<div dir="ltr"><div><div style>So I am trying to enrull Ubuntu into FreeIPA.</div><div style><br></div><div style>But I am getting a number of issues:</div><div style>1. DNS autodiscovery isn't working.</div><div style>
2. certutils fails at the end?</div><div style><br></div><div style>In my setup I currently have 1 IPA server running DNS and all of it.</div><div style><br></div><div style>What can be wrong?</div><div style><br></div><div style>
Endre.</div><div><br></div><div>sudo ipa-client-install -d --enable-dns-updates</div><div>root : DEBUG /usr/sbin/ipa-client-install was invoked with options: {'conf_ntp': True, 'domain': None, 'uninstall': False, 'force': False, 'sssd': True, 'krb5_offline_passwords': True, 'hostname': None, 'preserve_sssd': False, 'server': None, 'prompt_password': False, 'mkhomedir': False, 'dns_updates': True, 'permit': False, 'debug': True, 'on_master': False, 'ntp_server': None, 'realm_name': None, 'unattended': None, 'principal': None}</div>
<div>root : DEBUG missing options might be asked for interactively later</div><div><br></div><div>root : DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'</div><div>
root : DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'</div><div>root : DEBUG [ipadnssearchldap(<a href="http://coretrek.net">coretrek.net</a>)]</div><div>root : DEBUG [ipadnssearchldap(net)]</div>
<div>root : DEBUG [ipadnssearchldap(<a href="http://coretrek.net">coretrek.net</a>)]</div><div>root : DEBUG [ipadnssearchldap(net)]</div><div>root : DEBUG Domain not found</div><div>DNS discovery failed to determine your DNS domain</div>
<div>Provide the domain name of your IPA server (ex: <a href="http://example.com">example.com</a>): <a href="http://coretrek.net">coretrek.net</a></div><div>root : DEBUG will use domain: <a href="http://coretrek.net">coretrek.net</a></div>
<div><br></div><div>root : DEBUG [ipadnssearchldap]</div><div>root : DEBUG IPA Server not found</div><div>DNS discovery failed to find the IPA Server</div><div>Provide your IPA server name (ex: <a href="http://ipa.example.com">ipa.example.com</a>): <a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a></div>
<div>root : DEBUG will use server: <a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a></div><div><br></div><div>root : DEBUG [ipadnssearchkrb]</div><div>root : DEBUG [ipacheckldap]</div>
<div>root : DEBUG args=/usr/bin/wget -O /tmp/tmp1RBeGA/ca.crt -T 15 -t 2 <a href="http://st-vidm001.coretrek.net/ipa/config/ca.crt">http://st-vidm001.coretrek.net/ipa/config/ca.crt</a></div><div>root : DEBUG stdout=</div>
<div>root : DEBUG stderr=--2013-05-18 18:40:05-- <a href="http://st-vidm001.coretrek.net/ipa/config/ca.crt">http://st-vidm001.coretrek.net/ipa/config/ca.crt</a></div><div>Resolving <a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a> (<a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a>)... 172.16.200.5</div>
<div>Connecting to <a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a> (<a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a>)|172.16.200.5|:80... connected.</div><div>HTTP request sent, awaiting response... 200 OK</div>
<div>Length: 1321 (1.3K) [application/x-x509-ca-cert]</div><div>Saving to: `/tmp/tmp1RBeGA/ca.crt'</div><div><br></div><div> 0K . 100% 69.1M=0s</div><div><br></div>
<div>2013-05-18 18:40:05 (69.1 MB/s) - `/tmp/tmp1RBeGA/ca.crt' saved [1321/1321]</div><div><br></div><div><br></div><div>root : DEBUG Init ldap with: ldap://<a href="http://st-vidm001.coretrek.net:389">st-vidm001.coretrek.net:389</a></div>
<div>root : DEBUG Search LDAP server for IPA base DN</div><div>root : DEBUG Check if naming context 'dc=coretrek,dc=net' is for IPA</div><div>root : DEBUG Naming context 'dc=coretrek,dc=net' is a valid IPA context</div>
<div>root : DEBUG Search for (objectClass=krbRealmContainer) in dc=coretrek,dc=net(sub)</div><div>root : DEBUG Found: [('cn=<a href="http://CORETREK.NET">CORETREK.NET</a>,cn=kerberos,dc=coretrek,dc=net', {'krbSubTrees': ['dc=coretrek,dc=net'], 'cn': ['<a href="http://CORETREK.NET">CORETREK.NET</a>'], 'krbDefaultEncSaltTypes': ['aes256-cts:special', 'aes128-cts:special', 'des3-hmac-sha1:special', 'arcfour-hmac:special'], 'objectClass': ['top', 'krbrealmcontainer', 'krbticketpolicyaux'], 'krbSearchScope': ['2'], 'krbSupportedEncSaltTypes': ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'des3-hmac-sha1:normal', 'des3-hmac-sha1:special', 'arcfour-hmac:normal', 'arcfour-hmac:special'], 'krbMaxTicketLife': ['86400'], 'krbMaxRenewableAge': ['604800']})]</div>
<div><br></div><div>The failure to use DNS to find your IPA server indicates that your</div><div>resolv.conf file is not properly configured.</div><div><br></div><div>Autodiscovery of servers for failover cannot work with this configuration.</div>
<div><br></div><div>If you proceed with the installation, services will be configured to always</div><div>access the discovered server for all operation and will not fail over to</div><div>other servers in case of failure.</div>
<div><br></div><div><div>Proceed with fixed values and no DNS discovery? [no]: yes</div><div>root : DEBUG will use cli_realm: <a href="http://CORETREK.NET">CORETREK.NET</a></div><div><br></div><div>root : DEBUG will use cli_basedn: dc=coretrek,dc=net</div>
<div><br></div><div>Hostname: <a href="http://st-posctrl001.coretrek.net">st-posctrl001.coretrek.net</a></div><div>Realm: <a href="http://CORETREK.NET">CORETREK.NET</a></div><div>DNS Domain: <a href="http://coretrek.net">coretrek.net</a></div>
<div>IPA Server: <a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a></div><div>BaseDN: dc=coretrek,dc=net</div><div><br></div><div><br></div><div>Continue to configure the system with these values? [no]: yes</div>
<div>User authorized to enroll computers: admin</div><div>root : DEBUG will use principal: admin</div><div><br></div><div>root : DEBUG args=/usr/bin/wget -O /etc/ipa/ca.crt <a href="http://st-vidm001.coretrek.net/ipa/config/ca.crt">http://st-vidm001.coretrek.net/ipa/config/ca.crt</a></div>
<div>root : DEBUG stdout=</div><div>root : DEBUG stderr=--2013-05-18 18:40:28-- <a href="http://st-vidm001.coretrek.net/ipa/config/ca.crt">http://st-vidm001.coretrek.net/ipa/config/ca.crt</a></div><div>
Resolving <a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a> (<a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a>)... 172.16.200.5</div><div>Connecting to <a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a> (<a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a>)|172.16.200.5|:80... connected.</div>
<div>HTTP request sent, awaiting response... 200 OK</div><div>Length: 1321 (1.3K) [application/x-x509-ca-cert]</div><div>Saving to: `/etc/ipa/ca.crt'</div><div><br></div><div> 0K . 100% 66.7M=0s</div>
<div><br></div><div>2013-05-18 18:40:28 (66.7 MB/s) - `/etc/ipa/ca.crt' saved [1321/1321]</div><div><br></div><div><br></div><div>Synchronizing time with KDC...</div><div>root : DEBUG args=/usr/sbin/ntpdate -U ntp -s -b <a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a></div>
<div>root : DEBUG stdout=</div><div>root : DEBUG stderr=/usr/sbin/ntpdate: unknown option -U</div><div>usage: /usr/sbin/ntpdate [-46bBdqsuv] [-a key#] [-e delay] [-k file] [-p samples] [-o version#] [-t timeo] server ...</div>
<div><br></div><div>root : DEBUG args=/usr/sbin/ntpdate -U ntp -s -b <a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a></div><div>root : DEBUG stdout=</div><div>root : DEBUG stderr=/usr/sbin/ntpdate: unknown option -U</div>
<div>usage: /usr/sbin/ntpdate [-46bBdqsuv] [-a key#] [-e delay] [-k file] [-p samples] [-o version#] [-t timeo] server ...</div><div><br></div><div>root : DEBUG args=/usr/sbin/ntpdate -U ntp -s -b <a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a></div>
<div>root : DEBUG stdout=</div><div>root : DEBUG stderr=/usr/sbin/ntpdate: unknown option -U</div><div>usage: /usr/sbin/ntpdate [-46bBdqsuv] [-a key#] [-e delay] [-k file] [-p samples] [-o version#] [-t timeo] server ...</div>
<div><br></div><div>Unable to sync time with IPA NTP server, assuming the time is in sync.</div><div>root : DEBUG Writing Kerberos configuration to /tmp/tmpdGLoJb:</div><div>#File modified by ipa-client-install</div>
</div></div><div><br></div><div><div>[libdefaults]</div><div> default_realm = <a href="http://CORETREK.NET">CORETREK.NET</a></div><div> dns_lookup_realm = false</div><div> dns_lookup_kdc = false</div><div> rdns = false</div>
<div> ticket_lifetime = 24h</div><div> forwardable = yes</div><div><br></div><div>[realms]</div><div> <a href="http://CORETREK.NET">CORETREK.NET</a> = {</div><div> kdc = <a href="http://st-vidm001.coretrek.net:88">st-vidm001.coretrek.net:88</a></div>
<div> admin_server = <a href="http://st-vidm001.coretrek.net:749">st-vidm001.coretrek.net:749</a></div><div> default_domain = <a href="http://coretrek.net">coretrek.net</a></div><div> pkinit_anchors = FILE:/etc/ipa/ca.crt</div>
<div> }</div><div><br></div><div>[domain_realm]</div><div> .<a href="http://coretrek.net">coretrek.net</a> = <a href="http://CORETREK.NET">CORETREK.NET</a></div><div> <a href="http://coretrek.net">coretrek.net</a> = <a href="http://CORETREK.NET">CORETREK.NET</a></div>
<div><br></div><div><br></div><div>Password for <a href="mailto:admin@CORETREK.NET">admin@CORETREK.NET</a>:</div></div><div><br></div><div><div>root : DEBUG args=kinit <a href="mailto:admin@CORETREK.NET">admin@CORETREK.NET</a></div>
<div>root : DEBUG stdout=Password for <a href="mailto:admin@CORETREK.NET">admin@CORETREK.NET</a>:</div><div><br></div><div>root : DEBUG stderr=</div><div><br></div><div>root : DEBUG args=/usr/sbin/ipa-join -s <a href="http://st-vidm001.coretrek.net">st-vidm001.coretrek.net</a> -b dc=coretrek,dc=net -d</div>
<div>root : DEBUG stdout=</div><div>root : DEBUG stderr=XML-RPC CALL:</div><div><br></div><div><?xml version="1.0" encoding="UTF-8"?>\r\n</div><div><methodCall>\r\n</div>
<div><methodName>join</methodName>\r\n</div><div><params>\r\n</div><div><param><value><array><data>\r\n</div><div><value><string><a href="http://st-posctrl001.coretrek.net">st-posctrl001.coretrek.net</a></string></value>\r\n</div>
<div></data></array></value></param>\r\n</div><div><param><value><struct>\r\n</div><div><member><name>nsosversion</name>\r\n</div><div><value><string>3.2.0-43-generic</string></value></member>\r\n</div>
<div><member><name>nshardwareplatform</name>\r\n</div><div><value><string>x86_64</string></value></member>\r\n</div><div></struct></value></param>\r\n</div>
<div></params>\r\n</div><div></methodCall>\r\n</div><div><br></div><div>XML-RPC RESPONSE:</div><div><br></div><div><?xml version='1.0' encoding='UTF-8'?>\n</div><div><methodResponse>\n</div>
<div><params>\n</div><div><param>\n</div><div><value><array><data>\n</div><div><value><string>fqdn=<a href="http://st-posctrl001.coretrek.net">st-posctrl001.coretrek.net</a>,cn=computers,cn=accounts,dc=coretrek,dc=net</string></value>\n</div>
<div><value><struct>\n</div><div><member>\n</div><div><name>dn</name>\n</div><div><value><string>fqdn=<a href="http://st-posctrl001.coretrek.net">st-posctrl001.coretrek.net</a>,cn=computers,cn=accounts,dc=coretrek,dc=net</string></value>\n</div>
<div></member>\n</div><div><member>\n</div><div><name>ipacertificatesubjectbase</name>\n</div><div><value><array><data>\n</div><div><value><string>O=<a href="http://CORETREK.NET">CORETREK.NET</a></string></value>\n</div>
<div></data></array></value>\n</div><div></member>\n</div><div><member>\n</div><div><name>krbextradata</name>\n</div><div><value><array><data>\n</div><div><value><base64>\n</div>
<div>AAKuqZdRaG9zdC9zdC1wb3NjdHJsMDAxLmNvcmV0cmVrLm5ldEBDT1JFVFJFSy5ORVQA\n</div><div></base64></value>\n</div><div></data></array></value>\n</div><div></member>\n</div><div><member>\n</div>
<div><name>cn</name>\n</div><div><value><array><data>\n</div><div><value><string><a href="http://st-posctrl001.coretrek.net">st-posctrl001.coretrek.net</a></string></value>\n</div>
<div></data></array></value>\n</div><div></member>\n</div><div><member>\n</div><div><name>objectclass</name>\n</div><div><value><array><data>\n</div><div><value><string>ipaobject</string></value>\n</div>
<div><value><string>nshost</string></value>\n</div><div><value><string>ipahost</string></value>\n</div><div><value><string>pkiuser</string></value>\n</div>
<div><value><string>ipaservice</string></value>\n</div><div><value><string>krbprincipalaux</string></value>\n</div><div><value><string>krbprincipal</string></value>\n</div>
<div><value><string>ieee802device</string></value>\n</div><div><value><string>ipasshhost</string></value>\n</div><div><value><string>top</string></value>\n</div>
<div><value><string>ipaSshGroupOfPubKeys</string></value>\n</div><div></data></array></value>\n</div><div></member>\n</div><div><member>\n</div><div><name>fqdn</name>\n</div>
<div><value><array><data>\n</div><div><value><string><a href="http://st-posctrl001.coretrek.net">st-posctrl001.coretrek.net</a></string></value>\n</div><div></data></array></value>\n</div>
</div><div><div></member>\n</div><div><member>\n</div><div><name>managing_host</name>\n</div><div><value><array><data>\n</div><div><value><string><a href="http://st-posctrl001.coretrek.net">st-posctrl001.coretrek.net</a></string></value>\n</div>
<div></data></array></value>\n</div><div></member>\n</div><div><member>\n</div><div><name>krblastsuccessfulauth</name>\n</div><div><value><array><data>\n</div><div>
<value><string>20130518162120Z</string></value>\n</div><div></data></array></value>\n</div><div></member>\n</div><div><member>\n</div><div><name>has_keytab</name>\n</div>
<div><value><boolean>0</boolean></value>\n</div><div></member>\n</div><div><member>\n</div><div><name>has_password</name>\n</div><div><value><boolean>0</boolean></value>\n</div>
<div></member>\n</div><div><member>\n</div><div><name>ipauniqueid</name>\n</div><div><value><array><data>\n</div><div><value><string>88f1ad52-bfd2-11e2-81f5-525400d79980</string></value>\n</div>
<div></data></array></value>\n</div><div></member>\n</div><div><member>\n</div><div><name>krbprincipalname</name>\n</div><div><value><array><data>\n</div><div><value><string>host/<a href="mailto:st-posctrl001.coretrek.net@CORETREK.NET">st-posctrl001.coretrek.net@CORETREK.NET</a></string></value>\n</div>
<div></data></array></value>\n</div><div></member>\n</div><div><member>\n</div><div><name>managedby_host</name>\n</div><div><value><array><data>\n</div><div><value><string><a href="http://st-posctrl001.coretrek.net">st-posctrl001.coretrek.net</a></string></value>\n</div>
<div></data></array></value>\n</div><div></member>\n</div><div><member>\n</div><div><name>serverhostname</name>\n</div><div><value><array><data>\n</div><div><value><string>st-posctrl001</string></value>\n</div>
<div></data></array></value>\n</div><div></member>\n</div><div><member>\n</div><div><name>enrolledby_user</name>\n</div><div><value><array><data>\n</div><div><value><string>admin</string></value>\n</div>
<div></data></array></value>\n</div><div></member>\n</div><div></struct></value>\n</div><div></data></array></value>\n</div><div></param>\n</div><div></params>\n</div>
<div></methodResponse>\n</div><div><br></div><div>Keytab successfully retrieved and stored in: /etc/krb5.keytab</div><div>Certificate subject base is: O=<a href="http://CORETREK.NET">CORETREK.NET</a></div></div><div>
<div>Enrolled in IPA realm <a href="http://CORETREK.NET">CORETREK.NET</a></div><div>root : DEBUG args=kdestroy</div><div>root : DEBUG stdout=</div><div>root : DEBUG stderr=</div><div>root : DEBUG Backing up system configuration file '/etc/ipa/default.conf'</div>
<div>root : DEBUG -> Not backing up - '/etc/ipa/default.conf' doesn't exist</div><div>Created /etc/ipa/default.conf</div><div>root : DEBUG Backing up system configuration file '/etc/sssd/sssd.conf'</div>
<div>root : DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index'</div><div>Domain <a href="http://coretrek.net">coretrek.net</a> is already configured in existing SSSD config, creating a new one.</div>
<div>The old /etc/sssd/sssd.conf is backed up and will be restored during uninstall.</div><div>root : DEBUG Domain <a href="http://coretrek.net">coretrek.net</a> is already configured in existing SSSD config, creating a new one.</div>
<div>Configured /etc/sssd/sssd.conf</div><div>root : DEBUG args=/usr/bin/certutil -A -d /etc/pki/nssdb -n IPA CA -t CT,C,C -a -i /etc/ipa/ca.crt</div><div>root : DEBUG stdout=</div><div>root : DEBUG stderr=certutil: function failed: The certificate/key database is in an old, unsupported format.</div>
<div><br></div><div>Traceback (most recent call last):</div><div> File "/usr/sbin/ipa-client-install", line 1292, in <module></div><div> sys.exit(main())</div><div> File "/usr/sbin/ipa-client-install", line 1279, in main</div>
<div> rval = install(options, env, fstore, statestore)</div><div> File "/usr/sbin/ipa-client-install", line 1124, in install</div><div> run(["/usr/bin/certutil", "-A", "-d", "/etc/pki/nssdb", "-n", "IPA CA", "-t", "CT,C,C", "-a", "-i", "/etc/ipa/ca.crt"])</div>
<div> File "/usr/lib/python2.7/dist-packages/ipapython/ipautil.py", line 273, in run</div><div> raise CalledProcessError(p.returncode, args)</div><div>subprocess.CalledProcessError: Command '/usr/bin/certutil -A -d /etc/pki/nssdb -n IPA CA -t CT,C,C -a -i /etc/ipa/ca.crt' returned non-zero exit status 255</div>
</div><div><br></div></div>