<div dir="ltr">I just restored the machine from a pre-install snapshot and tried again. For some reason we don't fail on the krb config but the installer reports db write errors when adding records:<div><br></div><div>
<div>Done configuring directory server (dirsrv).</div><div>Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds</div><div> [1/10]: adding sasl mappings to the directory</div><div> [2/10]: adding kerberos container to the directory</div>
<div> [3/10]: configuring KDC</div><div> [4/10]: initialize kerberos container</div><div> [5/10]: adding default ACIs</div><div> [6/10]: creating a keytab for the directory</div><div> [7/10]: creating a keytab for the machine</div>
<div> [8/10]: adding the password extension to the directory</div><div> [9/10]: starting the KDC</div><div> [10/10]: configuring KDC to start on boot</div><div>Done configuring Kerberos KDC (krb5kdc).</div><div>Configuring kadmin</div>
<div> [1/2]: starting kadmin </div><div> [2/2]: configuring kadmin to start on boot</div><div>Done configuring kadmin.</div><div>Configuring ipa_memcached</div><div> [1/2]: starting ipa_memcached </div><div> [2/2]: configuring ipa_memcached to start on boot</div>
<div>Done configuring ipa_memcached.</div><div>Configuring the web interface (httpd): Estimated time 1 minute</div><div> [1/13]: setting mod_nss port to 443</div><div> [2/13]: setting mod_nss password file</div><div> [3/13]: enabling mod_nss renegotiate</div>
<div> [4/13]: adding URL rewriting rules</div><div> [5/13]: configuring httpd</div><div> [6/13]: setting up ssl</div><div> [7/13]: setting up browser autoconfig</div><div> [8/13]: publish CA cert</div><div> [9/13]: creating a keytab for httpd</div>
<div> [10/13]: clean up any existing httpd ccache</div><div> [11/13]: configuring SELinux for httpd</div><div> [12/13]: restarting httpd</div><div> [13/13]: configuring httpd to start on boot</div><div>Done configuring the web interface (httpd).</div>
<div>Applying LDAP updates</div><div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div><div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Delete Sudo command,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=Sudo Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Delete Sudo command')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Delete HBAC rule,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=HBAC Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Delete HBAC rule')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div><div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Add Sudo command group,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=Sudo Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Add Sudo command group')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Add Group Password Policy costemplate,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Add Group Password Policy costemplate')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div><div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div><div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div><div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=HBAC Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['nestedgroup', 'groupofnames', 'top']), ('member', [ipapython.dn.DN('cn=IT Security Specialist,cn=roles,cn=accounts,dc=miovision,dc=linux')]), ('cn', 'HBAC Administrator'), ('description', 'HBAC Administrator')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Add Sudo rule,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=Sudo Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Add Sudo rule')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Delete Group Password Policy costemplate,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Delete Group Password Policy costemplate')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div><div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Add krbPrincipalName to a host,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['top', 'groupofnames', 'ipapermission']), ('member', ['cn=Host Administrators,cn=privileges,cn=pbac,dc=miovision,dc=linux', 'cn=Host Enrollment,cn=privileges,cn=pbac,dc=miovision,dc=linux']), ('cn', 'Add krbPrincipalName to a host')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Manage Sudo command group membership,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=Sudo Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Manage Sudo command group membership')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Add HBAC service groups,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=HBAC Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Add HBAC service groups')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Remove SELinux User Maps,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['top', 'groupofnames', 'ipapermission']), ('member', 'cn=SELinux User Map Administrators,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Remove SELinux User Maps')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['top', 'groupofnames', 'ipapermission']), ('member', 'cn=Write IPA Configuration,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Write IPA Configuration')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Manage HBAC rule membership,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=HBAC Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Manage HBAC rule membership')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=SELinux User Map Administrators,cn=privileges,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['top', 'groupofnames', 'nestedgroup']), ('cn', 'SELinux User Map Administrators'), ('description', 'SELinux User Map Administrators')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div><div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Delete Sudo rule,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=Sudo Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Delete Sudo rule')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Delete HBAC services,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=HBAC Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Delete HBAC services')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Delete Sudo command group,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=Sudo Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Delete Sudo command group')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Delete Group Password Policy,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Delete Group Password Policy')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Add HBAC services,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=HBAC Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Add HBAC services')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Delete HBAC service groups,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=HBAC Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Delete HBAC service groups')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Modify Sudo command,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=Sudo Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Modify Sudo command')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div><div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Add Sudo command,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=Sudo Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Add Sudo command')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Modify Group Password Policy costemplate,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Modify Group Password Policy costemplate')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Add HBAC rule,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'ipapermission', 'top']), ('member', 'cn=HBAC Administrator,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Add HBAC rule')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Modify Group membership,cn=privileges,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['top', 'groupofnames', 'nestedgroup']), ('member', 'cn=helpdesk,cn=roles,cn=accounts,dc=miovision,dc=linux'), ('cn', 'Modify Group membership'), ('description', 'Modify Group membership')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=IT Specialist,cn=roles,cn=accounts,dc=miovision,dc=linux: [('objectclass', ['groupofnames', 'nestedgroup', 'top']), ('cn', 'IT Specialist'), ('description', 'IT Specialist')]</div>
<div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Server is unwilling to perform: database is read-only</div><div>ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Add failure Server is unwilling to perform: database is read-only arguments: entry=cn=Add SELinux User Maps,cn=permissions,cn=pbac,dc=miovision,dc=linux: [('objectclass', ['top', 'groupofnames', 'ipapermission']), ('member', 'cn=SELinux User Map Administrators,cn=privileges,cn=pbac,dc=miovision,dc=linux'), ('cn', 'Add SELinux User Maps')]</div>
<div>Restarting the directory server</div><div>Restarting the KDC</div><div>Configuring DNS (named)</div><div> [1/9]: adding DNS container</div><div> [2/9]: setting up our zone</div><div> [3/9]: setting up reverse zone</div>
<div> [4/9]: setting up our own record</div><div> [5/9]: setting up kerberos principal</div><div> [6/9]: setting up named.conf</div><div> [7/9]: restarting named</div><div> [8/9]: configuring named to start on boot</div>
<div> [9/9]: changing resolv.conf to point to ourselves</div><div>Done configuring DNS (named).</div><div><br></div><div>Global DNS configuration in LDAP server is empty</div><div>You can use 'dnsconfig-mod' command to set global DNS options that</div>
<div>would override settings in local named.conf files</div><div><br></div><div>Restarting the web server</div><div>==============================================================================</div><div>Setup complete</div>
<div><br></div><div>Next steps:</div><div><span class="" style="white-space:pre"> </span>1. You must make sure these network ports are open:</div><div><span class="" style="white-space:pre"> </span>TCP Ports:</div><div><span class="" style="white-space:pre"> </span> * 80, 443: HTTP/HTTPS</div>
<div><span class="" style="white-space:pre"> </span> * 389, 636: LDAP/LDAPS</div><div><span class="" style="white-space:pre"> </span> * 88, 464: kerberos</div><div><span class="" style="white-space:pre"> </span> * 53: bind</div>
<div><span class="" style="white-space:pre"> </span>UDP Ports:</div><div><span class="" style="white-space:pre"> </span> * 88, 464: kerberos</div><div><span class="" style="white-space:pre"> </span> * 53: bind</div><div>
<span class="" style="white-space:pre"> </span> * 123: ntp</div><div><br></div><div><span class="" style="white-space:pre"> </span>2. You can now obtain a kerberos ticket using the command: 'kinit admin'</div><div>
<span class="" style="white-space:pre"> </span> This ticket will allow you to use the IPA tools (e.g., ipa user-add)</div><div><span class="" style="white-space:pre"> </span> and the web user interface.</div><div><br>
</div><div>Be sure to back up the CA certificate stored in /root/cacert.p12</div><div>This file is required to create replicas. The password for this</div><div>file is the Directory Manager password</div></div><div><br></div>
<div><br></div><div><br></div><div>I'd attach the log file, but its 30MB in size... it looks like the DEBUG loglevel prints out all the inserts when building the db.</div><div><br></div><div><br></div></div><div class="gmail_extra">
<br clear="all"><div><div dir="ltr"><span style="font-family:arial,sans-serif;font-size:16px"><strong>Steve Dainard </strong></span><span style="font-size:12px"></span><br>
<span style="font-family:arial,sans-serif;font-size:12px">IT Infrastructure Manager<br>
<a href="http://miovision.com/" target="_blank">Miovision</a> | <em>Rethink Traffic</em><br>
519-513-2407 ex.250<br>
877-646-8476 (toll-free)<br>
<br>
<strong style="font-family:arial,sans-serif;font-size:13px;color:#999999"><a href="http://miovision.com/blog" target="_blank">Blog</a> | </strong><font color="#999999" style="font-family:arial,sans-serif;font-size:13px"><strong><a href="https://www.linkedin.com/company/miovision-technologies" target="_blank">LinkedIn</a> | <a href="https://twitter.com/miovision" target="_blank">Twitter</a> | <a href="https://www.facebook.com/miovision" target="_blank">Facebook</a></strong></font> </span>
<hr style="font-family:arial,sans-serif;font-size:13px;color:#333333;clear:both">
<div style="color:#999999;font-family:arial,sans-serif;font-size:13px;padding-top:5px">
<span style="font-family:arial,sans-serif;font-size:12px">Miovision Technologies Inc. | 148 Manitou Drive, Suite 101, Kitchener, ON, Canada | N2C 1L3</span><br>
<span style="font-family:arial,sans-serif;font-size:12px">This e-mail may contain information that is privileged or confidential. If you are not the intended recipient, please delete the e-mail and any attachments and notify us immediately.</span></div>
</div></div>
<br><br><div class="gmail_quote">On Wed, Feb 5, 2014 at 12:09 PM, Steve Dainard <span dir="ltr"><<a href="mailto:sdainard@miovision.com" target="_blank">sdainard@miovision.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><br></div><div><br></div><div>rpm -qa | grep krb5</div><div>pam_krb5-2.3.11-9.el6.x86_64</div><div><b>krb5-server-1.10.3-10.el6_4.6.x86_64</b></div><div>krb5-libs-1.10.3-10.el6_4.6.x86_64</div><div>krb5-workstation-1.10.3-10.el6_4.6.x86_64</div>
<div><br></div><div>I don't see any segfaults in messages.</div><div><br></div><div><span style="font-size:13px;font-family:arial,sans-serif">/var/log/dirsrv/slapd-</span><u style="font-size:13px;font-family:arial,sans-serif"></u><span style="font-size:13px;font-family:arial,sans-serif">MIOVISIO</span><span style="font-size:13px;font-family:arial,sans-serif">N-LINUX/</span>errors looks pretty clean:</div>
<div><br></div><div><div><span style="white-space:pre-wrap"> </span>389-Directory/<a href="http://1.2.11.15" target="_blank">1.2.11.15</a> B2013.337.1530</div><div><span style="white-space:pre-wrap"> </span>ipa1.miovision.linux:389 (/etc/dirsrv/slapd-MIOVISION-LINUX)</div>
<div><br></div><div>[04/Feb/2014:15:39:54 -0500] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database</div><div>[04/Feb/2014:15:39:54 -0500] - check_and_set_import_cache: pagesize: 4096, pages: 1497738, procpages: 51916</div>
<div>[04/Feb/2014:15:39:54 -0500] - Import allocates 2396380KB import cache.</div><div>[04/Feb/2014:15:39:55 -0500] - import userRoot: Beginning import job...</div><div>[04/Feb/2014:15:39:55 -0500] - import userRoot: Index buffering enabled with bucket size 100</div>
<div>[04/Feb/2014:15:39:56 -0500] - import userRoot: Processing file "/var/lib/dirsrv/boot.ldif"</div><div>[04/Feb/2014:15:39:56 -0500] - import userRoot: Finished scanning file "/var/lib/dirsrv/boot.ldif" (1 entries)</div>
<div>[04/Feb/2014:15:40:03 -0500] - import userRoot: Workers finished; cleaning up...</div><div>[04/Feb/2014:15:40:04 -0500] - import userRoot: Workers cleaned up.</div><div>[04/Feb/2014:15:40:05 -0500] - import userRoot: Cleaning up producer thread...</div>
<div>[04/Feb/2014:15:40:05 -0500] - import userRoot: Indexing complete. Post-processing...</div><div>[04/Feb/2014:15:40:06 -0500] - import userRoot: Generating numSubordinates complete.</div><div>[04/Feb/2014:15:40:07 -0500] - Nothing to do to build ancestorid index</div>
<div>[04/Feb/2014:15:40:08 -0500] - import userRoot: Flushing caches...</div><div>[04/Feb/2014:15:40:08 -0500] - import userRoot: Closing files...</div><div>[04/Feb/2014:15:40:10 -0500] - All database threads now stopped</div>
<div>[04/Feb/2014:15:40:10 -0500] - import userRoot: Import complete. Processed 1 entries in 15 seconds. (0.07 entries/sec)</div><div>[04/Feb/2014:15:40:18 -0500] - 389-Directory/<a href="http://1.2.11.15" target="_blank">1.2.11.15</a> B2013.337.1530 starting up</div>
<div>[04/Feb/2014:15:40:19 -0500] - Db home directory is not set. Possibly nsslapd-directory (optinally nsslapd-db-home-directory) is missing in the config file.</div><div>[04/Feb/2014:15:40:19 -0500] - I'm resizing my cache now...cache was 2453893120 and is now 8000000</div>
<div>[04/Feb/2014:15:40:36 -0500] - slapd started. Listening on All Interfaces port 389 for LDAP requests</div><div>[04/Feb/2014:15:40:36 -0500] - slapd shutting down - signaling operation threads</div><div>[04/Feb/2014:15:40:37 -0500] - slapd shutting down - closing down internal subsystems and plugins</div>
<div>[04/Feb/2014:15:40:37 -0500] - Waiting for 4 database threads to stop</div><div>[04/Feb/2014:15:40:38 -0500] - All database threads now stopped</div><div>[04/Feb/2014:15:40:38 -0500] - slapd stopped.</div><div>[04/Feb/2014:15:40:40 -0500] - 389-Directory/<a href="http://1.2.11.15" target="_blank">1.2.11.15</a> B2013.337.1530 starting up</div>
<div>[04/Feb/2014:15:40:41 -0500] - slapd started. Listening on All Interfaces port 389 for LDAP requests</div><div>[04/Feb/2014:15:40:43 -0500] - The change of nsslapd-ldapilisten will not take effect until the server is restarted</div>
<div>[04/Feb/2014:15:41:10 -0500] - Warning: Adding configuration attribute "nsslapd-security"</div><div>[04/Feb/2014:15:41:13 -0500] - slapd shutting down - signaling operation threads</div><div>[04/Feb/2014:15:41:14 -0500] - slapd shutting down - waiting for 30 threads to terminate</div>
<div>[04/Feb/2014:15:41:14 -0500] - slapd shutting down - closing down internal subsystems and plugins</div><div>[04/Feb/2014:15:41:15 -0500] - Waiting for 4 database threads to stop</div><div>[04/Feb/2014:15:41:17 -0500] - All database threads now stopped</div>
<div>[04/Feb/2014:15:41:17 -0500] - slapd stopped.</div><div>[04/Feb/2014:15:41:27 -0500] - 389-Directory/<a href="http://1.2.11.15" target="_blank">1.2.11.15</a> B2013.337.1530 starting up</div><div>[04/Feb/2014:15:41:27 -0500] attrcrypt - No symmetric key found for cipher AES in backend userRoot, attempting to create one...</div>
<div>[04/Feb/2014:15:41:28 -0500] attrcrypt - Key for cipher AES successfully generated and stored</div><div>[04/Feb/2014:15:41:29 -0500] attrcrypt - No symmetric key found for cipher 3DES in backend userRoot, attempting to create one...</div>
<div>[04/Feb/2014:15:41:29 -0500] attrcrypt - Key for cipher 3DES successfully generated and stored</div><div>[04/Feb/2014:15:41:31 -0500] - slapd started. Listening on All Interfaces port 389 for LDAP requests</div><div>
[04/Feb/2014:15:41:31 -0500] - Listening on All Interfaces port 636 for LDAPS requests</div><div>[04/Feb/2014:15:41:32 -0500] - Listening on /var/run/slapd-MIOVISION-LINUX.socket for LDAPI requests</div><div>[04/Feb/2014:15:42:06 -0500] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=miovision,dc=linux--no CoS Templates found, which should be added before the CoS Definition.</div>
<div>[04/Feb/2014:15:44:31 -0500] - slapd shutting down - signaling operation threads</div><div>[04/Feb/2014:15:44:33 -0500] - slapd shutting down - closing down internal subsystems and plugins</div><div>[04/Feb/2014:15:44:44 -0500] - Waiting for 4 database threads to stop</div>
<div>[04/Feb/2014:15:44:47 -0500] - All database threads now stopped</div><div>[04/Feb/2014:15:44:47 -0500] - slapd stopped.</div><div>[04/Feb/2014:15:44:49 -0500] - 389-Directory/<a href="http://1.2.11.15" target="_blank">1.2.11.15</a> B2013.337.1530 starting up</div>
<div>[04/Feb/2014:15:44:51 -0500] schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=miovision,dc=linux</div><div>[04/Feb/2014:15:44:52 -0500] schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=miovision,dc=linux</div>
<div>[04/Feb/2014:15:44:52 -0500] schema-compat-plugin - warning: no entries set up under ou=sudoers,dc=miovision,dc=linux</div><div>[04/Feb/2014:15:44:52 -0500] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=miovision,dc=linux--no CoS Templates found, which should be added before the CoS Definition.</div>
<div>[04/Feb/2014:15:44:52 -0500] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=miovision,dc=linux--no CoS Templates found, which should be added before the CoS Definition.</div><div>[04/Feb/2014:15:44:53 -0500] - slapd started. Listening on All Interfaces port 389 for LDAP requests</div>
<div>[04/Feb/2014:15:44:53 -0500] - Listening on All Interfaces port 636 for LDAPS requests</div><div>[04/Feb/2014:15:44:53 -0500] - Listening on /var/run/slapd-MIOVISION-LINUX.socket for LDAPI requests</div><div>[04/Feb/2014:15:44:53 -0500] - The change of nsslapd-maxdescriptors will not take effect until the server is restarted</div>
<div>[05/Feb/2014:09:51:59 -0500] - slapd shutting down - signaling operation threads</div><div>[05/Feb/2014:09:51:59 -0500] - slapd shutting down - waiting for 26 threads to terminate</div><div>[05/Feb/2014:09:52:00 -0500] - slapd shutting down - closing down internal subsystems and plugins</div>
<div>[05/Feb/2014:09:52:00 -0500] - Waiting for 4 database threads to stop</div><div>[05/Feb/2014:09:52:00 -0500] - All database threads now stopped</div><div>[05/Feb/2014:09:52:00 -0500] - slapd stopped.</div></div><div>
<br></div><div><br></div><div>Thanks,</div></div><div class="gmail_extra"><div class="im"><br clear="all"><div><div dir="ltr"><span style="font-family:arial,sans-serif;font-size:16px"><strong>Steve Dainard </strong></span><span style="font-size:12px"></span><br>
<span style="font-family:arial,sans-serif;font-size:12px">IT Infrastructure Manager<br>
<a href="http://miovision.com/" target="_blank">Miovision</a> | <em>Rethink Traffic</em><br>
<a href="tel:519-513-2407" value="+15195132407" target="_blank">519-513-2407</a> ex.250<br>
<a href="tel:877-646-8476" value="+18776468476" target="_blank">877-646-8476</a> (toll-free)<br>
<br>
<strong style="font-family:arial,sans-serif;font-size:13px;color:#999999"><a href="http://miovision.com/blog" target="_blank">Blog</a> | </strong><font color="#999999" style="font-family:arial,sans-serif;font-size:13px"><strong><a href="https://www.linkedin.com/company/miovision-technologies" target="_blank">LinkedIn</a> | <a href="https://twitter.com/miovision" target="_blank">Twitter</a> | <a href="https://www.facebook.com/miovision" target="_blank">Facebook</a></strong></font> </span>
<hr style="font-family:arial,sans-serif;font-size:13px;color:#333333;clear:both">
<div style="color:#999999;font-family:arial,sans-serif;font-size:13px;padding-top:5px">
<span style="font-family:arial,sans-serif;font-size:12px">Miovision Technologies Inc. | 148 Manitou Drive, Suite 101, Kitchener, ON, Canada | N2C 1L3</span><br>
<span style="font-family:arial,sans-serif;font-size:12px">This e-mail may contain information that is privileged or confidential. If you are not the intended recipient, please delete the e-mail and any attachments and notify us immediately.</span></div>
</div></div>
<br><br></div><div><div class="h5"><div class="gmail_quote">On Wed, Feb 5, 2014 at 11:50 AM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Steve Dainard wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>
Following this guide:<br>
<a href="https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/trust-diff-dns-domains.html" target="_blank">https://access.redhat.com/<u></u>site/documentation/en-US/Red_<u></u>Hat_Enterprise_Linux/6/html/<u></u>Identity_Management_Guide/<u></u>trust-diff-dns-domains.html</a><br>
<br>
STEP 4:<br>
ipa-server-install --setup-dns -p '<password>' -a '<password>' -r<br>
MIOVISION.LINUX -n miovision.linux --hostname ipa1.miovision.linux<br>
--forwarder=10.0.0.2 --forwarder=10.0.0.5<br>
<br>
Server host name [ipa1.miovision.linux]:<br>
<br>
Warning: skipping DNS resolution of host ipa1.miovision.linux<br>
Unable to resolve IP address for host name<br>
Please provide the IP address to be used for this host name: 10.0.6.3<br>
Adding [10.0.6.3 ipa1.miovision.linux] to your /etc/hosts file<br>
Do you want to configure the reverse zone? [yes]:<br>
Please specify the reverse zone name [6.0.10.in-addr.arpa.]:<br>
Using reverse zone 6.0.10.in-addr.arpa.<br>
<br>
The IPA Master Server will be configured with:<br>
Hostname: ipa1.miovision.linux<br>
IP address: 10.0.6.3<br>
Domain name: miovision.linux<br>
Realm name: MIOVISION.LINUX<br>
<br>
BIND DNS server will be configured to serve IPA domain with:<br>
Forwarders: 10.0.0.2, 10.0.0.5<br>
Reverse zone: 6.0.10.in-addr.arpa.<br>
<br>
Continue to configure the system with these values? [no]: yes<br>
<br>
The following operations may take some minutes to complete.<br>
Please wait until the prompt is returned.<br>
<br>
Configuring NTP daemon (ntpd)<br>
[1/4]: stopping ntpd<br>
<br>
...<br>
<br>
Done configuring directory server (dirsrv).<br>
Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds<br>
[1/10]: adding sasl mappings to the directory<br>
[2/10]: adding kerberos container to the directory<br>
[3/10]: configuring KDC<br>
[4/10]: initialize kerberos container<br>
Failed to initialize the realm container<br>
[5/10]: adding default ACIs<br>
[6/10]: creating a keytab for the directory<br>
Unexpected error - see /var/log/ipaserver-install.log for details:<br>
CalledProcessError: Command 'kadmin.local -q addprinc -randkey<br>
ldap/ipa1.miovision.linux@<u></u>MIOVISION.LINUX -x<br>
ipa-setup-override-<u></u>restrictions' returned non-zero exit status 1<br>
<br></div></div>
*/var/log/ipaserver-install.<u></u>log*<div><div><br>
<br>
add aci:<br>
<br>
(target="ldap:///cn=*,cn=ca_<u></u>renewal,cn=ipa,cn=etc,dc=<u></u>miovision,dc=linux")(<u></u>targetattr="userCertificate")(<u></u>version<br>
3.0; acl "Modify CA Certificates for renewals"; allow(write) userdn =<br>
"ldap:///fqdn=ipa1.miovision.<u></u>linux,cn=computers,cn=<u></u>accounts,dc=miovision,dc=<u></u>linux";)<br>
modifying entry "cn=ipa,cn=etc,dc=miovision,<u></u>dc=linux"<br>
modify complete<br>
<br>
<br>
2014-02-04T20:45:51Z DEBUG stderr=ldap_initialize(<br>
ldapi://%2Fvar%2Frun%2Fslapd-<u></u>MIOVISION-LINUX.socket/??base )<br>
<br>
2014-02-04T20:45:51Z DEBUG duration: 6 seconds<br>
2014-02-04T20:45:51Z DEBUG [6/10]: creating a keytab for the directory<br>
2014-02-04T20:45:51Z DEBUG args=kadmin.local -q addprinc -randkey<br>
ldap/ipa1.miovision.linux@<u></u>MIOVISION.LINUX -x ipa-setup-override-<u></u>restrictions<br>
2014-02-04T20:45:51Z DEBUG stdout=Authenticating as principal<br>
root/admin@MIOVISION.LINUX with password.<br>
<br>
2014-02-04T20:45:51Z DEBUG stderr=kadmin.local: No such entry in the<br>
database while initializing kadmin.local interface<br>
<br>
2014-02-04T20:45:51Z INFO File<br>
"/usr/lib/python2.6/site-<u></u>packages/ipaserver/install/<u></u>installutils.py",<br>
line 614, in run_script<br>
return_value = main_function()<br>
<br>
File "/usr/sbin/ipa-server-install"<u></u>, line 1024, in main<br>
subject_base=options.subject)<br>
<br>
File<br>
"/usr/lib/python2.6/site-<u></u>packages/ipaserver/install/<u></u>krbinstance.py",<br>
line 183, in create_instance<br>
self.start_creation(runtime=<u></u>30)<br>
<br>
File "/usr/lib/python2.6/site-<u></u>packages/ipaserver/install/<u></u>service.py",<br>
line 358, in start_creation<br>
method()<br>
<br>
File<br>
"/usr/lib/python2.6/site-<u></u>packages/ipaserver/install/<u></u>krbinstance.py",<br>
line 386, in __create_ds_keytab<br>
installutils.kadmin_addprinc(<u></u>ldap_principal)<br>
<br>
File<br>
"/usr/lib/python2.6/site-<u></u>packages/ipaserver/install/<u></u>installutils.py",<br>
line 369, in kadmin_addprinc<br>
kadmin("addprinc -randkey " + principal)<br>
<br>
File<br>
"/usr/lib/python2.6/site-<u></u>packages/ipaserver/install/<u></u>installutils.py",<br>
line 366, in kadmin<br>
"-x", "ipa-setup-override-<u></u>restrictions"])<br>
<br>
File "/usr/lib/python2.6/site-<u></u>packages/ipapython/ipautil.py"<u></u>, line<br>
316, in run<br>
raise CalledProcessError(p.<u></u>returncode, args)<br>
<br>
2014-02-04T20:45:51Z INFO The ipa-server-install command failed,<br>
exception: CalledProcessError: Command 'kadmin.local -q addprinc<br>
-randkey ldap/ipa1.miovision.linux@<u></u>MIOVISION.LINUX -x<br>
ipa-setup-override-<u></u>restrictions' returned non-zero exit status 1<br>
<br>
</div></div></blockquote>
<br>
Steve sent me the logs out-of-band. I think the problem is an earlier failure after generating the master key:<br>
<br>
2014-02-04T20:45:45Z DEBUG args=kdb5_util create -s -r MIOVISION.LINUX -x ipa-setup-override-<u></u>restrictions<br>
2014-02-04T20:45:45Z DEBUG stdout=Loading random data<br>
Initializing database '/var/kerberos/krb5kdc/<u></u>principal' for realm 'MIOVISION.LINUX',<br>
master key name 'K/M@MIOVISION.LINUX'<br>
You will be prompted for the database Master Password.<br>
It is important that you NOT FORGET this password.<br>
Enter KDC database master key:<br>
Re-enter KDC database master key to verify:<br>
<br>
<br>
2014-02-04T20:45:45Z DEBUG stderr=kdb5_util: add.c:124: ldap_add_ext: Assertion `ld != ((void *)0)' failed.<br>
<br>
What version of krb5_server is installed? Does /var/log/messages indicate a segfault? Are there any failures in /var/log/dirsrv/slapd-<u></u>MIOVISION-LINUX/errors?<span><font color="#888888"><br>
<br>
rob<br>
</font></span></blockquote></div><br></div></div></div>
</blockquote></div><br></div>