Steve Reed via FreeIPA-users wrote:
Hi all,
I am running Versions 4.8 of the client installations. I have one machine that installed except it failed to configure the krb5.conf file properly and it fails saying that it can't find the KDC for the realm xyz.com. I can fix Kerberos by manually editing the kfb5.conf file. Except for the rest of the machines which won't work for ldap logins, but Kerberos works fine.
Prior to the installation, I make sure the resolv.conf file is configured properly. I make sure that the /etc/hosts file has the proper entries for the machine I am installing on and the server. No extraneous domain names. Also, I make sure the hostname is fully qualified with the domain name. I turn off any potential firewalld, iptables or ip6tables services as well.
This is the installation command:
ipa-client-install --mkhomedir -p admin -w PassWord@12345! --ntp-server=idm.xyz.com --unattended --force-join --realm XYZ.COM
2021-05-07T20:36:19Z DEBUG Logging to /var/log/ipaclient-install.log 2021-05-07T20:36:19Z DEBUG ipa-client-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'force': False, 'verbose': False, 'ip_addresses': None, 'configure_firefox': False, 'realm_name': 'XYZ.COM', 'force_ntpd': False, 'on_master': False, 'no_nisdomain': False, 'ssh_trust_dns': False, 'principal': 'admin', 'keytab': None, 'no_ntp': False, 'domain_name': None, 'request_cert': False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None, 'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers': ['idm.xyz.com'], 'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh': False, 'force_join': True, 'firefox_dir': None, 'unattended': True, 'quiet': False, 'nisdomain': None, 'prompt_password': False, 'host_name': None, 'permit': False, 'automount_location': None, 'preserve_sssd': False, 'mkhomedir': True, 'log_file': None, 'uninstall': False} 2021-05-07T20:36:19Z DEBUG IPA version 4.6.8-5.el7.centos 2021-05-07T20:36:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/selinuxenabled 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout= 2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/bin/systemctl is-enabled chronyd.service 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout=enabled
2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG [IPA Discovery] 2021-05-07T20:36:19Z DEBUG Starting IPA discovery with domain=None, servers=None, hostname=client1.xyz.com 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com" (domain of the hostname) and its sub-domains 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com. 2021-05-07T20:36:19Z DEBUG [Kerberos realm search] 2021-05-07T20:36:19Z DEBUG Kerberos realm forced 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _kerberos._udp.xyz.com 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 88 idm.xyz.com. 2021-05-07T20:36:19Z DEBUG [LDAP server check] 2021-05-07T20:36:19Z DEBUG Verifying that idm.xyz.com (realm XYZ.COM) is an IPA server 2021-05-07T20:36:19Z DEBUG Init LDAP connection to: ldap://idm.xyz.com:389 2021-05-07T20:36:19Z DEBUG Search LDAP server for IPA base DN 2021-05-07T20:36:19Z DEBUG Check if naming context 'dc=xyz,dc=com' is for IPA 2021-05-07T20:36:19Z DEBUG Naming context 'dc=xyz,dc=com' is a valid IPA context 2021-05-07T20:36:19Z DEBUG Search for (objectClass=krbRealmContainer) in dc=xyz,dc=com (sub) 2021-05-07T20:36:19Z DEBUG Found: cn=XYZ.COM,cn=kerberos,dc=xyz,dc=com 2021-05-07T20:36:19Z DEBUG Discovery result: Success; server=idm.xyz.com, domain=xyz.com, kdc=idm.xyz.com, basedn=dc=xyz,dc=com 2021-05-07T20:36:19Z DEBUG Validated servers: idm.xyz.com 2021-05-07T20:36:19Z DEBUG will use discovered domain: xyz.com 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com" (Validating DNS Discovery) and its sub-domains 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com. 2021-05-07T20:36:19Z DEBUG DNS validated, enabling discovery 2021-05-07T20:36:19Z DEBUG will use discovered server: idm.xyz.com 2021-05-07T20:36:19Z INFO Discovery was successful! 2021-05-07T20:36:19Z DEBUG will use discovered realm: XYZ.COM 2021-05-07T20:36:19Z DEBUG will use discovered basedn: dc=xyz,dc=com 2021-05-07T20:36:19Z INFO Client hostname: client1.xyz.com 2021-05-07T20:36:19Z DEBUG Hostname source: Machine's FQDN 2021-05-07T20:36:19Z INFO Realm: XYZ.COM 2021-05-07T20:36:19Z DEBUG Realm source: Discovered from LDAP DNS records in idm.xyz.com 2021-05-07T20:36:19Z INFO DNS Domain: xyz.com 2021-05-07T20:36:19Z DEBUG DNS Domain source: Discovered LDAP SRV records from xyz.com (domain of the hostname) 2021-05-07T20:36:19Z INFO IPA Server: idm.xyz.com 2021-05-07T20:36:19Z DEBUG IPA Server source: Discovered from LDAP DNS records in idm.xyz.com 2021-05-07T20:36:19Z INFO BaseDN: dc=xyz,dc=com 2021-05-07T20:36:19Z DEBUG BaseDN source: From IPA server ldap://idm.xyz.com:389 2021-05-07T20:36:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:19Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r XYZ.COM 2021-05-07T20:36:19Z DEBUG Process finished, return code=5 2021-05-07T20:36:19Z DEBUG stdout= 2021-05-07T20:36:19Z DEBUG stderr=realm not found
2021-05-07T20:36:19Z INFO Skipping synchronizing time with NTP server. 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/bin/keyctl get_persistent @s 0 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout=599779671
2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG Enabling persistent keyring CCACHE 2021-05-07T20:36:19Z DEBUG Writing Kerberos configuration to /tmp/tmpfFCY1T: 2021-05-07T20:36:19Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults] default_realm = XYZ.COM dns_lookup_realm = false dns_lookup_kdc = false rdns = false dns_canonicalize_hostname = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid}
[realms] XYZ.COM = { kdc = idm.xyz.com:88 master_kdc = idm.xyz.com:88 admin_server = idm.xyz.com:749 kpasswd_server = idm.xyz.com:464 default_domain = xyz.com pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm] .xyz.com = XYZ.COM xyz.com = XYZ.COM client1.xyz.com = XYZ.COM
2021-05-07T20:36:19Z DEBUG Initializing principal admin@XYZ.COM using password 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/bin/kinit admin@XYZ.COM -c /tmp/krbccnj9ncO/ccache 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout=Password for admin@XYZ.COM:
2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG trying to retrieve CA cert via LDAP from idm.xyz.com 2021-05-07T20:36:19Z DEBUG retrieving schema for SchemaCache url=ldap://idm.xyz.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fc3c40d7248> 2021-05-07T20:36:19Z INFO Successfully retrieved CA cert Subject: CN=Certificate Authority,O=XYZ.COM Issuer: CN=Certificate Authority,O=XYZ.COM Valid From: 2021-05-06 19:54:28 Valid Until: 2041-05-06 19:54:28
2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-join -s idm.xyz.com -b dc=xyz,dc=com -h client1.xyz.com -f 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr=Keytab successfully retrieved and stored in: /etc/krb5.keytab Certificate subject base is: O=XYZ.COM
2021-05-07T20:36:20Z INFO Enrolled in IPA realm XYZ.COM 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/kdestroy 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG Initializing principal host/client1.xyz.com@XYZ.COM using keytab /etc/krb5.keytab 2021-05-07T20:36:20Z DEBUG using ccache /etc/ipa/.dns_ccache 2021-05-07T20:36:20Z DEBUG Attempt 1/5: success 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/ipa/default.conf' 2021-05-07T20:36:20Z DEBUG -> Not backing up - '/etc/ipa/default.conf' doesn't exist 2021-05-07T20:36:20Z INFO Created /etc/ipa/default.conf 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf' 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/nsswitch.conf' 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:20Z INFO Configured sudoers in /etc/nsswitch.conf 2021-05-07T20:36:20Z INFO Configured /etc/sssd/sssd.conf 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/krb5.conf' 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/keyctl get_persistent @s 0 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout=599779671
2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG Enabling persistent keyring CCACHE 2021-05-07T20:36:20Z DEBUG Writing Kerberos configuration to /etc/krb5.conf: 2021-05-07T20:36:20Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults] default_realm = XYZ.COM dns_lookup_realm = true dns_lookup_kdc = true rdns = false dns_canonicalize_hostname = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid}
[realms] XYZ.COM = { pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm] .xyz.com = XYZ.COM xyz.com = XYZ.COM client1.xyz.com = XYZ.COM
2021-05-07T20:36:20Z INFO Configured /etc/krb5.conf for IPA realm XYZ.COM 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -N -f /tmp/tmpxItqiM/pwdfile.txt -f /tmp/tmpxItqiM/pwdfile.txt 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -A -n CA certificate 1 -t C,, -a -f /tmp/tmpxItqiM/pwdfile.txt 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG failed to find session_cookie in persistent storage for principal 'host/client1.xyz.com@XYZ.COM' 2021-05-07T20:36:20Z INFO trying https://idm.xyz.com/ipa/json 2021-05-07T20:36:20Z DEBUG Created connection context.rpcclient_140479019423504 2021-05-07T20:36:20Z INFO [try 1]: Forwarding 'schema' to json server 'https://idm.xyz.com/ipa/json' 2021-05-07T20:36:20Z DEBUG New HTTP connection (idm.xyz.com) 2021-05-07T20:36:20Z DEBUG HTTP connection destroyed (idm.xyz.com) Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in single_request self.get_auth_info() File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in get_auth_info self._handle_exception(e, service=service) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in _handle_exception raise errors.KerberosError(message=unicode(e)) KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' 2021-05-07T20:36:20Z DEBUG Destroyed connection context.rpcclient_140479019423504 2021-05-07T20:36:20Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3670, in main install(self) File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2391, in install _install(options) File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2733, in _install api.finalize() File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 740, in finalize self.__do_if_not_done('load_plugins') File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 431, in __do_if_not_done getattr(self, name)() File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 619, in load_plugins for package in self.packages: File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line 954, in packages ipaclient.remote_plugins.get_package(self), File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py", line 134, in get_package plugins = schema.get_package(server_info, client) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 553, in get_package schema = Schema(client) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 401, in __init__ fingerprint, ttl = self._fetch(client, ignore_cache=read_failed) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 426, in _fetch schema = client.forward(u'schema', **kwargs)['result'] File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1151, in forward return self._call_command(command, params) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1127, in _call_command return command(*params) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1281, in _call return self.__request(name, args) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1248, in __request verbose=self.__verbose >= 3, File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request return self.single_request(host, handler, request_body, verbose) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in single_request self.get_auth_info() File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in get_auth_info self._handle_exception(e, service=service) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in _handle_exception raise errors.KerberosError(message=unicode(e))
2021-05-07T20:36:20Z DEBUG The ipa-client-install command failed, exception: KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' 2021-05-07T20:36:20Z ERROR Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' 2021-05-07T20:36:20Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
So, what I found is that the krb5.conf file is partially configured. I'm not sure what to look for in the sssd.conf file. I am assuming that since I can't login with an ldap account and it finds the domain that something is not cofigured properly for that either.
Any thoughts on what is going wrong? And how I can fix it or work around it? I'm more worried about not being able to do ldap logins than the Kerberos problem since I have a work around for that.
Can you expand on what you mean by ldap logins fail?
Is there a reason you're forcing the Kerberos realm and not relying on discovery?
rob