Rob Crittenden via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
writes:
Dirk Streubel via FreeIPA-users wrote:
> Hello Rob,
>
> Am 14.06.19 um 22:33 schrieb Rob Crittenden:
>> Dirk Streubel wrote:
>>> Hello Rob,
>>>
>>> second try ;)
>>>
>>> [root@ipaserver ~]# ipa-healthcheck --source ipahealthcheck.ipa.host --debug
>>> Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
>> ...
>>> Calling check <ipahealthcheck.ipa.host.IPAHostKeytab object at
>>> 0x7facb6a2ac50>
>>> Initializing principal host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
>>> using keytab /etc/krb5.keytab
>>> using ccache /tmp/tmp_1g2c73d/ccache
>>> [{"source": "ipahealthcheck.ipa.host", "check":
"IPAHostKeytab",
>>> "severity": 2, "uuid":
"964f55b3-a12f-4282-b776-912892f8001a", "when":
>>> "20190614195109Z", "duration": "0.010907",
"kw": {"msg": "Failed to
>>> obtain host TGT: Major (851968): Unspecified GSS failure. Minor code
>>> [root@ipaserver ~]#
>> Ok I'd check /var/log/krb5kdc.log on the master to see what the failure is.
>>
>> Also:
>>
>> # klist -kt /etc/krb5.keytab
>
> here is the output:
>
> [root@ipaserver ~]# klist -kt /etc/krb5.keytab
> Keytab name: FILE:/etc/krb5.keytab
> KVNO Timestamp Principal
> ---- -------------------
> ------------------------------------------------------
> 2 30.05.2019 18:40:19 host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
> 2 30.05.2019 18:40:19 host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
> 2 30.05.2019 18:40:19 host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
> 2 30.05.2019 18:40:19 host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
> 2 30.05.2019 18:40:19 host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
> 2 30.05.2019 18:40:19 host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
>
>> # kvno host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
>
> [root@ipaserver ~]# kvno host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX
> host/ipaserver.linux.fritz.box(a)LINUX.FRITZ.BOX: KVNO = 2
>
>>
>> The kvno should match between the two.
>>
>> You might also try manually: kinit -kt /etc/krb5.keytab
>
> root@ipaserver ~]# kinit -kt /etc/krb5.keytab
> kinit: Pre-authentication failed: Invalid argument bei Anfängliche
> Anmeldedaten werden geholt.
What about the krb5 log? Can you check for SELinux AVCs just in case?
You can get more output on the client side with:
# KRB5_TRACE=/dev/stdout kinit -kt /etc/krb5.keytab
(And while I'm really excited to see the German localization getting
used this soon after merging, it would be helpful to me if you could set
LC_ALL=C as well.)
Thanks,
--Robbie