Log filling up with kadmind: no such file or directory while initializing

Followup, if I run kadmind from the command line I get:

Couldn't open log file var/log/krb5kdc/kadmin.log: Permission denied
kadmind: Permission denied while initializing, aborting

Which explains why the krb5kdc log folder in Console is greyed out....related or coincidence?

Thanks, started clean, Kerberos is running without errors, though I still can't connect using Kerberos auth (for example, iCal), and further I can't seem to access anything except the Wiki. iCal's logging 403 forbidden errors. ::smacks head::

With Kerberos required, I get no logged errors on the client nor the server, just a dialog that says "Sorry, you entered an invalid username or password" - "Please try again".

If I set to "Any Method" of authentication, I gain access just fine. Still get the same errors when trying to connect to iCal, though, no success regardless of authentication type.

Full error, incidentally, for iCal (and this is just opening iCal on the server, not attempting from an external client):

3/10/09 12:05:01 AM iCal[4126] CalDAV CalDAVGetAccountPropertiesOperation failed: status 'HTTP/1.1 401 Unauthorized' request:

<?xml version="1.0" encoding="utf-8"?>
<x0:propfind xmlns:x2="http://calendarserver.org/ns/" xmlns:x1="urn:ietf:params:xml:ns:caldav" xmlns:x0="DAV:">
<x0:prop>
<x1:calendar-home-set/>
<x1:calendar-user-address-set/>
<x1:schedule-inbox-URL/>
<x1:schedule-outbox-URL/>
<x2:dropbox-home-URL/>
<x2:notifications-URL/>
<x0:displayname/>
</x0:prop>
</x0:propfind>

... response:
HTTP/1.1 401 Unauthorized
Date: Tue, 10 Mar 2009 05:05:01 GMT
Content-Length: 141
Content-Type: text/html
Www-Authenticate: negotiate, digest nonce="20479288996101959981014771594", realm="/Search", algorithm="md5"
Server: Twisted/2.5.0 TwistedWeb/[twisted.web2, version 0.2.0]

Hm, I definitely have a reverse PTR. But there's also definitely a problem with Kerberos. In the Directory, I click Edit for a user and get a GSSAPI Error (cannot find ticket for requested realm) followed by a "if you haven't dismissed the Kerberos authentication dialog by clicking 'Cancel', chances are there is a problem with Kerberos." Interestingly, there's never a dialog presented to me.

In case it's relevant, as mentioned, this is a new iMac. It will not boot from the OS X Server Install DVD - I have to start out with the client version of OS X and run the installer from the disc, and then reboot sans install DVD. If I try to boot from the DVD it restarts over and over again. Enterprise support said this is "normal" since the install DVD comes with 10.5.4 - it won't boot from a machine that came with 10.5.6 client.

Is it possible that something that the client version does with Kerberos (standalone machine?) doesn't get corrected in the Server install, preventing it from working? I'm postulizing this theory as I see in my error log shortly after boot:

com.apple.KerberosAutoConfig[3244] Couldn't find KerberosClient config record