kpasswd - Cannot contact any KDC for requested realm changing password

Question

After kinit user1 successfully

I tried to change passwd with kpasswd user1

$ kpasswd user1
Password for user1@EXAMPLE.COMN:
Enter new password:
Enter it again:
kpasswd: Cannot contact any KDC for requested realm changing password

How can I debug this problem?

How can I see logs of kpasswd?

Answer 1

I could set ENV KRB5_TRACE and see logs.

$ KRB5_TRACE=/dev/stdout kpasswd user1
...
...
Enter new password:
Enter it again:
[19347] 1542261437.864732: Creating authenticator for ... -> kadmin/changepw@..., seqnum 0, subkey aes256-cts/BC93, session key aes256-cts/6786
[19347] 1542261437.866856: Resolving hostname ...
[19347] 1542261437.867433: Sending initial UDP request to dgram ...
[19347] 1542261440.870780: Sending retry UDP request to dgram ...
[19347] 1542261445.876049: Sending retry UDP request to dgram ...
kpasswd: Cannot contact any KDC for requested realm changing password