<div dir="ltr">Hi Rob<div><br></div><div>Ipa client version is :ipa-client-2.1.3-7.el5</div><div><br></div><div><div>[root@apa01-tst ~]# klist -kte /etc/krb5.keytab </div><div>Keytab name: FILE:/etc/krb5.keytab</div><div>KVNO Timestamp Principal</div> <div>---- ----------------- --------------------------------------------------------</div><div> 2 03/11/14 15:55:02 host/apa01-tst.chn1.oob.pp.ams@PP.AMS (AES-256 CTS mode with 96-bit SHA-1 HMAC) </div><div> 2 03/11/14 15:55:02 host/apa01-tst.chn1.oob.pp.ams@PP.AMS (AES-128 CTS mode with 96-bit SHA-1 HMAC) </div> <div> 2 03/11/14 15:55:02 host/apa01-tst.chn1.oob.pp.ams@PP.AMS (Triple DES cbc mode with HMAC/sha1) </div><div> 2 03/11/14 15:55:02 host/apa01-tst.chn1.oob.pp.ams@PP.AMS (ArcFour with HMAC/md5) </div></div><div><br></div> <div><br></div><div>this is what shows up in the logfile krb5kdc.log on the KDC</div><div><br></div><div><div><br></div><div>Mar 11 15:55:02 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16846](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://10.63.130.33">10.63.130.33</a>: NEEDED_PREAUTH: host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for krbtgt/<a href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a>, Additional pre-authentication required</div> <div>Mar 11 15:55:02 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16847](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://10.63.130.33">10.63.130.33</a>: ISSUE: authtime 1394549702, etypes {rep=18 tkt=18 ses=18}, host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for krbtgt/<a href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a></div> <div>Mar 11 15:55:02 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16847](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://10.63.130.33">10.63.130.33</a>: ISSUE: authtime 1394549702, etypes {rep=18 tkt=18 ses=18}, host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for HTTP/<a href="mailto:auth01.example.com@EXAMPLE.COM">auth01.example.com@EXAMPLE.COM</a></div> <div>Mar 11 15:55:02 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16847](info): TGS_REQ (1 etypes {18}) <a href="http://10.63.130.33">10.63.130.33</a>: ISSUE: authtime 1394549702, etypes {rep=18 tkt=18 ses=18}, host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for krbtgt/<a href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a></div> <div>Mar 11 15:55:02 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16847](info): TGS_REQ (1 etypes {18}) <a href="http://10.63.130.33">10.63.130.33</a>: ISSUE: authtime 1394549702, etypes {rep=18 tkt=18 ses=18}, host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for krbtgt/<a href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a></div> <div>Mar 11 15:55:02 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16847](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://10.63.132.21">10.63.132.21</a>: ISSUE: authtime 1394549702, etypes {rep=18 tkt=18 ses=18}, host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for ldap/<a href="mailto:auth01.example.com@EXAMPLE.COM">auth01.example.com@EXAMPLE.COM</a></div> <div>Mar 11 15:55:03 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16847](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://10.63.130.33">10.63.130.33</a>: NEEDED_PREAUTH: host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for krbtgt/<a href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a>, Additional pre-authentication required</div> <div>Mar 11 15:55:03 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16846](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://10.63.130.33">10.63.130.33</a>: ISSUE: authtime 1394549703, etypes {rep=18 tkt=18 ses=18}, host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for krbtgt/<a href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a></div> <div>Mar 11 15:55:03 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16846](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://10.63.130.33">10.63.130.33</a>: ISSUE: authtime 1394549703, etypes {rep=18 tkt=18 ses=18}, host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for HTTP/<a href="mailto:auth01.example.com@EXAMPLE.COM">auth01.example.com@EXAMPLE.COM</a></div> <div>Mar 11 15:55:03 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16847](info): TGS_REQ (1 etypes {18}) <a href="http://10.63.130.33">10.63.130.33</a>: ISSUE: authtime 1394549703, etypes {rep=18 tkt=18 ses=18}, host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for krbtgt/<a href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a></div> <div>Mar 11 15:55:03 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16846](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://10.63.132.21">10.63.132.21</a>: ISSUE: authtime 1394549703, etypes {rep=18 tkt=18 ses=18}, host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for ldap/<a href="mailto:auth01.example.com@EXAMPLE.COM">auth01.example.com@EXAMPLE.COM</a></div> <div>Mar 11 15:55:04 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16846](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://10.63.130.33">10.63.130.33</a>: NEEDED_PREAUTH: host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for krbtgt/<a href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a>, Additional pre-authentication required</div> <div>Mar 11 15:55:04 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16846](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://10.63.130.33">10.63.130.33</a>: ISSUE: authtime 1394549704, etypes {rep=18 tkt=18 ses=18}, host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for krbtgt/<a href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a></div> <div>Mar 11 15:55:04 <a href="http://auth01.example.com">auth01.example.com</a> krb5kdc[16846](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) <a href="http://10.63.130.33">10.63.130.33</a>: ISSUE: authtime 1394549704, etypes {rep=18 tkt=18 ses=18}, host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM">apa01-tst.chn1.oob.example.com@EXAMPLE.COM</a> for ldap/<a href="mailto:auth01.example.com@EXAMPLE.COM">auth01.example.com@EXAMPLE.COM</a></div> </div><div><br></div><div><br></div><div>Cheers,</div><div>Patrick</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Mar 11, 2014 at 2:00 PM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Patrick de Ruiter wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class=""> When I want to enroll en new machine the ipa-client-install process<br> bails out with the error "Failed to retrieve encryption type DES cbc<br> mode with CRC-32 (#1)" .<br> The output below is the debug output:<br> <br> [root@apa01-tst ~]# ipa-client-install -d --domain=<a href="http://example.com" target="_blank">example.com</a><br></div> <<a href="http://example.com" target="_blank">http://example.com</a>> --mkhomedir -w otpass --realm=<a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a><br> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>> --ntp-server=<a href="http://ns01.example.com" target="_blank">ns01.example.com</a><br> <<a href="http://ns01.example.com" target="_blank">http://ns01.example.com</a>> --unattended<div class=""><br> root : DEBUG /usr/sbin/ipa-client-install was invoked with<br> options: {'conf_ntp': True, 'domain': '<a href="http://example.com" target="_blank">example.com</a><br></div> <<a href="http://example.com" target="_blank">http://example.com</a>>', 'uninstall': False, 'force': False, 'sssd': True,<div class=""><br> 'krb5_offline_passwords': True, 'hostname': None, 'permit': False,<br> 'server': None, 'prompt_password': False, 'mkhomedir': True,<br> 'dns_updates': False, 'preserve_sssd': False, 'debug': True,<br> 'on_master': False, 'ca_cert_file': None, 'realm_name': '<a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a><br></div> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>>', 'unattended': True, 'ntp_server':<br> '<a href="http://ns01.example.com" target="_blank">ns01.example.com</a> <<a href="http://ns01.example.com" target="_blank">http://ns01.example.com</a>>', 'principal': None}<div class=""><br> root : DEBUG missing options might be asked for interactively<br> later<br> <br> root : DEBUG Loading Index file from<br> '/var/lib/ipa-client/<u></u>sysrestore/sysrestore.index'<br> root : DEBUG Loading StateFile from<br> '/var/lib/ipa-client/<u></u>sysrestore/sysrestore.state'<br> root : DEBUG [IPA Discovery]<br> root : DEBUG Starting IPA discovery with domain=<a href="http://example.com" target="_blank">example.com</a><br></div> <<a href="http://example.com" target="_blank">http://example.com</a>>, servers=None,<br> hostname=<a href="http://apa01-tst.chn1.oob.example.com" target="_blank">apa01-tst.chn1.oob.<u></u>example.com</a><br> <<a href="http://apa01-tst.chn1.oob.example.com" target="_blank">http://apa01-tst.chn1.oob.<u></u>example.com</a>><div class=""><br> root : DEBUG Search for LDAP SRV record in <a href="http://example.com" target="_blank">example.com</a><br></div> <<a href="http://example.com" target="_blank">http://example.com</a>><div class=""><br> root : DEBUG [ipadnssearchldap]<br> root : DEBUG [ipadnssearchkrb]<br> root : DEBUG [ipacheckldap]<br> root : DEBUG Verifying that <a href="http://auth01.example.com" target="_blank">auth01.example.com</a><br></div> <<a href="http://auth01.example.com" target="_blank">http://auth01.example.com</a>> (realm <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>>) is<div class=""> <br> an IPA server<br> root : DEBUG Init ldap with: ldap://<a href="http://auth01.example.com:389" target="_blank">auth01.example.com:389</a><br></div> <<a href="http://auth01.example.com:389" target="_blank">http://auth01.example.com:389</a><u></u>><div class=""><br> root : DEBUG Search LDAP server for IPA base DN<br> root : DEBUG Check if naming context 'dc=pp,dc=ams' is for IPA<br> root : DEBUG Naming context 'dc=pp,dc=ams' is a valid IPA context<br> root : DEBUG Search for (objectClass=<u></u>krbRealmContainer) in<br> dc=pp,dc=ams(sub)<br> root : DEBUG Found: [('cn=<a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a><br></div> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>>,cn=<u></u>kerberos,dc=pp,dc=ams', {'krbSubTrees':<br> ['dc=pp,dc=ams'], 'cn': ['<a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>>'],<div class=""><br> 'krbDefaultEncSaltTypes': ['aes256-cts:special', 'aes128-cts:special',<br> 'des3-hmac-sha1:special', 'arcfour-hmac:special'], 'objectClass':<br> ['top', 'krbrealmcontainer', 'krbticketpolicyaux'], 'krbSearchScope':<br> ['2'], 'krbSupportedEncSaltTypes': ['aes256-cts:normal',<br> 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special',<br> 'des3-hmac-sha1:normal', 'des3-hmac-sha1:special',<br> 'arcfour-hmac:normal', 'arcfour-hmac:special'], 'krbMaxTicketLife':<br> ['86400'], 'krbMaxRenewableAge': ['604800']})]<br> root : DEBUG Discovery result: Success;<br></div> server=<a href="http://auth01.example.com" target="_blank">auth01.example.com</a> <<a href="http://auth01.example.com" target="_blank">http://auth01.example.com</a>>,<br> domain=<a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>>, kdc=<a href="http://auth01.example.com" target="_blank">auth01.example.com</a><br> <<a href="http://auth01.example.com" target="_blank">http://auth01.example.com</a>>, basedn=dc=pp,dc=ams<div class=""><br> root : DEBUG Validated servers: <a href="http://auth01.example.com" target="_blank">auth01.example.com</a><br></div> <<a href="http://auth01.example.com" target="_blank">http://auth01.example.com</a>><br> root : DEBUG will use domain: <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>><br> <br> root : DEBUG [ipadnssearchldap(<a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>>)]<div class=""><br> root : DEBUG DNS validated, enabling discovery<br> root : DEBUG will use discovered server: <a href="http://auth01.example.com" target="_blank">auth01.example.com</a><br></div> <<a href="http://auth01.example.com" target="_blank">http://auth01.example.com</a>><br> Discovery was successful!<br> root : DEBUG will use cli_realm: <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>><div class=""><br> <br> root : DEBUG will use cli_basedn: dc=pp,dc=ams<br> <br> Hostname: <a href="http://apa01-tst.chn1.oob.example.com" target="_blank">apa01-tst.chn1.oob.example.com</a><br></div> <<a href="http://apa01-tst.chn1.oob.example.com" target="_blank">http://apa01-tst.chn1.oob.<u></u>example.com</a>><br> Realm: <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>><br> DNS Domain: <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>><br> IPA Server: <a href="http://auth01.example.com" target="_blank">auth01.example.com</a> <<a href="http://auth01.example.com" target="_blank">http://auth01.example.com</a>><div class=""><br> BaseDN: dc=pp,dc=ams<br> <br> <br> Synchronizing time with KDC...<br> root : DEBUG args=/usr/sbin/ntpdate -U ntp -s -b<br> </div><a href="http://auth01.example.com" target="_blank">auth01.example.com</a> <<a href="http://auth01.example.com" target="_blank">http://auth01.example.com</a>><div class=""><br> root : DEBUG stdout=<br> root : DEBUG stderr=<br> root : DEBUG Writing Kerberos configuration to /tmp/tmpM19nuR:<br> #File modified by ipa-client-install<br> <br> [libdefaults]<br></div> default_realm = <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>><div class=""><br> dns_lookup_realm = false<br> dns_lookup_kdc = false<br> rdns = false<br> ticket_lifetime = 24h<br> forwardable = yes<br> <br> [realms]<br> </div><a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>> = {<br> kdc = <a href="http://auth01.example.com:88" target="_blank">auth01.example.com:88</a> <<a href="http://auth01.example.com:88" target="_blank">http://auth01.example.com:88</a>><br> master_kdc = <a href="http://auth01.example.com:88" target="_blank">auth01.example.com:88</a> <<a href="http://auth01.example.com:88" target="_blank">http://auth01.example.com:88</a>><br> admin_server = <a href="http://auth01.example.com:749" target="_blank">auth01.example.com:749</a> <<a href="http://auth01.example.com:749" target="_blank">http://auth01.example.com:749</a><u></u>><br> default_domain = <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>><div class=""><br> pkinit_anchors = FILE:/etc/ipa/ca.crt<br> }<br> <br> [domain_realm]<br></div> .<a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>> = <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>><br> <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>> = <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>><div class=""> <br> <br> <br> root : INFO OTP case, CA cert preexisted, use it<br> root : DEBUG args=/usr/sbin/ipa-join -s <a href="http://auth01.example.com" target="_blank">auth01.example.com</a><br></div> <<a href="http://auth01.example.com" target="_blank">http://auth01.example.com</a>> -b dc=pp,dc=ams -d -w XXXXXXXX<div class=""><br> root : DEBUG stdout=<br> root : DEBUG stderr=request done: ld 0x172d1d10 msgid 1<br> request done: ld 0x172d1d10 msgid 2<br> request done: ld 0x172d1d10 msgid 3<br> Failed to retrieve encryption type DES cbc mode with CRC-32 (#1)<br> Keytab successfully retrieved and stored in: /etc/krb5.keytab<br></div> Certificate subject base is: O=<a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>><br> <br> Enrolled in IPA realm <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>><div class=""><br> root : DEBUG args=/usr/kerberos/bin/kinit -k -t<br> /etc/krb5.keytab host/<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM" target="_blank">apa01-tst.chn1.oob.<u></u>example.com@EXAMPLE.COM</a><br></div> <mailto:<a href="mailto:apa01-tst.chn1.oob.example.com@EXAMPLE.COM" target="_blank">apa01-tst.chn1.oob.<u></u>example.com@EXAMPLE.COM</a>><div class=""><br> root : DEBUG stdout=<br> root : DEBUG stderr=kinit(v5): Password incorrect while<br> getting initial credentials<br> <br> Failed to obtain host TGT.<br> Installation failed. Rolling back changes.<br> IPA client is not configured on this system.<br> </div></blockquote> <br> I don't think this is related to the DES failure, it just means that the KDC doesn't issue DES keys (a good thing).<br> <br> What keys are in the keytab and why errors are logged in the KDC when this kinit fails?<br> <br> What is the rpm version of ipa-client?<span class="HOEnZb"><font color="#888888"><br> <br> rob<br> </font></span></blockquote></div><br></div>