [krb5_child[58551]] [map_krb5_error] (0x0020): [RID#246] 2138: [-1765328366][Client's credentials have been revoked]