Hi Rob, I follow one of your suggestions in another post, it's :
"certmonger _should_ have renewed them. Try killing ntpd, going back a few days,
restart krb5kdc, dirsrv, httpd and the CA then certmonger and see what happens"
I did it, no success with messages:
- MainThread ipa DEBUG Could not connect to the Directory Server on
ca-ldap01.domain.com: Insufficient access: Invalid credentials
- ca-dap01 certmonger: 2018-08-07 10:40:39 [4831] Internal error
- ca-ldap01 [sssd[ldap_child[5045]]]: Failed to initialize credentials using keytab
[MEMORY:/etc/krb5.keytab]: Cannot contact any KDC for realm 'DOMAIN.COM'. Unable
to create GSSAPI-encrypted LDAP connection.
- ca-ldap01 [sssd[ldap_child[5045]]]: Cannot contact any KDC for realm
'DOMAIN.COM'
And I notice that Kerberos somehow still shows current date, instead of 2018-08-07 (my
back in time).
[root@ca-ldap01 ~]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin(a)DOMAIN.COM
Valid starting Expires Service principal
10/25/2018 20:55:02 10/26/2018 20:54:58 krbtgt/DOMAIN.COM(a)DOMAIN.COM
Is this reason for failure?
Hi,
when you go back in time, avoid using ipactl start to restart all the
services as it will restart ntpd (and set back the time to the current
time). Use systemctl start instead.
flo
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...