<div dir="ltr"><div><div><div>kinit USER works perfectly; but I can't ssh into the client machine from the server without it requesting a password.<br><br></div>I think this is a DNS issue, actually. The server isn't resolving the name of the client, so I'm ssh'ing with the IP address, and that's not going to work since it's not in the Kerberos db ("Cannot determine realm for numeric host address").<br><br>Except, of course, that the server did not get its own valid Kerberos host certificate. It should, right? during the ipa-client-install --on-master step of the server install?<br><br></div>In fact, the global DNS config is completely empty. But I'm going to have to tear down the server and rebuild because it's on the same domain as an AD server, and ipa-client-install finds that server rather than the new IPA server by default: that won't work because I want LDAP to dynamically update the records, and establish a trust with the AD server.<br>Also we've got 2 linux DNS root servers that act as forwarders. I pointed the IPA server at them, but I don't know enough about FreeIPA or DNS/Bind to configure IPA to use them properly. SO I'm sure that's where most of my problems lie.<br></div><div><br></div>I've got to RTFM a bit more before I really start asking the right questions, I think. At that point I'll start a new thread.<br><div><div><div><div><br><br></div></div></div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div>thx<br></div>anthony<br></div></div></div> <br><div class="gmail_quote">On Thu, Mar 26, 2015 at 9:31 AM, Martin Kosek <span dir="ltr"><<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I am not sure what you mean. So are you saying that "kinit USER" done on server<br> fails? With what error?<br> <div class="HOEnZb"><div class="h5"><br> On 03/26/2015 05:28 PM, Anthony Lanni wrote:<br> > great, thanks.<br> ><br> > On a related note: the server still doesn't get a (client) kerberos ticket,<br> > which means I can't kinit as a user and then log into a client machine<br> > without a password. Going the other way works fine, however.<br> ><br> > thx<br> > anthony<br> ><br> > On Thu, Mar 26, 2015 at 7:14 AM, Martin Kosek <<a href="mailto:mkosek@redhat.com">mkosek@redhat.com</a>> wrote:<br> ><br> >> Ok, thanks for reaching back. BTW, next RHEL-6 minor release should have<br> >> the<br> >> keyutils dependency fixed anyway :-)<br> >><br> >> Martin<br> >><br> >> On 03/25/2015 06:59 PM, Anthony Lanni wrote:<br> >>> keyutils is already installed but /bin/keyctl was 0 length (!). Anyway I<br> >>> reinstalled keyutils and then ran the ipa-server-install again, and this<br> >>> time it completed without error.<br> >>><br> >>> Thanks very much, Martin and Dmitri!<br> >>><br> >>> thx<br> >>> anthony<br> >>><br> >>> On Wed, Mar 25, 2015 at 5:34 AM, Martin Kosek <<a href="mailto:mkosek@redhat.com">mkosek@redhat.com</a>> wrote:<br> >>><br> >>>> On 03/25/2015 04:11 AM, Dmitri Pal wrote:<br> >>>>> On 03/24/2015 09:17 PM, Anthony Lanni wrote:<br> >>>>>> While running ipa-server-install, it's failing out at the end with an<br> >>>> error<br> >>>>>> regarding the client install on the server. This happens regardless of<br> >>>> how I<br> >>>>>> input the options, but here's the latest command:<br> >>>>>><br> >>>>>> ipa-server-install --setup-dns -N --idstart=1000 -r <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a><br> >>>>>> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>> -n <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>> -p passwd1<br> >> -a<br> >>>>>> passwd2 --hostname=<a href="http://ldap-server-01.example.com" target="_blank">ldap-server-01.example.com</a><br> >>>>>> <<a href="http://ldap-server-01.example.com" target="_blank">http://ldap-server-01.example.com</a>> --forwarder=10.0.1.20<br> >>>>>> --forwarder=10.0.1.21 --reverse-zone=1.0.10.in-addr.arpa. -d<br> >>>>>><br> >>>>>> Runs through the entire setup and gives me this:<br> >>>>>><br> >>>>>> [...]<br> >>>>>> ipa : DEBUG args=/usr/sbin/ipa-client-install --on-master<br> >>>>>> --unattended --domain <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>> --server<br> >>>>>> <a href="http://ldap-server-01.example.com" target="_blank">ldap-server-01.example.com</a> <<a href="http://ldap-server-01.example.com" target="_blank">http://ldap-server-01.example.com</a>><br> >> --realm<br> >>>>>> <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>> --hostname<br> >> <a href="http://ldap-server-01.example.com" target="_blank">ldap-server-01.example.com</a><br> >>>>>> <<a href="http://ldap-server-01.example.com" target="_blank">http://ldap-server-01.example.com</a>><br> >>>>>> ipa : DEBUG stdout=<br> >>>>>><br> >>>>>> ipa : DEBUG stderr=Hostname: <a href="http://ldap-server-01.example.com" target="_blank">ldap-server-01.example.com</a><br> >>>>>> <<a href="http://ldap-server-01.example.com" target="_blank">http://ldap-server-01.example.com</a>><br> >>>>>> Realm: <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> <<a href="http://EXAMPLE.COM" target="_blank">http://EXAMPLE.COM</a>><br> >>>>>> DNS Domain: <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>><br> >>>>>> IPA Server: <a href="http://ldap-server-01.example.com" target="_blank">ldap-server-01.example.com</a> <<br> >>>> <a href="http://ldap-server-01.example.com" target="_blank">http://ldap-server-01.example.com</a>><br> >>>>>> BaseDN: dc=example,dc=com<br> >>>>>> New SSSD config will be created<br> >>>>>> Configured /etc/sssd/sssd.conf<br> >>>>>> Traceback (most recent call last):<br> >>>>>> File "/usr/sbin/ipa-client-install", line 2377, in <module><br> >>>>>> sys.exit(main())<br> >>>>>> File "/usr/sbin/ipa-client-install", line 2363, in main<br> >>>>>> rval = install(options, env, fstore, statestore)<br> >>>>>> File "/usr/sbin/ipa-client-install", line 2135, in install<br> >>>>>> delete_persistent_client_session_data(host_principal)<br> >>>>>> File "/usr/lib/python2.6/site-packages/ipalib/rpc.py", line 124, in<br> >>>>>> delete_persistent_client_session_data<br> >>>>>> kernel_keyring.del_key(keyname)<br> >>>>>> File "/usr/lib/python2.6/site-packages/ipapython/kernel_keyring.py",<br> >>>> line<br> >>>>>> 99, in del_key<br> >>>>>> real_key = get_real_key(key)<br> >>>>>> File "/usr/lib/python2.6/site-packages/ipapython/kernel_keyring.py",<br> >>>> line<br> >>>>>> 45, in get_real_key<br> >>>>>> (stdout, stderr, rc) = run(['keyctl', 'search', KEYRING, KEYTYPE,<br> >>>> key],<br> >>>>>> raiseonerr=False)<br> >>>>><br> >>>>> Is keyctl installed? Can you run it manually?<br> >>>>> Any SELinux denials?<br> >>>><br> >>>> You are likely hitting<br> >>>> <a href="https://fedorahosted.org/freeipa/ticket/3808" target="_blank">https://fedorahosted.org/freeipa/ticket/3808</a><br> >>>><br> >>>> Please try installing keyutils before running ipa-server-install. It is<br> >>>> fixed<br> >>>> in RHEL-7, I filed us a RHEL-6 ticket, to fix it in this platform also:<br> >>>> <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1205660" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=1205660</a><br> >>>><br> >>>> Martin<br> >>>><br> >>>> --<br> >>>> Manage your subscription for the Freeipa-users mailing list:<br> >>>> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> >>>> Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br> >>>><br> >>><br> >><br> >><br> ><br> <br> </div></div></blockquote></div><br></div>