Thanks. Got it.
On Tue, Aug 7, 2018 at 11:13 PM Robbie Harwood <rharwood(a)redhat.com> wrote:
Quan Zhou via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
writes:
> It took me a few days to figure out that it was the `/var/lib/krb5kdc`
> directory whom has no execution perms set, so that the contents within
> cannot be accessed by the wsgi process that caused the problem, after
> 'sudo chmod a+x /var/lib/krb5kdc' the problem is then resolved.
>
> I wonder if this issue can be fixed by the package maintainer or it's
> a problem with krb5kdc. Thanks for reading.
It's a distro difference. Debian sets /var/lib/krb5kdc to 700 by
default. On Fedora, I set the equivalent directory
/var/kerberos/krb5kdc to 755 and then make everything in it 700.
My recommendation would be to file a bug against krb5kdc in your distro
and see if Sam, Russ, or Ben want to change this. Otherwise we may need
to work around it in freeipa.
Thanks,
--Robbie
--
Regards,
Quan Zhou
E271C0D1BD90012B8D8EECF6F822BC9F8E1C35C8
quanzhou822(a)gmail.com
https://keybase.io/qzhou