Kerberos is a network authentication protocol that uses tickets to allow clients and servers to prove their identity to each other. Kerberos relies on accurate time synchronization between the parties involved, as the tickets have expiration dates and timestamps. If the system clock of a Linux server is off by more than five minutes from the LDAP server or the domain controller, the Kerberos authentication will fail and generate errors. A local firewall is unlikely to block authentication requests if the server can communicate over the network and is configured correctly. The users' passwords are not relevant if theyare known-working LDAP credentials. The server has access to the LDAP host if it can communicate over the network and is configured correctly. References:
* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html
/identity_management_guide/kerberos_errors
* https://www.ibm.com/docs/en/aix/7.2?topic=authentication-kerberos-time-synchronization