Hi all,
I am running Versions 4.8 of the client installations. I have one machine that installed
except it failed to configure the krb5.conf file properly and it fails saying that it
can't find the KDC for the realm
xyz.com. I can fix Kerberos by manually editing the
kfb5.conf file. Except for the rest of the machines which won't work for ldap logins,
but Kerberos works fine.
Prior to the installation, I make sure the resolv.conf file is configured properly. I
make sure that the /etc/hosts file has the proper entries for the machine I am installing
on and the server. No extraneous domain names. Also, I make sure the hostname is fully
qualified with the domain name. I turn off any potential firewalld, iptables or ip6tables
services as well.
This is the installation command:
ipa-client-install --mkhomedir -p admin -w PassWord@12345! --ntp-server=idm.xyz.com
--unattended --force-join --realm
XYZ.COM
2021-05-07T20:36:19Z DEBUG Logging to /var/log/ipaclient-install.log
2021-05-07T20:36:19Z DEBUG ipa-client-install was invoked with arguments [] and options:
{'no_dns_sshfp': False, 'force': False, 'verbose': False,
'ip_addresses': None, 'configure_firefox': False, 'realm_name':
'XYZ.COM', 'force_ntpd': False, 'on_master': False,
'no_nisdomain': False, 'ssh_trust_dns': False, 'principal':
'admin', 'keytab': None, 'no_ntp': False, 'domain_name':
None, 'request_cert': False, 'fixed_primary': False, 'no_ac':
False, 'no_sudo': False, 'ca_cert_files': None,
'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers':
['idm.xyz.com'], 'enable_dns_updates': False, 'no_sshd': False,
'no_sssd': False, 'no_krb5_offline_passwords': False, 'servers':
None, 'no_ssh': False, 'force_join': True, 'firefox_dir': None,
'unattended': True, 'quiet': False, 'nisdomain': None,
'prompt_password': False, 'host_name': None, 'permit': False,
'automount_location': None, 'preserve_sssd': False, 'mkhomedir':
True, 'log_file': None, 'uninstall': False}
2021-05-07T20:36:19Z DEBUG IPA version 4.6.8-5.el7.centos
2021-05-07T20:36:19Z DEBUG Loading Index file from
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2021-05-07T20:36:19Z DEBUG Starting external process
2021-05-07T20:36:19Z DEBUG args=/usr/sbin/selinuxenabled
2021-05-07T20:36:19Z DEBUG Process finished, return code=0
2021-05-07T20:36:19Z DEBUG stdout=
2021-05-07T20:36:19Z DEBUG stderr=
2021-05-07T20:36:19Z DEBUG Starting external process
2021-05-07T20:36:19Z DEBUG args=/bin/systemctl is-enabled chronyd.service
2021-05-07T20:36:19Z DEBUG Process finished, return code=0
2021-05-07T20:36:19Z DEBUG stdout=enabled
2021-05-07T20:36:19Z DEBUG stderr=
2021-05-07T20:36:19Z DEBUG [IPA Discovery]
2021-05-07T20:36:19Z DEBUG Starting IPA discovery with domain=None, servers=None,
hostname=client1.xyz.com
2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com"
(domain of the hostname) and its sub-domains
2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of
_ldap._tcp.xyz.com
2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389
idm.xyz.com.
2021-05-07T20:36:19Z DEBUG [Kerberos realm search]
2021-05-07T20:36:19Z DEBUG Kerberos realm forced
2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of
_kerberos._udp.xyz.com
2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 88
idm.xyz.com.
2021-05-07T20:36:19Z DEBUG [LDAP server check]
2021-05-07T20:36:19Z DEBUG Verifying that
idm.xyz.com (realm
XYZ.COM) is an IPA server
2021-05-07T20:36:19Z DEBUG Init LDAP connection to: ldap://idm.xyz.com:389
2021-05-07T20:36:19Z DEBUG Search LDAP server for IPA base DN
2021-05-07T20:36:19Z DEBUG Check if naming context 'dc=xyz,dc=com' is for IPA
2021-05-07T20:36:19Z DEBUG Naming context 'dc=xyz,dc=com' is a valid IPA context
2021-05-07T20:36:19Z DEBUG Search for (objectClass=krbRealmContainer) in dc=xyz,dc=com
(sub)
2021-05-07T20:36:19Z DEBUG Found: cn=XYZ.COM,cn=kerberos,dc=xyz,dc=com
2021-05-07T20:36:19Z DEBUG Discovery result: Success;
server=idm.xyz.com,
domain=xyz.com,
kdc=idm.xyz.com, basedn=dc=xyz,dc=com
2021-05-07T20:36:19Z DEBUG Validated servers:
idm.xyz.com
2021-05-07T20:36:19Z DEBUG will use discovered domain:
xyz.com
2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com"
(Validating DNS Discovery) and its sub-domains
2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of
_ldap._tcp.xyz.com
2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389
idm.xyz.com.
2021-05-07T20:36:19Z DEBUG DNS validated, enabling discovery
2021-05-07T20:36:19Z DEBUG will use discovered server:
idm.xyz.com
2021-05-07T20:36:19Z INFO Discovery was successful!
2021-05-07T20:36:19Z DEBUG will use discovered realm:
XYZ.COM
2021-05-07T20:36:19Z DEBUG will use discovered basedn: dc=xyz,dc=com
2021-05-07T20:36:19Z INFO Client hostname:
client1.xyz.com
2021-05-07T20:36:19Z DEBUG Hostname source: Machine's FQDN
2021-05-07T20:36:19Z INFO Realm:
XYZ.COM
2021-05-07T20:36:19Z DEBUG Realm source: Discovered from LDAP DNS records in
idm.xyz.com
2021-05-07T20:36:19Z INFO DNS Domain:
xyz.com
2021-05-07T20:36:19Z DEBUG DNS Domain source: Discovered LDAP SRV records from
xyz.com
(domain of the hostname)
2021-05-07T20:36:19Z INFO IPA Server:
idm.xyz.com
2021-05-07T20:36:19Z DEBUG IPA Server source: Discovered from LDAP DNS records in
idm.xyz.com
2021-05-07T20:36:19Z INFO BaseDN: dc=xyz,dc=com
2021-05-07T20:36:19Z DEBUG BaseDN source: From IPA server ldap://idm.xyz.com:389
2021-05-07T20:36:19Z DEBUG Loading Index file from
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2021-05-07T20:36:19Z DEBUG Loading StateFile from
'/var/lib/ipa-client/sysrestore/sysrestore.state'
2021-05-07T20:36:19Z DEBUG Starting external process
2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r
XYZ.COM
2021-05-07T20:36:19Z DEBUG Process finished, return code=5
2021-05-07T20:36:19Z DEBUG stdout=
2021-05-07T20:36:19Z DEBUG stderr=realm not found
2021-05-07T20:36:19Z INFO Skipping synchronizing time with NTP server.
2021-05-07T20:36:19Z DEBUG Starting external process
2021-05-07T20:36:19Z DEBUG args=/usr/bin/keyctl get_persistent @s 0
2021-05-07T20:36:19Z DEBUG Process finished, return code=0
2021-05-07T20:36:19Z DEBUG stdout=599779671
2021-05-07T20:36:19Z DEBUG stderr=
2021-05-07T20:36:19Z DEBUG Enabling persistent keyring CCACHE
2021-05-07T20:36:19Z DEBUG Writing Kerberos configuration to /tmp/tmpfFCY1T:
2021-05-07T20:36:19Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm =
XYZ.COM
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
XYZ.COM = {
kdc = idm.xyz.com:88
master_kdc = idm.xyz.com:88
admin_server = idm.xyz.com:749
kpasswd_server = idm.xyz.com:464
default_domain =
xyz.com
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.xyz.com =
XYZ.COM
xyz.com =
XYZ.COM
client1.xyz.com =
XYZ.COM
2021-05-07T20:36:19Z DEBUG Initializing principal admin(a)XYZ.COM using password
2021-05-07T20:36:19Z DEBUG Starting external process
2021-05-07T20:36:19Z DEBUG args=/usr/bin/kinit admin(a)XYZ.COM -c /tmp/krbccnj9ncO/ccache
2021-05-07T20:36:19Z DEBUG Process finished, return code=0
2021-05-07T20:36:19Z DEBUG stdout=Password for admin(a)XYZ.COM:
2021-05-07T20:36:19Z DEBUG stderr=
2021-05-07T20:36:19Z DEBUG trying to retrieve CA cert via LDAP from
idm.xyz.com
2021-05-07T20:36:19Z DEBUG retrieving schema for SchemaCache url=ldap://idm.xyz.com:389
conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fc3c40d7248>
2021-05-07T20:36:19Z INFO Successfully retrieved CA cert
Subject: CN=Certificate
Authority,O=XYZ.COM
Issuer: CN=Certificate
Authority,O=XYZ.COM
Valid From: 2021-05-06 19:54:28
Valid Until: 2041-05-06 19:54:28
2021-05-07T20:36:19Z DEBUG Starting external process
2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-join -s
idm.xyz.com -b dc=xyz,dc=com -h
client1.xyz.com -f
2021-05-07T20:36:20Z DEBUG Process finished, return code=0
2021-05-07T20:36:20Z DEBUG stdout=
2021-05-07T20:36:20Z DEBUG stderr=Keytab successfully retrieved and stored in:
/etc/krb5.keytab
Certificate subject base is:
O=XYZ.COM
2021-05-07T20:36:20Z INFO Enrolled in IPA realm
XYZ.COM
2021-05-07T20:36:20Z DEBUG Starting external process
2021-05-07T20:36:20Z DEBUG args=/usr/bin/kdestroy
2021-05-07T20:36:20Z DEBUG Process finished, return code=0
2021-05-07T20:36:20Z DEBUG stdout=
2021-05-07T20:36:20Z DEBUG stderr=
2021-05-07T20:36:20Z DEBUG Initializing principal host/client1.xyz.com(a)XYZ.COM using
keytab /etc/krb5.keytab
2021-05-07T20:36:20Z DEBUG using ccache /etc/ipa/.dns_ccache
2021-05-07T20:36:20Z DEBUG Attempt 1/5: success
2021-05-07T20:36:20Z DEBUG Backing up system configuration file
'/etc/ipa/default.conf'
2021-05-07T20:36:20Z DEBUG -> Not backing up - '/etc/ipa/default.conf'
doesn't exist
2021-05-07T20:36:20Z INFO Created /etc/ipa/default.conf
2021-05-07T20:36:20Z DEBUG Backing up system configuration file
'/etc/sssd/sssd.conf'
2021-05-07T20:36:20Z DEBUG Saving Index File to
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2021-05-07T20:36:20Z DEBUG Backing up system configuration file
'/etc/nsswitch.conf'
2021-05-07T20:36:20Z DEBUG Saving Index File to
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2021-05-07T20:36:20Z INFO Configured sudoers in /etc/nsswitch.conf
2021-05-07T20:36:20Z INFO Configured /etc/sssd/sssd.conf
2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/krb5.conf'
2021-05-07T20:36:20Z DEBUG Saving Index File to
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2021-05-07T20:36:20Z DEBUG Starting external process
2021-05-07T20:36:20Z DEBUG args=/usr/bin/keyctl get_persistent @s 0
2021-05-07T20:36:20Z DEBUG Process finished, return code=0
2021-05-07T20:36:20Z DEBUG stdout=599779671
2021-05-07T20:36:20Z DEBUG stderr=
2021-05-07T20:36:20Z DEBUG Enabling persistent keyring CCACHE
2021-05-07T20:36:20Z DEBUG Writing Kerberos configuration to /etc/krb5.conf:
2021-05-07T20:36:20Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm =
XYZ.COM
dns_lookup_realm = true
dns_lookup_kdc = true
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
XYZ.COM = {
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.xyz.com =
XYZ.COM
xyz.com =
XYZ.COM
client1.xyz.com =
XYZ.COM
2021-05-07T20:36:20Z INFO Configured /etc/krb5.conf for IPA realm
XYZ.COM
2021-05-07T20:36:20Z DEBUG Starting external process
2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -N -f
/tmp/tmpxItqiM/pwdfile.txt -f /tmp/tmpxItqiM/pwdfile.txt
2021-05-07T20:36:20Z DEBUG Process finished, return code=0
2021-05-07T20:36:20Z DEBUG stdout=
2021-05-07T20:36:20Z DEBUG stderr=
2021-05-07T20:36:20Z DEBUG Starting external process
2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -A -n CA
certificate 1 -t C,, -a -f /tmp/tmpxItqiM/pwdfile.txt
2021-05-07T20:36:20Z DEBUG Process finished, return code=0
2021-05-07T20:36:20Z DEBUG stdout=
2021-05-07T20:36:20Z DEBUG stderr=
2021-05-07T20:36:20Z DEBUG failed to find session_cookie in persistent storage for
principal 'host/client1.xyz.com(a)XYZ.COM'
2021-05-07T20:36:20Z INFO trying
https://idm.xyz.com/ipa/json
2021-05-07T20:36:20Z DEBUG Created connection context.rpcclient_140479019423504
2021-05-07T20:36:20Z INFO [try 1]: Forwarding 'schema' to json server
'https://idm.xyz.com/ipa/json'
2021-05-07T20:36:20Z DEBUG New HTTP connection (
idm.xyz.com)
2021-05-07T20:36:20Z DEBUG HTTP connection destroyed (
idm.xyz.com)
Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in
single_request
self.get_auth_info()
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in
get_auth_info
self._handle_exception(e, service=service)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in
_handle_exception
raise errors.KerberosError(message=unicode(e))
KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more
information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM'
2021-05-07T20:36:20Z DEBUG Destroyed connection context.rpcclient_140479019423504
2021-05-07T20:36:20Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in
run
return cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 360,
in run
return self.execute()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 386,
in execute
for rval in self._executor():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431,
in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460,
in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450,
in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421,
in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418,
in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in
run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in
run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 655,
in _configure
next(executor)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431,
in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460,
in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518,
in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450,
in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515,
in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450,
in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421,
in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418,
in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in
run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in
run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65,
in _install
for unused in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line
3670, in main
install(self)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line
2391, in install
_install(options)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line
2733, in _install
api.finalize()
File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 740, in
finalize
self.__do_if_not_done('load_plugins')
File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 431, in
__do_if_not_done
getattr(self, name)()
File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 619, in
load_plugins
for package in self.packages:
File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line 954, in
packages
ipaclient.remote_plugins.get_package(self),
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py",
line 134, in get_package
plugins = schema.get_package(server_info, client)
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
line 553, in get_package
schema = Schema(client)
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
line 401, in __init__
fingerprint, ttl = self._fetch(client, ignore_cache=read_failed)
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
line 426, in _fetch
schema = client.forward(u'schema', **kwargs)['result']
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1151, in forward
return self._call_command(command, params)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1127, in
_call_command
return command(*params)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1281, in _call
return self.__request(name, args)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1248, in
__request
verbose=self.__verbose >= 3,
File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request
return self.single_request(host, handler, request_body, verbose)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in
single_request
self.get_auth_info()
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in
get_auth_info
self._handle_exception(e, service=service)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in
_handle_exception
raise errors.KerberosError(message=unicode(e))
2021-05-07T20:36:20Z DEBUG The ipa-client-install command failed, exception:
KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more
information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM'
2021-05-07T20:36:20Z ERROR Major (851968): Unspecified GSS failure. Minor code may
provide more information, Minor (2529639068): Cannot contact any KDC for realm
'XYZ.COM'
2021-05-07T20:36:20Z ERROR The ipa-client-install command failed. See
/var/log/ipaclient-install.log for more information
So, what I found is that the krb5.conf file is partially configured. I'm not sure
what to look for in the sssd.conf file. I am assuming that since I can't login with
an ldap account and it finds the domain that something is not cofigured properly for that
either.
Any thoughts on what is going wrong? And how I can fix it or work around it? I'm
more worried about not being able to do ldap logins than the Kerberos problem since I have
a work around for that.
Thanks,
Steve