Trace Kerberos in the CLI

Luke Hebert

- One minute read - 207 words

Kerberos authentication failures can be frustrating to debug. Setting the KRB5_TRACE environment variable gives you detailed library-level logging that pinpoints exactly where the exchange breaks down. Most programs using MIT krb5 1.9 or later support this trace logging out of the box, so you do not need to install extra tooling.

Enabling Trace Logging

To enable trace logging, set the KRB5_TRACE environment variable to a filename before running the program. On many operating systems, the filename /dev/stdout can be used to send trace logging output directly to standard output, which is handy for quick diagnostics.

export KRB5_TRACE=/dev/stdout
kinit user@REALM

If you prefer to capture the output to a file for later review, point the variable at a file path instead:

export KRB5_TRACE=/tmp/krb5_trace.log
kinit user@REALM
cat /tmp/krb5_trace.log

What to Look For

The trace output includes the full sequence of library calls, DNS lookups, and network exchanges. Common issues you can spot include:

  • Incorrect realm names or case mismatches
  • DNS SRV record failures when locating the KDC
  • Clock skew errors between the client and the KDC
  • Ticket cache conflicts or stale credentials

Once you have identified the issue, unset the variable to stop generating trace output:

unset KRB5_TRACE

Reference