So i'm trying to add FreeRADIUS as a service to my IPA setup. I"ve added the service using --force and i'm trying to get the keytab for it but getting the following error: [root@asm-rancid02 keytabs]# ipa-getkeytab -s asm-rancid02.mgt.asm.borg.local. -p radius/asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytabUnable to initialize STARTTLS sessionFailed to bind to server!Retrying with pre-4.0 keytab retrieval method...Unable to initialize STARTTLS sessionFailed to bind to server!Failed to get keytab[root@asm-rancid02 keytabs]#
Do I need to generate a keytab first? Should this be generated when I add the server to the domain/realm?
Andrew Meyer via FreeIPA-users freeipa-users@lists.fedorahosted.org writes:
[root@asm-rancid02 keytabs]# ipa-getkeytab -s asm-rancid02.mgt.asm.borg.local. -p radius/asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [root@asm-rancid02 keytabs]#
Do I need to generate a keytab first? Should this be generated when I add the server to the domain/realm?
This looks like it wasn't able to connect properly, so it hasn't reached the point where Kerberos is involved.
Keytabs are generated when the machine is enrolled in the realm.
Thanks, --Robbie
Robbie Harwood via FreeIPA-users wrote:
Andrew Meyer via FreeIPA-users freeipa-users@lists.fedorahosted.org writes:
[root@asm-rancid02 keytabs]# ipa-getkeytab -s asm-rancid02.mgt.asm.borg.local. -p radius/asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [root@asm-rancid02 keytabs]#
Do I need to generate a keytab first? Should this be generated when I add the server to the domain/realm?
This looks like it wasn't able to connect properly, so it hasn't reached the point where Kerberos is involved.
Keytabs are generated when the machine is enrolled in the realm.
The host keytab is generated by ipa-clinet-install. Service keytabs need to be retrieved separately using ipa-getkeytab.
It's strange that the starttls is failing. The 389-ds access log may have some information on the connection failure.
To exercise it you can do something like:
$ ldapsearch -LL -x -ZZ -H ldap://`hostname` -b '' -s base vendorName
rob
[andrew.meyer@asm-rancid02 ~]$ ldapsearch -LL -x -ZZ -H ldap://asm-dns01.meyer.local -b '' -s base vendorNameversion: 1 dn:vendorName: 389 Project [andrew.meyer@asm-rancid02 ~]$ [andrew.meyer@asm-rancid02 ~]$ ipa-getkeytab -p 'radiusd/asm-rancid02.mgt.asm.borg.local' -s asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytabUnable to initialize STARTTLS sessionFailed to bind to server!Retrying with pre-4.0 keytab retrieval method...Unable to initialize STARTTLS sessionFailed to bind to server!Failed to get keytab[andrew.meyer@asm-rancid02 ~]$
On Monday, November 20, 2017 4:42 PM, Rob Crittenden rcritten@redhat.com wrote:
Robbie Harwood via FreeIPA-users wrote:
Andrew Meyer via FreeIPA-users freeipa-users@lists.fedorahosted.org writes:
[root@asm-rancid02 keytabs]# ipa-getkeytab -s asm-rancid02.mgt.asm.borg.local. -p radius/asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [root@asm-rancid02 keytabs]#
Do I need to generate a keytab first? Should this be generated when I add the server to the domain/realm?
This looks like it wasn't able to connect properly, so it hasn't reached the point where Kerberos is involved.
Keytabs are generated when the machine is enrolled in the realm.
The host keytab is generated by ipa-clinet-install. Service keytabs need to be retrieved separately using ipa-getkeytab.
It's strange that the starttls is failing. The 389-ds access log may have some information on the connection failure.
To exercise it you can do something like:
$ ldapsearch -LL -x -ZZ -H ldap://`hostname` -b '' -s base vendorName
rob
Do I need to do any of this: ipa permission-add 'ipaNTHash service read' --attrs=ipaNTHash --type=user --right=readipa privilege-add 'Radius services' --desc='Privileges needed to allow radiusd servers to operate'ipa privilege-add-permission 'Radius services' --permissions='ipaNTHash service read'ipa role-add 'Radius server' --desc="Radius server role"ipa role-add-privilege --privileges="Radius services" 'Radius server'
On Monday, November 20, 2017 4:54 PM, Andrew Meyer andrewm659@yahoo.com wrote:
[andrew.meyer@asm-rancid02 ~]$ ldapsearch -LL -x -ZZ -H ldap://asm-dns01.meyer.local -b '' -s base vendorNameversion: 1 dn:vendorName: 389 Project [andrew.meyer@asm-rancid02 ~]$ [andrew.meyer@asm-rancid02 ~]$ ipa-getkeytab -p 'radiusd/asm-rancid02.mgt.asm.borg.local' -s asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytabUnable to initialize STARTTLS sessionFailed to bind to server!Retrying with pre-4.0 keytab retrieval method...Unable to initialize STARTTLS sessionFailed to bind to server!Failed to get keytab[andrew.meyer@asm-rancid02 ~]$
On Monday, November 20, 2017 4:42 PM, Rob Crittenden rcritten@redhat.com wrote:
Robbie Harwood via FreeIPA-users wrote:
Andrew Meyer via FreeIPA-users freeipa-users@lists.fedorahosted.org writes:
[root@asm-rancid02 keytabs]# ipa-getkeytab -s asm-rancid02.mgt.asm.borg.local. -p radius/asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [root@asm-rancid02 keytabs]#
Do I need to generate a keytab first? Should this be generated when I add the server to the domain/realm?
This looks like it wasn't able to connect properly, so it hasn't reached the point where Kerberos is involved.
Keytabs are generated when the machine is enrolled in the realm.
The host keytab is generated by ipa-clinet-install. Service keytabs need to be retrieved separately using ipa-getkeytab.
It's strange that the starttls is failing. The 389-ds access log may have some information on the connection failure.
To exercise it you can do something like:
$ ldapsearch -LL -x -ZZ -H ldap://`hostname` -b '' -s base vendorName
rob
Andrew Meyer wrote:
[andrew.meyer@asm-rancid02 ~]$ ldapsearch -LL -x -ZZ -H ldap://asm-dns01.meyer.local -b '' -s base vendorName version: 1
dn: vendorName: 389 Project
[andrew.meyer@asm-rancid02 ~]$
[andrew.meyer@asm-rancid02 ~]$ ipa-getkeytab -p 'radiusd/asm-rancid02.mgt.asm.borg.local' -s asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [andrew.meyer@asm-rancid02 ~]$
What host is your IPA server? You used asm-dns01.meyer.local for the LDAP test and asm-rancid02.mgt.asm.borg.local for ipa-getkeytab.
rob
On Monday, November 20, 2017 4:42 PM, Rob Crittenden rcritten@redhat.com wrote:
Robbie Harwood via FreeIPA-users wrote:
Andrew Meyer via FreeIPA-users <freeipa-users@lists.fedorahosted.org
mailto:freeipa-users@lists.fedorahosted.org>
writes:
[root@asm-rancid02 mailto:root@asm-rancid02 keytabs]# ipa-getkeytab
-s asm-rancid02.mgt.asm.borg.local. -p radius/asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab
Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [root@asm-rancid02 mailto:root@asm-rancid02 keytabs]#
Do I need to generate a keytab first? Should this be generated when I add the server to the domain/realm?
This looks like it wasn't able to connect properly, so it hasn't reached the point where Kerberos is involved.
Keytabs are generated when the machine is enrolled in the realm.
The host keytab is generated by ipa-clinet-install. Service keytabs need to be retrieved separately using ipa-getkeytab.
It's strange that the starttls is failing. The 389-ds access log may have some information on the connection failure.
To exercise it you can do something like:
$ ldapsearch -LL -x -ZZ -H ldap://`hostname` -b '' -s base vendorName
rob
my host is asm-dns01.meyer.local
On Monday, November 20, 2017 4:57 PM, Rob Crittenden rcritten@redhat.com wrote:
Andrew Meyer wrote:
[andrew.meyer@asm-rancid02 ~]$ ldapsearch -LL -x -ZZ -H ldap://asm-dns01.meyer.local -b '' -s base vendorName version: 1
dn: vendorName: 389 Project
[andrew.meyer@asm-rancid02 ~]$
[andrew.meyer@asm-rancid02 ~]$ ipa-getkeytab -p 'radiusd/asm-rancid02.mgt.asm.borg.local' -s asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [andrew.meyer@asm-rancid02 ~]$
What host is your IPA server? You used asm-dns01.meyer.local for the LDAP test and asm-rancid02.mgt.asm.borg.local for ipa-getkeytab.
rob
On Monday, November 20, 2017 4:42 PM, Rob Crittenden rcritten@redhat.com wrote:
Robbie Harwood via FreeIPA-users wrote:
Andrew Meyer via FreeIPA-users <freeipa-users@lists.fedorahosted.org
mailto:freeipa-users@lists.fedorahosted.org>
writes:
[root@asm-rancid02 mailto:root@asm-rancid02 keytabs]# ipa-getkeytab
-s asm-rancid02.mgt.asm.borg.local. -p radius/asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab
Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [root@asm-rancid02 mailto:root@asm-rancid02 keytabs]#
Do I need to generate a keytab first? Should this be generated when I add the server to the domain/realm?
This looks like it wasn't able to connect properly, so it hasn't reached the point where Kerberos is involved.
Keytabs are generated when the machine is enrolled in the realm.
The host keytab is generated by ipa-clinet-install. Service keytabs need to be retrieved separately using ipa-getkeytab.
It's strange that the starttls is failing. The 389-ds access log may have some information on the connection failure.
To exercise it you can do something like:
$ ldapsearch -LL -x -ZZ -H ldap://`hostname` -b '' -s base vendorName
rob
Andrew Meyer wrote:
my host is asm-dns01.meyer.local
That didn't answer the question. The question was which host is an IPA master?
The -s argument of ipa-getkeytab should be an IPA master. Near as I can tell you used the host you want to generate the keytab for and not an IPA master.
rob
On Monday, November 20, 2017 4:57 PM, Rob Crittenden rcritten@redhat.com wrote:
Andrew Meyer wrote:
[andrew.meyer@asm-rancid02 mailto:andrew.meyer@asm-rancid02 ~]$
ldapsearch -LL -x -ZZ -H
ldap://asm-dns01.meyer.local -b '' -s base vendorName version: 1
dn: vendorName: 389 Project
[andrew.meyer@asm-rancid02 mailto:andrew.meyer@asm-rancid02 ~]$
[andrew.meyer@asm-rancid02 mailto:andrew.meyer@asm-rancid02 ~]$
ipa-getkeytab -p
'radiusd/asm-rancid02.mgt.asm.borg.local' -s asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [andrew.meyer@asm-rancid02 mailto:andrew.meyer@asm-rancid02 ~]$
What host is your IPA server? You used asm-dns01.meyer.local for the LDAP test and asm-rancid02.mgt.asm.borg.local for ipa-getkeytab.
rob
On Monday, November 20, 2017 4:42 PM, Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:
Robbie Harwood via FreeIPA-users wrote:
Andrew Meyer via FreeIPA-users <freeipa-users@lists.fedorahosted.org
mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org
mailto:freeipa-users@lists.fedorahosted.org>>
writes:
[root@asm-rancid02 mailto:root@asm-rancid02
<mailto:root@asm-rancid02 mailto:root@asm-rancid02> keytabs]# ipa-getkeytab
-s asm-rancid02.mgt.asm.borg.local. -p radius/asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab
Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [root@asm-rancid02 mailto:root@asm-rancid02
<mailto:root@asm-rancid02 mailto:root@asm-rancid02> keytabs]#
Do I need to generate a keytab first? Should this be generated when I add the server to the domain/realm?
This looks like it wasn't able to connect properly, so it hasn't reached the point where Kerberos is involved.
Keytabs are generated when the machine is enrolled in the realm.
The host keytab is generated by ipa-clinet-install. Service keytabs need to be retrieved separately using ipa-getkeytab.
It's strange that the starttls is failing. The 389-ds access log may have some information on the connection failure.
To exercise it you can do something like:
$ ldapsearch -LL -x -ZZ -H ldap://`hostname` -b '' -s base vendorName
rob
My apologies. asm-dns01.meyer.local is my FreeIPA master.
On Monday, November 20, 2017 5:46 PM, Rob Crittenden via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Andrew Meyer wrote:
my host is asm-dns01.meyer.local
That didn't answer the question. The question was which host is an IPA master?
The -s argument of ipa-getkeytab should be an IPA master. Near as I can tell you used the host you want to generate the keytab for and not an IPA master.
rob
On Monday, November 20, 2017 4:57 PM, Rob Crittenden rcritten@redhat.com wrote:
Andrew Meyer wrote:
[andrew.meyer@asm-rancid02 mailto:andrew.meyer@asm-rancid02 ~]$
ldapsearch -LL -x -ZZ -H
ldap://asm-dns01.meyer.local -b '' -s base vendorName version: 1
dn: vendorName: 389 Project
[andrew.meyer@asm-rancid02 mailto:andrew.meyer@asm-rancid02 ~]$
[andrew.meyer@asm-rancid02 mailto:andrew.meyer@asm-rancid02 ~]$
ipa-getkeytab -p
'radiusd/asm-rancid02.mgt.asm.borg.local' -s asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [andrew.meyer@asm-rancid02 mailto:andrew.meyer@asm-rancid02 ~]$
What host is your IPA server? You used asm-dns01.meyer.local for the LDAP test and asm-rancid02.mgt.asm.borg.local for ipa-getkeytab.
rob
On Monday, November 20, 2017 4:42 PM, Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:
Robbie Harwood via FreeIPA-users wrote:
Andrew Meyer via FreeIPA-users <freeipa-users@lists.fedorahosted.org
mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org
mailto:freeipa-users@lists.fedorahosted.org>>
writes:
[root@asm-rancid02 mailto:root@asm-rancid02
<mailto:root@asm-rancid02 mailto:root@asm-rancid02> keytabs]# ipa-getkeytab
-s asm-rancid02.mgt.asm.borg.local. -p radius/asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab
Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [root@asm-rancid02 mailto:root@asm-rancid02
<mailto:root@asm-rancid02 mailto:root@asm-rancid02> keytabs]#
Do I need to generate a keytab first? Should this be generated when I add the server to the domain/realm?
This looks like it wasn't able to connect properly, so it hasn't reached the point where Kerberos is involved.
Keytabs are generated when the machine is enrolled in the realm.
The host keytab is generated by ipa-clinet-install. Service keytabs need to be retrieved separately using ipa-getkeytab.
It's strange that the starttls is failing. The 389-ds access log may have some information on the connection failure.
To exercise it you can do something like:
$ ldapsearch -LL -x -ZZ -H ldap://`hostname` -b '' -s base vendorName
rob
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
I think I figured it out. When I issue the command to get the keytab I'm exporting and I was trying to overwrite the /etc/krb5.keytab file. I was not running this as root rather as a regular user. Should I overwrite the default krb5.keytab file? I'm working on documenting all of my steps. Thank you,
On Monday, November 20, 2017 5:54 PM, Andrew Meyer via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
My apologies. asm-dns01.meyer.local is my FreeIPA master.
On Monday, November 20, 2017 5:46 PM, Rob Crittenden via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Andrew Meyer wrote:
my host is asm-dns01.meyer.local
That didn't answer the question. The question was which host is an IPA master?
The -s argument of ipa-getkeytab should be an IPA master. Near as I can tell you used the host you want to generate the keytab for and not an IPA master.
rob
On Monday, November 20, 2017 4:57 PM, Rob Crittenden rcritten@redhat.com wrote:
Andrew Meyer wrote:
[andrew.meyer@asm-rancid02 mailto:andrew.meyer@asm-rancid02 ~]$
ldapsearch -LL -x -ZZ -H
ldap://asm-dns01.meyer.local -b '' -s base vendorName version: 1
dn: vendorName: 389 Project
[andrew.meyer@asm-rancid02 mailto:andrew.meyer@asm-rancid02 ~]$
[andrew.meyer@asm-rancid02 mailto:andrew.meyer@asm-rancid02 ~]$
ipa-getkeytab -p
'radiusd/asm-rancid02.mgt.asm.borg.local' -s asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [andrew.meyer@asm-rancid02 mailto:andrew.meyer@asm-rancid02 ~]$
What host is your IPA server? You used asm-dns01.meyer.local for the LDAP test and asm-rancid02.mgt.asm.borg.local for ipa-getkeytab.
rob
On Monday, November 20, 2017 4:42 PM, Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:
Robbie Harwood via FreeIPA-users wrote:
Andrew Meyer via FreeIPA-users <freeipa-users@lists.fedorahosted.org
mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org
mailto:freeipa-users@lists.fedorahosted.org>>
writes:
[root@asm-rancid02 mailto:root@asm-rancid02
<mailto:root@asm-rancid02 mailto:root@asm-rancid02> keytabs]# ipa-getkeytab
-s asm-rancid02.mgt.asm.borg.local. -p radius/asm-rancid02.mgt.asm.borg.local -k /etc/krb5.keytab
Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab [root@asm-rancid02 mailto:root@asm-rancid02
<mailto:root@asm-rancid02 mailto:root@asm-rancid02> keytabs]#
Do I need to generate a keytab first? Should this be generated when I add the server to the domain/realm?
This looks like it wasn't able to connect properly, so it hasn't reached the point where Kerberos is involved.
Keytabs are generated when the machine is enrolled in the realm.
The host keytab is generated by ipa-clinet-install. Service keytabs need to be retrieved separately using ipa-getkeytab.
It's strange that the starttls is failing. The 389-ds access log may have some information on the connection failure.
To exercise it you can do something like:
$ ldapsearch -LL -x -ZZ -H ldap://`hostname` -b '' -s base vendorName
rob
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
freeipa-users@lists.fedorahosted.org
-
Andrew Meyer -
Rob Crittenden -
Robbie Harwood