besides dropping the deprecated Sandbox option, set `GSSAPICleanupCredentials no` since that's what I have on a fresh installation of CentOS 8.