<div dir="ltr">Installed FreeIPA 4.2 on a fresh CentOS 7.2. After initial setup and configuration a one way trust was added to windows AD. Server was shut down and moved to a different rack. When it was started back up IPA no longer runs. <div><br></div><div><div><div>ipa-admintools.x86_64 4.2.0-15.0.1.el7.centos.19</div><div>ipa-client.x86_64 4.2.0-15.0.1.el7.centos.19</div><div>ipa-python.x86_64 4.2.0-15.0.1.el7.centos.19</div><div>ipa-server.x86_64 4.2.0-15.0.1.el7.centos.19</div><div>ipa-server-dns.x86_64 4.2.0-15.0.1.el7.centos.19</div><div>ipa-server-trust-ad.x86_64 4.2.0-15.0.1.el7.centos.19</div><div>libipa_hbac.x86_64 1.13.0-40.el7_2.12</div><div>python-iniparse.noarch 0.4-9.el7</div><div>python-libipa_hbac.x86_64 1.13.0-40.el7_2.12</div><div>sssd-ipa.x86_64 1.13.0-40.el7_2.12</div></div><div><br></div><div>In the service list IPA, polkit. postfix, and smb service are currently failed. kadmin is also failed sometimes, however I'm able to start it occasionally without explanation.</div><div><br></div><div><div>running IPA restart results in the following error:</div><div><br></div><div><div>[root@SERVER ~]# ipactl restart</div><div>Starting Directory Service</div><div>Stopping pki-tomcatd Service</div><div>Restarting krb5kdc Service</div><div>Restarting kadmin Service</div><div>Restarting named Service</div><div>Restarting ipa_memcached Service</div><div>Restarting httpd Service</div><div>Restarting pki-tomcatd Service</div><div>Starting smb Service</div><div>Job for smb.service failed because the control process exited with error code. See "systemctl status smb.service" and "journalctl -xe" for details.</div><div>Failed to start smb Service</div><div>Shutting down</div><div>Aborting ipactl</div></div><div><br></div><div>Checking the SMB service I get the following</div><div><br></div><div><div>[root@SERVER ~]# systemctl status smb</div><div>● smb.service - Samba SMB Daemon</div><div> Loaded: loaded (/usr/lib/systemd/system/smb.service; disabled; vendor preset: disabled)</div><div> Active: failed (Result: exit-code) since Wed 2016-09-28 17:15:50 EDT; 43s ago</div><div> Process: 7186 ExecStart=/usr/sbin/smbd $SMBDOPTIONS (code=exited, status=1/FAILURE)</div><div> Main PID: 7186 (code=exited, status=1/FAILURE)</div><div> Status: "Starting process..."</div><div><br></div><div>Sep 28 17:15:49 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> smbd[7186]: [2016/09/28 17:15:49.718669, 0] ipa_sam.c:4208(bind_callback_cleanup)</div><div>Sep 28 17:15:49 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> smbd[7186]: kerberos error: code=-1765328203, message=Keytab contains no suitable keys for cifs/<a href="mailto:SERVER.SUB.DOMAIN.COM@SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM@SUB.DOMAIN.COM</a></div><div>Sep 28 17:15:50 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> smbd[7186]: [2016/09/28 17:15:50.718869, 0] ipa_sam.c:4520(pdb_init_ipasam)</div><div>Sep 28 17:15:50 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> smbd[7186]: Failed to get base DN.</div><div>Sep 28 17:15:50 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> smbd[7186]: [2016/09/28 17:15:50.718900, 0] ../source3/passdb/pdb_interface.c:179(make_pdb_method_name)</div><div>Sep 28 17:15:50 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> smbd[7186]: pdb backend ipasam:ldapi://%2fvar%2frun%2fslapd-SUB.DOMAIN.COM.socket did not correctly init (error was NT_STATUS_UNSUCCESSFUL)</div><div>Sep 28 17:15:50 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> systemd[1]: smb.service: main process exited, code=exited, status=1/FAILURE</div><div>Sep 28 17:15:50 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> systemd[1]: Failed to start Samba SMB Daemon.</div><div>Sep 28 17:15:50 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> systemd[1]: Unit smb.service entered failed state.</div><div>Sep 28 17:15:50 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> systemd[1]: smb.service failed.</div></div><div><br></div><div><br></div><div>I had issues when first trying to add one way trust with SMB but I was able to restart the service and move forward. That doesn't appear to be happening this time. I've also tried using kinit to obtain a ticket but that doesn't work. I'm not sure if that should work at this juncture or not. After restarting ipa the kadmin service also fails to start some of the time.</div></div><div><br></div><div>if kadmin is running</div><div>=======================</div><div><div>[root@SERVER ~]# kinit -V admin</div><div>Using default cache: persistent:0:0</div><div>Using principal: <a href="mailto:admin@SUB.DOMAIN.COM">admin@SUB.DOMAIN.COM</a></div><div>kinit: Generic error (see e-text) while getting initial credentials</div></div><div><br></div><div><br></div><div>if kadmin isn't running</div><div>=======================</div><div><div>[root@SERVER ~]# kinit -V admin</div><div>Using default cache: persistent:0:0</div><div>Using principal: <a href="mailto:admin@SUB.DOMAIN.COM">admin@SUB.DOMAIN.COM</a></div><div>kinit: Cannot contact any KDC for realm '<a href="http://SUB.DOMAIN.COM">SUB.DOMAIN.COM</a>' while getting initial credentials</div></div><div><br></div><div><br></div><div>Attempts to get kadmin to run</div><div>=======================</div><div><div>[root@SERVER ~]# systemctl start kadmin</div><div>Job for kadmin.service failed because the control process exited with error code. See "systemctl status kadmin.service" and "journalctl -xe" for details.</div></div><div><br></div><div><br></div><div>Journal for kadmin attempt</div><div>======================</div><div><div>-- Subject: Unit kadmin.service has begun start-up</div><div>-- Defined-By: systemd</div><div>-- Support: <a href="http://lists.freedesktop.org/mailman/listinfo/systemd-devel">http://lists.freedesktop.org/mailman/listinfo/systemd-devel</a></div><div>--</div><div>-- Unit kadmin.service has begun starting up.</div><div>Sep 28 17:22:38 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> _kadmind[7978]: kadmind: kadmind: Server error while initializing, aborting</div><div>Sep 28 17:22:38 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> systemd[1]: kadmin.service: control process exited, code=exited status=1</div><div>Sep 28 17:22:38 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> systemd[1]: Failed to start Kerberos 5 Password-changing and Administration.</div><div>-- Subject: Unit kadmin.service has failed</div><div>-- Defined-By: systemd</div><div>-- Support: <a href="http://lists.freedesktop.org/mailman/listinfo/systemd-devel">http://lists.freedesktop.org/mailman/listinfo/systemd-devel</a></div><div>--</div><div>-- Unit kadmin.service has failed.</div><div>--</div><div>-- The result is failed.</div><div>Sep 28 17:22:38 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> systemd[1]: Unit kadmin.service entered failed state.</div><div>Sep 28 17:22:38 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> systemd[1]: kadmin.service failed.</div><div>Sep 28 17:22:38 <a href="http://SERVER.SUB.DOMAIN.COM">SERVER.SUB.DOMAIN.COM</a> polkitd[6092]: Unregistered Authentication Agent for unix-process:7973:9203783 (system bus name :1.639, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (dis</div></div><div><br></div><div><br></div><div><br></div></div></div>