Dirk Streubel via FreeIPA-users wrote:
Hello Rob,
Am 14.06.19 um 22:33 schrieb Rob Crittenden:
> Dirk Streubel wrote:
>> Hello Rob,
>>
>> second try ;)
>>
>> [root@ipaserver ~]# ipa-healthcheck --source ipahealthcheck.ipa.host --debug
>> Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
> ...
>> Calling check <ipahealthcheck.ipa.host.IPAHostKeytab object at
>> 0x7facb6a2ac50>
>> Initializing principal host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
>> using keytab /etc/krb5.keytab
>> using ccache /tmp/tmp_1g2c73d/ccache
>> [{"source": "ipahealthcheck.ipa.host", "check":
"IPAHostKeytab",
>> "severity": 2, "uuid":
"964f55b3-a12f-4282-b776-912892f8001a", "when":
>> "20190614195109Z", "duration": "0.010907",
"kw": {"msg": "Failed to
>> obtain host TGT: Major (851968): Unspecified GSS failure. Minor code
>> [root@ipaserver ~]#
> Ok I'd check /var/log/krb5kdc.log on the master to see what the failure is.
>
> Also:
>
> # klist -kt /etc/krb5.keytab
here is the output:
[root@ipaserver ~]# klist -kt /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
KVNO Timestamp Principal
---- -------------------
------------------------------------------------------
2 30.05.2019 18:40:19 host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
2 30.05.2019 18:40:19 host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
2 30.05.2019 18:40:19 host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
2 30.05.2019 18:40:19 host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
2 30.05.2019 18:40:19 host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
2 30.05.2019 18:40:19 host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
> # kvno host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
[root@ipaserver ~]# kvno host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX: KVNO = 2
>
> The kvno should match between the two.
>
> You might also try manually: kinit -kt /etc/krb5.keytab
root@ipaserver ~]# kinit -kt /etc/krb5.keytab
kinit: Pre-authentication failed: Invalid argument bei Anfängliche
Anmeldedaten werden geholt.
What about the krb5 log? Can you check for SELinux AVCs just in case?
You can get more output on the client side with:
# KRB5_TRACE=/dev/stdout kinit -kt /etc/krb5.keytab
rob