<div class="gmail_quote">On Wed, Jul 31, 2013 at 11:09 AM, KodaK <<a href="mailto:sakodak@gmail.com" target="_blank">sakodak@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div class="im">On Wed, Jul 31, 2013 at 6:56 AM, Sumit Bose <<a href="mailto:sbose@redhat.com" target="_blank">sbose@redhat.com</a>> wrote: > I think that's the issue. You have to make sure that <a href="http://host.domain.com" target="_blank">host.domain.com</a> has > a DNS entry somewhere, it does not have to be the IPA DNS but the DNS > setup must be correct so the IPA DNS can forward the request to the > right server. Then you can call 'ipa host-add <a href="http://host.domain.com" target="_blank">host.domain.com</a>' which > will create a host entry with the principal > host/<a href="mailto:host.domain.com@UNIX.DOMAIN.COM" target="_blank">host.domain.com@UNIX.DOMAIN.COM</a>. Now you can call ipa-getkeytab and > transfer the new keytab to <a href="http://host.domain.com" target="_blank">host.domain.com</a>. </div>Ok, I'm dumbfounded (again.) I've removed the old host from IPA: xxx@slpidml01 ~]$ ipa host-show <a href="http://sla400q1.unix.domain.com" target="_blank">sla400q1.unix.domain.com</a> ipa: INFO: trying <a href="https://slpidml01.unix.domain.com/ipa/session/xml" target="_blank">https://slpidml01.unix.domain.com/ipa/session/xml</a> ipa: INFO: Forwarding 'host_show' to server u'<a href="https://slpidml01.unix.domain.com/ipa/session/xml" target="_blank">https://slpidml01.unix.domain.com/ipa/session/xml</a>' ipa: ERROR: <a href="http://sla400q1.unix.domain.com" target="_blank">sla400q1.unix.domain.com</a>: host not found And I added the new host: [xxx@slpidml01 ~]$ ipa host-show <a href="http://sla400q1.domain.com" target="_blank">sla400q1.domain.com</a> ipa: INFO: trying <a href="https://slpidml01.unix.domain.com/ipa/xml" target="_blank">https://slpidml01.unix.domain.com/ipa/xml</a> ipa: INFO: Forwarding 'host_show' to server u'<a href="https://slpidml01.unix.domain.com/ipa/xml" target="_blank">https://slpidml01.unix.domain.com/ipa/xml</a>' Host name: <a href="http://sla400q1.domain.com" target="_blank">sla400q1.domain.com</a> Principal name: host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> Password: False Keytab: True Managed by: <a href="http://sla400q1.domain.com" target="_blank">sla400q1.domain.com</a> I generated the keytab: [xxx@slpidml01 ~]$ ipa-getkeytab -s <a href="http://slpidml01.unix.domain.com" target="_blank">slpidml01.unix.domain.com</a> -p host/<a href="http://sla400q1.domain.com" target="_blank">sla400q1.domain.com</a> -k /tmp/sla400q1.keytabKeytab successfully retrieved and stored in: /tmp/sla400q1.keytab [xxx@slpidml01 ~]$ Then I copied that keytab to the host and put it in /etc/krb5/krb5.keytab But, when I list the principals in the keytab: sla400q1:/var/adm> /usr/krb5/bin/klist -k -e Keytab name: FILE:/etc/krb5/krb5.keytabKVNO Principal ---- --------- 1 host/<a href="mailto:sla400q1.unix.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.unix.domain.com@UNIX.DOMAIN.COM</a> (AES-256 CTS mode with 96-bit SHA-1 HMAC) 1 host/<a href="mailto:sla400q1.unix.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.unix.domain.com@UNIX.DOMAIN.COM</a> (AES-128 CTS mode with 96-bit SHA-1 HMAC) 1 host/<a href="mailto:sla400q1.unix.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.unix.domain.com@UNIX.DOMAIN.COM</a> (Triple DES cbc mode with HMAC/sha1) 1 host/<a href="mailto:sla400q1.unix.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.unix.domain.com@UNIX.DOMAIN.COM</a> (ArcFour with HMAC/md5) 2 host/<a href="mailto:sla400q1.unix.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.unix.domain.com@UNIX.DOMAIN.COM</a> (AES-256 CTS mode with 96-bit SHA-1 HMAC) 2 host/<a href="mailto:sla400q1.unix.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.unix.domain.com@UNIX.DOMAIN.COM</a> (AES-128 CTS mode with 96-bit SHA-1 HMAC) 2 host/<a href="mailto:sla400q1.unix.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.unix.domain.com@UNIX.DOMAIN.COM</a> (Triple DES cbc mode with HMAC/sha1) 2 host/<a href="mailto:sla400q1.unix.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.unix.domain.com@UNIX.DOMAIN.COM</a> (ArcFour with HMAC/md5) 1 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (AES-256 CTS mode with 96-bit SHA-1 HMAC) 1 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (AES-128 CTS mode with 96-bit SHA-1 HMAC) 1 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (Triple DES cbc mode with HMAC/sha1) 1 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (ArcFour with HMAC/md5) 2 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (AES-256 CTS mode with 96-bit SHA-1 HMAC) 2 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (AES-128 CTS mode with 96-bit SHA-1 HMAC) 2 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (Triple DES cbc mode with HMAC/sha1) 2 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (ArcFour with HMAC/md5) 3 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (AES-256 CTS mode with 96-bit SHA-1 HMAC) 3 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (AES-128 CTS mode with 96-bit SHA-1 HMAC) 3 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (Triple DES cbc mode with HMAC/sha1) 3 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (ArcFour with HMAC/md5) 4 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (AES-256 CTS mode with 96-bit SHA-1 HMAC) 4 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (AES-128 CTS mode with 96-bit SHA-1 HMAC) 4 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (Triple DES cbc mode with HMAC/sha1) 4 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (ArcFour with HMAC/md5) 5 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (AES-256 CTS mode with 96-bit SHA-1 HMAC) 5 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (AES-128 CTS mode with 96-bit SHA-1 HMAC) 5 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (Triple DES cbc mode with HMAC/sha1) 5 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (ArcFour with HMAC/md5) 6 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (AES-256 CTS mode with 96-bit SHA-1 HMAC) 6 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (AES-128 CTS mode with 96-bit SHA-1 HMAC) 6 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (Triple DES cbc mode with HMAC/sha1) 6 host/<a href="mailto:sla400q1.domain.com@UNIX.DOMAIN.COM" target="_blank">sla400q1.domain.com@UNIX.DOMAIN.COM</a> (ArcFour with HMAC/md5) Where are the <a href="http://sla400q1.unix.domain.com" target="_blank">sla400q1.unix.domain.com</a> coming from? I've done this over and over, I can't find any reference to <a href="http://sla400q1.unix.domain.com" target="_blank">sla400q1.unix.domain.com</a> in DNS in IPA, and the box never had any <a href="http://unix.comain.com" target="_blank">unix.comain.com</a> references. In addition, I’m still getting the error: <div class="im"> Miscellaneous failure\nNo principal in keytab matches desired name\n </div>in the logs, even though: sla400q1:/var/adm> grep sla400q1 /etc/hosts 192.168.42.108 sla400q1-bk #10.200.5.48 <a href="http://sla400q1.domain.com" target="_blank">sla400q1.domain.com</a> sla400q1 10.200.5.48 <a href="http://sla400q1.domain.com" target="_blank">sla400q1.domain.com</a> sla400q1 sla400q1:/var/adm> hostname <a href="http://sla400q1.domain.com" target="_blank">sla400q1.domain.com</a> sla400q1:/var/adm> domainname<a href="http://domain.com" target="_blank">domain.com</a> sla400q1:/var/adm> Any clues?<div> </div> </blockquote></div> forgot to add:<div> </div><div><div>sla400q1:/var/adm> nslookup 10.200.5.48</div><div>Server: 10.200.2.24</div><div>Address: 10.200.2.24#53</div><div> </div><div>48.5.200.10.in-addr.arpa name = <a href="http://SLA400Q1.domain.com">SLA400Q1.domain.com</a>.</div> <div> </div><div> </div><div> </div>-- The government is going to read our mail anyway, might as well make it tough for them. GPG Public key ID: B6A1A7C6 </div>