Hi,
I had a problem with webui a while ago where the error was "Login
failed due to an unknown reason". The OS was Ubuntu 18.04, fresh
install. The freeipa was installed with `apt install freeipa-server`
and the version was '4.7.0~pre1+git20180411-2ubuntu2'.
Pulling the logs from /var/log/apache2/error.log clearly shows that
pkinit failed due to inability to read /var/lib/krb5kdc/kdc.crt:
```
[Fri Aug 03 16:26:50.741160 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] mod_wsgi (pid=21592):
Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'.
[Fri Aug 03 16:26:50.741202 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] Traceback (most recent
call last):
[Fri Aug 03 16:26:50.741224 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/share/ipa/wsgi.py", line 57, in application
[Fri Aug 03 16:26:50.741257 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] return
api.Backend.wsgi_dispatch(environ, start_response)
[Fri Aug 03 16:26:50.741266 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/lib/python2.7/dist-packages/ipaserver/rpcserver.py", line 265,
in __call__
[Fri Aug 03 16:26:50.741286 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] return
self.route(environ, start_response)
[Fri Aug 03 16:26:50.741292 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/lib/python2.7/dist-packages/ipaserver/rpcserver.py", line 277,
in route
[Fri Aug 03 16:26:50.741300 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] return app(environ,
start_response)
[Fri Aug 03 16:26:50.741306 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/lib/python2.7/dist-packages/ipaserver/rpcserver.py", line 935,
in __call__
[Fri Aug 03 16:26:50.741313 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705]
self.kinit(user_principal, password, ipa_ccache_name)
[Fri Aug 03 16:26:50.741319 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/lib/python2.7/dist-packages/ipaserver/rpcserver.py", line 971,
in kinit
[Fri Aug 03 16:26:50.741326 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705]
pkinit_anchors=[paths.KDC_CERT, paths.KDC_CA_BUNDLE_PEM],
[Fri Aug 03 16:26:50.741333 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/lib/python2.7/dist-packages/ipalib/install/kinit.py", line 125,
in kinit_armor
[Fri Aug 03 16:26:50.741343 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] run(args, env=env,
raiseonerr=True, capture_error=True)
[Fri Aug 03 16:26:50.741349 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] File
"/usr/lib/python2.7/dist-packages/ipapython/ipautil.py", line 572, in
run
[Fri Aug 03 16:26:50.741358 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] p.returncode,
arg_string, output_log, error_log
[Fri Aug 03 16:26:50.741390 2018] [wsgi:error] [pid 21592:tid
140689492375296] [remote 162.158.118.11:20705] CalledProcessError:
CalledProcessError(Command ['/usr/bin/kinit', '-n', '-c',
'/var/run/ipa/ccaches/armor_21592', '-X', 'X509_anchors=FILE:/
var/lib/krb5kdc/kdc.crt', '-X',
'X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem']
returned non-zero exit status 1: "kinit: Pre-authentication failed:
Cannot open file '/var/lib/krb5kdc/kdc.crt': Permission denied while
getting initial credentials\\n")
```
despite that correct permission been set on the '/var/lib/krb5kdc/kdc.crt' file.
```
$ sudo ls -la /var/lib/krb5kdc
total 20
drw------- 2 root root 4096 Aug 3 15:08 .
drwxr-xr-x 52 root root 4096 Aug 3 14:16 ..
-rw-r--r-- 1 root root 2217 Aug 3 15:50 cacert.pem
-rw-r--r-- 1 root root 1590 Aug 3 15:08 kdc.crt
-rw------- 1 root root 1704 Aug 3 15:08 kdc.key
```
It took me a few days to figure out that it was the `/var/lib/krb5kdc`
directory whom has no execution perms set, so that the contents within
cannot be accessed by the wsgi process that caused the problem, after
'sudo chmod a+x /var/lib/krb5kdc' the problem is then resolved.
I wonder if this issue can be fixed by the package maintainer or it's
a problem with krb5kdc. Thanks for reading.
--
Regards,
Quan Zhou
E271C0D1BD90012B8D8EECF6F822BC9F8E1C35C8
quanzhou822(a)gmail.com
https://keybase.io/qzhou