[Freeipa-users] Solaris 10 client configuration using profile
sipazzo at yahoo.com
Wed Oct 29 00:00:41 UTC 2014
I only have ldap defined in nsswitch.conf for passwd and group, ipnodes and host correctly reference dns. The fact that I get an SSL initialization failed: error -8174 (security library: bad database) when performing an ldapsearch with the -ZZ option seems to indicate that there is something wrong with the .db files. I have tried uninitializing the client, regenerating the .db files and re-copying them to the server but having same errors.
On Tue, 10/28/14, Rob Crittenden <rcritten at redhat.com> wrote:
Subject: Re: [Freeipa-users] Solaris 10 client configuration using profile
To: "sipazzo" <sipazzo at yahoo.com>, "Freeipa-users at redhat.com" <Freeipa-users at redhat.com>
Date: Tuesday, October 28, 2014, 3:29 PM
Rob Crittenden wrote:
> sipazzo wrote:
Yes I did generate the database on the IPA server and copied
it over. I thought that was what the instructions indicated
> So NSS is
not known for the greatest error messages. The error
SEC_ERROR_LEGACY_DATABASE, can happen for any number of
> including there being no
database at all or there is a database but the
> wrong version. So using native tools was a
shot in the dark.
truss might be of some help here to figure out what it is
trying to open.
/etc/nsswitch.conf. I'll bet you've got ldap defined
service. If so, this is the
What you need to do
is edit /etc/nsswitch.ldap and replace at least
hosts and ipnodes with:
hosts: files dns
ipnodes: files dns
Now, to back out what you've done, I'd
/etc/nsswitch.conf and do the above hosts & inodes
- ldapclient -v uninit
- edit /etc/nsswitch.ldap and fix it up
- re-run ldapclient -v init <options>
That should do the trick. It
did for me anyway.
that the BZ instructions have that openssl PEM conversion
That isn't necessary as the CA is
already in PEM format.
More information about the Freeipa-users