When trying

kinit 

I get

's Password:
kinit: krb5_get_init_creds: Clock skew too great

What to do?

Here is my timedatectl status

$ timedatectl status Local time: C  2018-03-01 14:28:48 EET Universal time: C  2018-03-01 12:28:48 UTC RTC time: S  2018-02-24 23:48:07 Time zone: Europe/Riga (EET, +0200) Network time on: yes
NTP synchronized: yes RTC in local TZ: no

1 Answer

Best practice

Because Kerberos is very time sensitive you should configure your client machines to use one of your domain controllers as an NTP server. The DigitalOcean link further down recommends using ntp instead of systemd-timesyncd due to some optimized "smoothing" algorithms that prevent weird clock jumps that can break some applications "timestamp in the future, session aborted, etc".

If on a system with systemd and timedatectl

Run sudo gedit /etc/systemd/timesyncd.conf and uncomment NTP= and set your list of space separated servers to try, if you have laptops that may not be on VPN to access the domain controllers you should also set the FallbackNTP= to include something like pool.ntp.org or other public NTP servers.

Example /etc/systemd/timesyncd.conf

[Time]
NTP=domaincontroller.pithoslabs.com
FallbackNTP=ntp.ubuntu.com pool.ntp.org

Then sudo systemctl restart systemd-timesyncd to put the new changes into effect without rebooting.

If on a system without systemd

sudo apt install ntpdate
ntpdate domaincontroller.yourdomain.com
sudo gedit /etc/default/ntpdate

You will probably need to add a cron entry to run this daily for long running machines. You could also use ntp directly per this excellent DigitalOcean document,

If you also have ntp installed, ntpdate-debian (ntpdate package with some tweaks from the upstream for debian/ubuntu) can also use /etc/ntp.conf, see the /etc/default/ntpdate file's comments.