From what I experience, during " killing ntpd, going back a few days, restart
krb5kdc, dirsrv, httpd and the CA then certmonger", service ipa-dnskeysyncd.service
is failing.
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: ipa : DEBUG Kerberos principal:
ipa-dnskeysyncd/ca-ldap04.domain.com
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: ipa : DEBUG Initializing principal
ipa-dnskeysyncd/ca-ldap04.domain.com using keytab /etc/ipa/dnssec/ipa-dnskeysyncd.keytab
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: ipa : DEBUG using ccache
/tmp/ipa-dnskeysyncd.ccache
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: ipa : DEBUG Attempt 1/5: success
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: ipa : DEBUG LDAP URL:
ldapi://%2Fvar%2Frun%2Fslapd-US-ORACLE-COM.socket/cn%3Ddns%2Cdc%3Dus%2Cdc%3Doracle%2Cdc%3Dcom??sub?%28%7C%28objectClass%3DidnsZone%29%28objectClass%3DidnsSecKey%29%28objectClass%3Dipk11PublicKey%29%29
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: ipa : INFO LDAP bind...
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: ipa : ERROR Login to LDAP server
failed: {'desc': 'Invalid credentials'}
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: Traceback (most recent call last):
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: File
"/usr/libexec/ipa/ipa-dnskeysyncd", line 90, in <module>
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd:
ldap_connection.sasl_interactive_bind_s("", ipaldap.SASL_GSSAPI)
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: File
"/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 850, in
sasl_interactive_bind_s
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: res =
self._apply_method_s(SimpleLDAPObject.sasl_interactive_bind_s,*args,**kwargs)
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: File
"/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 818, in
_apply_method_s
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: return func(self,*args,**kwargs)
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: File
"/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 229, in
sasl_interactive_bind_s
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: return
self._ldap_call(self._l.sasl_interactive_bind_s,who,auth,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls),sasl_flags)
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: File
"/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 99, in _ldap_call
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: result = func(*args,**kwargs)
Aug 10 10:19:18 ca-ldap04 ipa-dnskeysyncd: INVALID_CREDENTIALS: {'desc':
'Invalid credentials'}
Aug 10 10:19:18 ca-ldap04 systemd: ipa-dnskeysyncd.service: main process exited,
code=exited, status=1/FAILURE
Aug 10 10:19:18 ca-ldap04 systemd: Unit ipa-dnskeysyncd.service entered failed state.
Aug 10 10:19:18 ca-ldap04 systemd: ipa-dnskeysyncd.service failed.
And other logs like :
Aug 10 10:17:38 ca-ldap04 ns-slapd: [10/Aug/2018:10:17:38.973963675 -0700] csngen_new_csn
- Warning: too much time skew (-6959333 secs). Current seqnum=47
Aug 10 10:17:53 ca-ldap04 named-pkcs11[2514]: GSSAPI Error: Unspecified GSS failure.
Minor code may provide more information (Ticket not yet valid)
Aug 10 10:17:53 ca-ldap04 named-pkcs11[2514]: LDAP error: Local error: SASL(-1): generic
failure: GSSAPI Error: Unspecified GSS failure.