Thank you all for your time and attention. Very simply I'm getting this error when invoking kinit to test kerberos authentication against my AD domain (which is hosted on a Server 2012 box).The error:    kinit: Cannot contact any KDC for realm 'MYDOMAIN.LOCAL' while getting initial credentialsNow, everything is fixed when I either explicitly set the KDC to an IP address instead of the host name in /etc/krb5.conf (e.g. kdc = 172.16.0.10 vs kdc = ad0.mydomain.local and same with admin_server) and it also works when the KDC is set as the hostname in /etc/krb5.conf and the KDC also has an explicit entry in /etc/hosts. My real question is why is this necessary? The whole point of DNS is to not have to use these local hosts files and I don't want my config setup that way. Does anyone know why this works this way? All the usual network tools and the host -t SRV ... queries all seem to work correctly (details below) without these extra steps (/etc/krb5.conf lists host name and no entry in /etc/hosts).So can anyone tell me why kinit seems to be ignoring my resolv.conf file?Tokenslocal host IP is 172.16.0.20Local hostname is psLocal FQDN is ps.mydomain.localAD host IP is 172.16.0.10AD hostname is ad0AD FQDN is ad0.mydomain.localAD is primary DNSdomain is mydomain.local (I know .local is bad, working on it)Network is 172.16.0.0/24/etc/network/interfacesauto loiface lo inet loopbackauto eth0iface eth0 inet static  address 172.16.0.20  netmask 255.255.255.0  gateway 172.16.0.1  network 172.16.0.0  broadcast 172.16.0.255  dns-nameservers 172.16.0.10 8.8.8.8  dns-search MYDOMAIN.LOCAL/etc/hosts127.0.0.1 localhost172.16.0.20 ps.mydomain.local ps# IPv6 stuff, don't think it's relevant to the problem::1 localhost ip6-localhost ip6-loopbackff02::1 ip6-allnodesff02::2 ip6-allrouters/etc/resolv.conf - automatically generatednameserver 172.16.0.10nameserver 8.8.8.8search MYDOMAIN.LOCAL/etc/krb5.conf[libdefaults]  default_realm = MYDOMAIN.LOCAL  dns_lookup_kdc = true  dns_lookup_realm = true  # tried dns_lookup_realm as both true and false, no change[realms]  MYDOMAIN.LOCAL = {    kdc = ad0.mydomain.local    admin_server = ad0.mydomain.local    default_domain = mydomain.local  }[domain_realm]  .opticonwa.local = OPTICONWA.LOCAL  opticonwa.local = OPTICONWA.LOCALNot including smb.conf as this all works once kinit functions.Testsuser@ps:~$ KRB5_TRACE=/dev/stdout kinit administrator[1634] 1447281918.814976: Getting initial credentials for administrator@MYDOMAIN.LOCAL[1634] 1447281918.815297: Sending request (181 bytes) to MYDOMAIN.LOCAL[1634] 1447281918.815346: Resolving hostname ad0.mydomain.local[1634] 1447281923.817731: Resolving hostname ad0.mydomain.localkinit: Cannot contact any KDC for realm 'MYDOMAIN.LOCAL' while getting initial credentialsuser@ps:~$ host -t SRV _kerberos._udp.mydomain.local_kerberos._udp.mydomain.local has SRV record 0 0 88 ad0.mydomain.local._kerberos._udp.mydomain.local has SRV record 0 100 88 ad0.mydomain.local.user@ps:~$ host -t SRV _kerberos._tcp.mydomain.local_kerberos._tcp.mydomain.local has SRV record 0 0 88 ad0.mydomain.local._kerberos._tcp.mydomain.local has SRV record 0 100 88 ad0.mydomain.local.user@ps:~$ dig -x 172.16.0.10; <<>> DiG 9.9.5-3ubuntu0.5-Ubuntu <<>> -x 172.16.0.10;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19749;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 4000;; QUESTION SECTION:;10.0.16.172.in-addr.arpa.  IN  PTR;; ANSWER SECTION:10.0.16.172.in-addr.arpa. 1200 IN   PTR ad0.mydomain.local.;; Query time: 2 msec;; SERVER: 172.16.0.10#53(172.16.0.10);; WHEN: Thu Nov 12 11:19:27 PST 2015;; MSG SIZE  rcvd: 92Not sure why I'm showing 2 SRV records as the server only has 1 (at least that I'm aware of).output of gentent hosts ...user@ps:~$ getent hosts ad0.mydonaim.localuser@ps:~$ getent hosts 172.16.0.10172.16.0.10 ad0.mydomain.localSo reverse lookups work when the hosts file does not contain an entry for the domain controller. Forward lookups do not. Both work when the entry is in hosts...Output of nsswitch.conf unmodified from base install...passwd:     files winbindgroup:      files winbind#passwd:         compat#group:          compatshadow:         compathosts:          files mdns4_minimal [NOTFOUND=return] dnsnetworks:       filesprotocols:      db filesservices:       db filesethers:         db filesrpc:            db filesnetgroup:       nisSo can anyone tell me why kinit seems to ignore /etc/resolv.conf? Does it have to do with the incomplete DNS implementation for the admin_server stanza in /etc/krb5.conf? Or am I stuck in some kind of DNS catch-22 that I'm failing to notice? But why only Kerberos? As an add-on question, why does the local host name need to be in /etc/hosts anyway? Can someone point me to a thorough writeup on linux networking that would explain how this works on the back end?Thanks again for your help. This is really bugging me.
Kerberos DNS issue with /etc/hosts
linux;networking;dns;kerberos
For kinit/kerberos to work properly, host name lookups should work for both forward and reverse zones. On Linux hosts nsswitch.conf determines the sources to obtain name-service information. Each line in that file controls the database sources, for example hosts line determines what sources would be looked up for host name resolution.With default setting of hostshosts:          files mdns4_minimal [NOTFOUND=return] dnsDNS will not be looked up at all and it would return if host record was not found in files (/etc/hosts) and mdns4_minimal (This source seem to be related to avahi-daemon multicast DNS, however it seems unable to resolve your kerberos host)Removing [NOTFOUND=return] allowed host resolution process to contact dns servers in /etc/resolv.conf (which seem to be working as per dig requests seen above)