On Mon, Jan 09, 2017 at 01:07:06PM +0530, Rakesh Rajasekharan wrote: > Hi, > > I am using a Freeipa 4.2.0 server. > > I sometimes see, "clock skew too great" errors in /var/log/krb5kdc.log. And > when this happens, usually logins or new ipa-cleint-install fails. > > When I checked on one of the hosts for which the clock skew was reported, > > #> ntpq -p > remote refid st t when poll reach delay offset > jitter > ============================================================================== > *ip-10-10-1-150.e 171.66.97.126 2 u 869 1024 377 0.448 0.047 > 0.142
In general, 5 minutes is OK at least. But are you sure the server is also in sync or just the client against an NTP server (iow, are you sure you are checking the difference between a client and the KDC as well?) -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
