Clock skew limits are configurable in the Kerberos protocols. The default setting is five minutes.

You also must ensure that you can do a reverse DNS lookup on the IP address of your KDC. Also, the name that this reverse lookup maps to must either be the NetBIOS name of the KDC (i.e., the hostname with no domain attached) or it can be the NetBIOS name followed by the realm.

The easiest way to ensure you get this right is to add a /etc/hosts entry mapping the IP address of your KDC to its NetBIOS name. If you do not get this correct, then you will get a local error when you try to join the realm.

If all you want is Kerberos support in smbclient, then you can skip directly to Testing with smbclient now. Create the Computer Account and Testing Server Setup are needed only if you want Kerberos support for smbd and winbindd.