<html><head/><body><html><head></head><body>Ok. I'm fairly new to selinux but I will give it a go tomorrow. Thanks. Rgds S. <div class="gmail_quote">Rob Crittenden <rcritten@redhat.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> <pre style="white-space: pre-wrap; word-wrap:break-word; font-family: sans-serif; margin-top: 0px">Sigbjorn Lie wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">On 09/19/2012 10:48 PM, Rob Crittenden wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">Sigbjorn Lie wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;">Hi, I noticed an updated krb5-server package today advertising that it's fixing the issue with slow GSSAPI binds discussed earlier, so I installed it in my test environment, set SElinux back to enforcing in /etc/sysconfig/selinux and rebooted. The named daemon does not start now. The error below was logged in /var/log/messages: Sep 19 21:54:46 ipa01 named[3712]: GSSAPI Error: Unsp ecified GSS failure. Minor code may provide more information (KDC returned error string: PROCESS_TGS) I am able to start named after setting SElinux in permissive mode (setenforce 0). Then to verify: I stop all IPA services (ipactl stop), reenabled selinux (setenforce 1), and start the IPA services (ipactl start). A new error is logged in /var/log/messages: Sep 19 22:00:49 ipa01 named[5918]: bind to LDAP server failed: Invalid credentials Sep 19 22:00:49 ipa01 named[5918]: loading configuration: permission denied Sep 19 22:00:49 ipa01 named[5918]: exiting (due to fatal error) From the /var/log/krb5kdc.log: Sep 19 21:54:46 <a href="http://ipa01.ix.test.com">ipa01.ix.test.com</a> krb5kdc[3681](info): TGS_REQ (4 etypes {18 17 16 23}) <a href="http://192.168.210.20">192.168.210.20</a>: PROCESS_TGS: authtime 0, <unknown client> for <unknown server>, Cannot create repl ay cache file /var/tmp/krbtgt_0: File exists Sep 19 21:54:46 <a href="http://ipa01.ix.test.com">ipa01.ix.test.com</a> krb5kdc[3681](info): TGS_REQ (4 etypes {18 17 16 23}) <a href="http://192.168.210.20">192.168.210.20</a>: PROCESS_TGS: authtime 0, <unknown client> for <unknown server>, Cannot create replay cache file /var/tmp/krbtgt_0: File exists Sep 19 21:54:46 <a href="http://ipa01.ix.test.com">ipa01.ix.test.com</a> krb5kdc[3681](info): AS_REQ (4 etypes {18 17 16 23}) <a href="http://192.168.210.20">192.168.210.20</a>: NEEDED_PREAUTH: DNS/<a href="http://ipa01.ix.test.com">ipa01.ix.test.com</a>@IX.TEST.COM for krbtgt/IX.TEST.COM@IX.TEST.COM, Additional pre-authentication required Sep 19 21:54:46 <a href="http://ipa01.ix.test.com">ipa01.ix.test.com</a> krb5kdc[3681](info): AS_REQ (4 etypes {18 17 16 23}) <a href="http://192.168.210.20">192.168.210.20</a>: ISSUE: authtime 1348084486, etypes {rep=18 tkt=18 ses=18}, DNS/<a href="http://ipa01.ix.test.com">ipa01.ix.test.com</a>@IX.TEST.COM for krbtgt/IX.TEST.COM@IX.TEST.COM /var/named/data/named.run logged nothing. Any suggestions for how to troubleshoot this issue?</blockquote> Pure guess, but: restorecon /var/tmp/krbtgt_0 rob </blockquote>Sorry, that did not help. There seem to be a new error in the messages file every time I attempt a named restart though. See below for the latest: Sep 19 23:01:27 ipa01 named[12638]: default realm from krb5.conf (IX.TEST.COM) does not match tkey-gssapi-credential (DNS/<a href="http://ipa01.ix.test.com">ipa01.ix.test.com</a>) Sep 19 23:01:27 ipa01 named[12638]: configuring TKEY: failure Sep 19 23:01:27 ipa01 named[12638]: loading configuration: failure Sep 19 23:01:27 ipa01 named[12638]: exiting (due to fatal error)</blockquote> I'd continue to check /var/log/audit/audit.log for AVCs. rob </pre></blockquote></div> -- Sent from my Android phone with K-9 Mail. Please excuse my brevity.</body></html></body></html>