We were seeing the following error today when trying to run sudo:
sudo: kerb5: Cannot verify TGT! Possible attack!: Clock skew too great
Clocks were synchronized, so it wasn’t that, and the Internet wasn’t helpful for this issue beyond insisting we had a clock problem. Turns out the Kerberos “replay cache” (or “rcache”) had become corrupt somehow on multiple hosts. The issue was fixed by removing /var/krb5/rcache/root/hosts_0. After that, success!