<div dir="ltr"><div>Hi Rob,</div><div> </div><div>Yes, sssd is running and this is sssd.conf:</div><div> </div><div>[domain/<a href="http://hq.example.com">hq.example.com</a>]</div><div>debug_level=9</div><div>cache_credentials = True</div><div>krb5_store_password_if_offline = True</div><div>ipa_domain = <a href="http://hq.example.com">hq.example.com</a></div><div>id_provider = ipa</div><div>auth_provider = ipa</div><div>access_provider = ipa</div><div>ipa_hostname = meson.hq.example.com</div><div>chpass_provider = ipa</div><div>ipa_server = _srv_, ipa.hq.example.com</div><div>ldap_tls_cacert = /etc/ipa/ca.crt</div><div>[sssd]</div><div>services = nss, sudo, pam, ssh</div><div>config_file_version = 2</div><div> </div><div>domains = hq.example.com</div><div>[nss]</div><div>homedir_substring = /home</div><div>debug_level=9</div><div> </div><div>[pam]</div><div> </div><div>[sudo]</div><div> </div><div>[autofs]</div><div> </div><div>[ssh]</div><div> </div><div>[pac]</div><div> </div><div>[ifp]</div><div> </div></div><div class="gmail_extra"> <div class="gmail_quote">On 21 March 2015 at 17:05, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Roberto Cornacchia wrote: > Indeed, id admin does not work and there is no sign of it in the log. > > From the client (with admin-tools installed): > > $ kinit admin > Password for <a href="mailto:admin@HQ.EXAMPLE.COM">admin@HQ.EXAMPLE.COM</a> <mailto:<a href="mailto:admin@HQ.EXAMPLE.COM">admin@HQ.EXAMPLE.COM</a>>: > $ ipa user-show admin > User login: admin > Last name: Administrator > Home directory: /home/admin > Login shell: /bin/bash > UID: 1172000000 > GID: 1172000000 > Account disabled: False > Password: True > Member of groups: trust admins, admins > Kerberos keys available: True > $ id admin > id: admin: no such user > $ getent passwd <a href="mailto:admin@hq.spinque.com">admin@hq.spinque.com</a> <mailto:<a href="mailto:admin@hq.spinque.com">admin@hq.spinque.com</a>> > $ grep admin /var/log/sssd/* > $ This is because sssd is not configured in nsswitch.conf to serve anything other than sudo. I see in the client install log you posted in the first message of the thread that there was no pre-existing sssd.conf so it created a new one, but that shouldn't be an issue. What does sssd.conf look like and is sssd running? rob > > > On 21 March 2015 at 01:01, Dmitri Pal <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a> > <mailto:<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>>> wrote: > > On 03/20/2015 07:40 PM, Roberto Cornacchia wrote: >> Two log files in attachment (the other files in /var/log/sssd are >> all empty). >> >> I'll also go through the troubleshooting page again, thanks >> > > Do the logs include an id call for admin? > I do not see any instance of the word "admin" in the log. > > >> >> On 20 March 2015 at 23:03, Dmitri Pal <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a> >> <mailto:<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>>> wrote: >> >> On 03/20/2015 05:59 PM, Roberto Cornacchia wrote: >>> SSSD logs are empty so far. >> >> This is wrong. >> >>> Isn't sssd.conf written by ipa-client-install? >> >> Yes >> >>> If I raise the debug level after client installation, >> >> (and restart) >> >>> what activities do you suggest to attempt from the client? >> the ones that fail. getent call that returns nothing. >> Also try 'id'. >> >> <a href="http://www.freeipa.org/page/Troubleshooting#Client_Installation" target="_blank">http://www.freeipa.org/page/Troubleshooting#Client_Installation</a> >> <a href="https://fedorahosted.org/sssd/wiki/Troubleshooting" target="_blank">https://fedorahosted.org/sssd/wiki/Troubleshooting</a> >> >>> >>> >>> On 20 March 2015 at 22:37, Dmitri Pal <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a> >>> <mailto:<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>>> wrote: >>> >>> On 03/20/2015 05:28 PM, Roberto Cornacchia wrote: >>>> It certainly gets there, because the client gets in fact >>>> enrolled as a domain host. I can see it from the UI in >>>> Identity / Hosts. But not in the DNS zone. >>>> >>>> *Before ipa-client-install, all these do work: * >>>> >>>> $ ssh <a href="http://ipa.hq.example.com" target="_blank">ipa.hq.example.com</a> <<a href="http://ipa.hq.example.com" target="_blank">http://ipa.hq.example.com</a>> >>>> $ ntpdate <a href="http://ipa.hq.example.com" target="_blank">ipa.hq.example.com</a> <<a href="http://ipa.hq.example.com" target="_blank">http://ipa.hq.example.com</a>> >>>> $ ldapsearch -x -h <a href="http://ipa.hq.example.com" target="_blank">ipa.hq.example.com</a> >>>> <<a href="http://ipa.hq.example.com" target="_blank">http://ipa.hq.example.com</a>> -b dc=hq,dc=example,dc=com >>>> uid=admin >>>> >>>> >>>> *After running ipa-client-install, all these do work:* >>>> >>>> $ kinit admin >>>> Password for <a href="mailto:admin@HQ.EXAMPLE.COM">admin@HQ.EXAMPLE.COM</a> >>>> <mailto:<a href="mailto:admin@HQ.EXAMPLE.COM">admin@HQ.EXAMPLE.COM</a>>: >>>> $ ipa dnszone-show --all >>>> [...] >>>> $ ntpq -p >>>> remote refid st t when poll reach >>>> delay offset jitter >>>> ============================================================================== >>>> *ipa.hq.example. 131.155.140.130 3 u 19 64 1 >>>> 0.415 -0.006 0.000 >>>> LOCAL(0) .LOCL. 5 l - 64 0 >>>> 0.000 0.000 0.000 >>>> >>>> *But this does NOT work:* >>>> $ getent passwd <a href="mailto:admin@hq.example.com">admin@hq.example.com</a> >>>> <mailto:<a href="mailto:admin@hq.example.com">admin@hq.example.com</a>> >>> >>> What do SSSD logs show on the client? >>> Please rise the SSSD debug_level and provide SSSD logs. >>> >>>> >>>> *On the server, in /var/log/krb5kdc.log, I see many of >>>> these:* >>>> >>>> Mar 20 21:53:17 <a href="http://ipa.hq.example.com" target="_blank">ipa.hq.example.com</a> >>>> <<a href="http://ipa.hq.example.com" target="_blank">http://ipa.hq.example.com</a>> krb5kdc[9229](info): AS_REQ >>>> (6 etypes {18 17 16 23 25 26}) 192.168.0.207 >>>> <<a href="http://192.168.0.207" target="_blank">http://192.168.0.207</a>>: NEEDED_PREAUTH: >>>> <a href="mailto:admin@HQ.EXAMPLE.COM">admin@HQ.EXAMPLE.COM</a> <mailto:<a href="mailto:admin@HQ.EXAMPLE.COM">admin@HQ.EXAMPLE.COM</a>> for >>>> krbtgt/<a href="mailto:HQ.EXAMPLE.COM@HQ.EXAMPLE.COM">HQ.EXAMPLE.COM@HQ.EXAMPLE.COM</a> >>>> <mailto:<a href="mailto:COM@HQ.EXAMPLE.COM">COM@HQ.EXAMPLE.COM</a>>, Additional >>>> pre-authentication required >>>> Mar 20 21:53:17 <a href="http://ipa.hq.example.com" target="_blank">ipa.hq.example.com</a> >>>> <<a href="http://ipa.hq.example.com" target="_blank">http://ipa.hq.example.com</a>> krb5kdc[9229](info): AS_REQ >>>> (6 etypes {18 17 16 23 25 26}) 192.168.0.207 >>>> <<a href="http://192.168.0.207" target="_blank">http://192.168.0.207</a>>: ISSUE: authtime 1426884797, >>>> etypes {rep=18 tkt=18 ses=18}, <a href="mailto:admin@HQ.EXAMPLE.COM">admin@HQ.EXAMPLE.COM</a> >>>> <mailto:<a href="mailto:admin@HQ.EXAMPLE.COM">admin@HQ.EXAMPLE.COM</a>> for >>>> krbtgt/<a href="mailto:HQ.EXAMPLE.COM@HQ.EXAMPLE.COM">HQ.EXAMPLE.COM@HQ.EXAMPLE.COM</a> >>>> <mailto:<a href="mailto:HQ.EXAMPLE.COM@HQ.EXAMPLE.COM">HQ.EXAMPLE.COM@HQ.EXAMPLE.COM</a>> >>> >>> This is not an error. It is a normal user authentication. >>> OK so it is DNS that is not working. Is DNS server >>> running on the server? >>> What do Bind logs show? >>> >>> >>>> >>>> 192.168.0.207 is the IP of the client I'm trying to >>>> install. However, higher up in the log, I also see such >>>> errors for the ipa server itself. >>>> >>>> On 20 March 2015 at 20:24, Dmitri Pal <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a> >>>> <mailto:<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>>> wrote: >>>> >>>> On 03/20/2015 02:48 PM, Roberto Cornacchia wrote: >>>>> No, all real machines. >>>>> >>>>> I'm really sorry it's taking so much of your time. >>>>> I had tried almost everything on a VM setting >>>>> first, and everything was fine. >>>>> Everything always works fine, until you actually >>>>> need it. >>>> >>>> >>>> We try to help as much as we can. >>>> Can you do LDAP lookups as a directory manager from >>>> client host to server? >>>> Can you ssh from client to server? >>>> >>>> When you try to install client is there anything in >>>> the logs on the server? Does it even get there? >>>> >>>> >>>> >>>> >>>>> >>>>> >>>>> On 20 March 2015 at 19:41, Dmitri Pal >>>>> <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a> <mailto:<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>>> wrote: >>>>> >>>>> On 03/20/2015 01:57 PM, Roberto Cornacchia wrote: >>>>>> But the ipa server itself is also enrolled as >>>>>> a client, just after the server installation, >>>>>> right?. And that worked fine. >>>>> >>>>> Are these VMs? >>>>> There have been a similar case when the network >>>>> was not set properly for the virtual test >>>>> environment. >>>>> >>>>> >>>>>> >>>>>> On 20 March 2015 at 18:55, Roberto Cornacchia >>>>>> <<a href="mailto:roberto.cornacchia@gmail.com">roberto.cornacchia@gmail.com</a> >>>>>> <mailto:<a href="mailto:roberto.cornacchia@gmail.com">roberto.cornacchia@gmail.com</a>>> wrote: >>>>>> >>>>>> No, sorry about the confusion, i shouldn't >>>>>> have posted so quickly. >>>>>> >>>>>> When I use the correct domain >>>>>> (<a href="http://hq.example.com" target="_blank">hq.example.com</a> <<a href="http://hq.example.com" target="_blank">http://hq.example.com</a>>), >>>>>> then I really get all the same errors as >>>>>> before, also in the new client. >>>>>> >>>>>> >>>>>> >>>>>> On 20 Mar 2015 18:39, "Dmitri Pal" >>>>>> <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a> <mailto:<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>>> >>>>>> wrote: >>>>>> >>>>>> On 03/20/2015 01:25 PM, Roberto >>>>>> Cornacchia wrote: >>>>>>> Oops. Not true, forget last email. >>>>>>> >>>>>>> This secon client installation went >>>>>>> different just because it took the >>>>>>> wrong domain. >>>>>>> It used *<a href="http://example.com" target="_blank">example.com</a> >>>>>>> <<a href="http://example.com" target="_blank">http://example.com</a>>* (what was >>>>>>> previously set) instead of >>>>>>> *<a href="http://hq.example.com" target="_blank">hq.example.com</a> <<a href="http://hq.example.com" target="_blank">http://hq.example.com</a>>* >>>>>>> >>>>>>> Uninstalled, tried again with >>>>>>> --hostname=<a href="http://photon.hq.example.com" target="_blank">photon.hq.example.com</a> >>>>>>> <<a href="http://photon.hq.example.com" target="_blank">http://photon.hq.example.com</a>> >>>>>>> And then it behaves precisely like >>>>>>> the previous client. >>>>>>> >>>>>>> So something seems wrong in the server. >>>>>>> >>>>>>> On 20 March 2015 at 18:18, Roberto >>>>>>> Cornacchia >>>>>>> <<a href="mailto:roberto.cornacchia@gmail.com">roberto.cornacchia@gmail.com</a> <div><div class="h5">>>>>>>> <mailto:<a href="mailto:roberto.cornacchia@gmail.com">roberto.cornacchia@gmail.com</a>>> wrote: >>>>>>> >>>>>>> Update: >>>>>>> I tried from another client. Also >>>>>>> FC21, same network, same settings >>>>>>> from the same DHCP. >>>>>>> But obviously it must have >>>>>>> something different because it >>>>>>> partially succeeded. >>>>>>> >>>>>>> - I do not get errors about LDAP >>>>>>> users. >>>>>>> - I do not get errors about DNS >>>>>>> update >>>>>>> >>>>>>> However: >>>>>>> - I still get the initial error >>>>>>> about NTP >>>>>>> - The host is enrolled, but not >>>>>>> added to the DNS zone >>>>>>> >>>>>>> Now, I don't care much about the >>>>>>> previous client. It was pretty >>>>>>> much empty and can re-install >>>>>>> Fedora from scratch. >>>>>>> >>>>>>> But I'd like to understand if >>>>>>> this is still a problem. >>>>>>> It should be added to the zone, >>>>>>> shouldn't it? >>>>>>> >>>>>>> $ ipa-client-install --mkhomedir >>>>>>> --ssh-trust-dns --force-ntpd >>>>>>> Discovery was successful! >>>>>>> Hostname: <a href="http://photon.example.com" target="_blank">photon.example.com</a> </div></div>>>>>>>> <<a href="http://photon.example.com" target="_blank">http://photon.example.com</a>> >>>>>>> Realm: <a href="http://HQ.EXAMPLE.COM" target="_blank">HQ.EXAMPLE.COM</a> >>>>>>> <<a href="http://HQ.EXAMPLE.COM" target="_blank">http://HQ.EXAMPLE.COM</a>> >>>>>>> DNS Domain: <a href="http://hq.example.com" target="_blank">hq.example.com</a> >>>>>>> <<a href="http://hq.example.com" target="_blank">http://hq.example.com</a>> >>>>>>> IPA Server: <a href="http://ipa.hq.example.com" target="_blank">ipa.hq.example.com</a> >>>>>>> <<a href="http://ipa.hq.example.com" target="_blank">http://ipa.hq.example.com</a>> >>>>>>> BaseDN: dc=hq,dc=example,dc=com >>>>>>> >>>>>>> Continue to configure the system >>>>>>> with these values? [no]: yes >>>>>>> Synchronizing time with KDC... >>>>>>> *Unable to sync time with IPA NTP >>>>>>> server, assuming the time is in >>>>>>> sync. Please check that 123 UDP >>>>>>> port is opened.* >>>>>>> User authorized to enroll >>>>>>> computers: admin >>>>>>> Password for <a href="mailto:admin@HQ.EXAMPLE.COM">admin@HQ.EXAMPLE.COM</a> >>>>>>> <mailto:<a href="mailto:admin@HQ.EXAMPLE.COM">admin@HQ.EXAMPLE.COM</a>>: >>>>>>> Successfully retrieved CA cert >>>>>>> Subject: CN=Certificate >>>>>>> Authority,O=<a href="http://HQ.EXAMPLE.COM" target="_blank">HQ.EXAMPLE.COM</a> >>>>>>> <<a href="http://HQ.EXAMPLE.COM" target="_blank">http://HQ.EXAMPLE.COM</a>> >>>>>>> Issuer: CN=Certificate >>>>>>> Authority,O=<a href="http://HQ.EXAMPLE.COM" target="_blank">HQ.EXAMPLE.COM</a> >>>>>>> <<a href="http://HQ.EXAMPLE.COM" target="_blank">http://HQ.EXAMPLE.COM</a>> >>>>>>> Valid From: Mon Mar 16 >>>>>>> 18:44:35 2015 UTC >>>>>>> Valid Until: Fri Mar 16 >>>>>>> 18:44:35 2035 UTC >>>>>>> >>>>>>> Enrolled in IPA realm >>>>>>> <a href="http://HQ.EXAMPLE.COM" target="_blank">HQ.EXAMPLE.COM</a> >>>>>>> <<a href="http://HQ.EXAMPLE.COM" target="_blank">http://HQ.EXAMPLE.COM</a>> >>>>>>> Created /etc/ipa/default.conf >>>>>>> New SSSD config will be created >>>>>>> Configured sudoers in >>>>>>> /etc/nsswitch.conf >>>>>>> Configured /etc/sssd/sssd.conf >>>>>>> Configured /etc/krb5.conf for IPA >>>>>>> realm <a href="http://HQ.EXAMPLE.COM" target="_blank">HQ.EXAMPLE.COM</a> >>>>>>> <<a href="http://HQ.EXAMPLE.COM" target="_blank">http://HQ.EXAMPLE.COM</a>> >>>>>>> trying >>>>>>> <a href="https://ipa.hq.example.com/ipa/json" target="_blank">https://ipa.hq.example.com/ipa/json</a> >>>>>>> Forwarding 'ping' to json server >>>>>>> '<a href="https://ipa.hq.example.com/ipa/json" target="_blank">https://ipa.hq.example.com/ipa/json</a>' >>>>>>> Forwarding 'ca_is_enabled' to >>>>>>> json server >>>>>>> '<a href="https://ipa.hq.example.com/ipa/json" target="_blank">https://ipa.hq.example.com/ipa/json</a>' >>>>>>> Systemwide CA database updated. >>>>>>> Added CA certificates to the >>>>>>> default NSS database. >>>>>>> Adding SSH public key from >>>>>>> /etc/ssh/ssh_host_rsa_key.pub >>>>>>> Adding SSH public key from >>>>>>> /etc/ssh/ssh_host_ed25519_key.pub >>>>>>> Adding SSH public key from >>>>>>> /etc/ssh/ssh_host_dsa_key.pub >>>>>>> Adding SSH public key from >>>>>>> /etc/ssh/ssh_host_ecdsa_key.pub >>>>>>> Forwarding 'host_mod' to json >>>>>>> server >>>>>>> '<a href="https://ipa.hq.example.com/ipa/json" target="_blank">https://ipa.hq.example.com/ipa/json</a>' >>>>>>> *Could not update DNS SSHFP records.* >>>>>>> SSSD enabled >>>>>>> Configured /etc/openldap/ldap.conf >>>>>>> NTP enabled >>>>>>> Configured /etc/ssh/ssh_config >>>>>>> Configured /etc/ssh/sshd_config >>>>>>> Configuring <a href="http://hq.example.com" target="_blank">hq.example.com</a> >>>>>>> <<a href="http://hq.example.com" target="_blank">http://hq.example.com</a>> as NIS <div class="HOEnZb"><div class="h5">>>>>>>> domain. >>>>>>> Client configuration complete. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>>> It is different. It does not have the >>>>>> same failure about admin as you had in >>>>>> the first email. >>>>>> So may be it is the permissions issue >>>>>> and a separate NTP issue? >>>>>> Did you play with any permissions on >>>>>> the server side? >>>>>> >>>>>> >>>>>> -- >>>>>> Thank you, >>>>>> Dmitri Pal >>>>>> >>>>>> Sr. Engineering Manager IdM portfolio >>>>>> Red Hat, Inc. >>>>>> >>>>>> >>>>>> -- >>>>>> Manage your subscription for the >>>>>> Freeipa-users mailing list: >>>>>> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> >>>>>> Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info >>>>>> on the project >>>>>> >>>>>> >>>>>> >>>>>> >>>>> >>>>> >>>>> -- >>>>> Thank you, >>>>> Dmitri Pal >>>>> >>>>> Sr. Engineering Manager IdM portfolio >>>>> Red Hat, Inc. >>>>> >>>>> >>>>> -- >>>>> Manage your subscription for the Freeipa-users >>>>> mailing list: >>>>> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> >>>>> Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the >>>>> project >>>>> >>>>> >>>>> >>>>> >>>> >>>> >>>> -- >>>> Thank you, >>>> Dmitri Pal >>>> >>>> Sr. Engineering Manager IdM portfolio >>>> Red Hat, Inc. >>>> >>>> >>>> -- >>>> Manage your subscription for the Freeipa-users >>>> mailing list: >>>> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> >>>> Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project >>>> >>>> >>>> >>>> >>> >>> >>> -- >>> Thank you, >>> Dmitri Pal >>> >>> Sr. Engineering Manager IdM portfolio >>> Red Hat, Inc. >>> >>> >>> -- >>> Manage your subscription for the Freeipa-users mailing list: >>> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> >>> Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project >>> >>> >>> >>> >> >> >> -- >> Thank you, >> Dmitri Pal >> >> Sr. Engineering Manager IdM portfolio >> Red Hat, Inc. >> >> >> -- >> Manage your subscription for the Freeipa-users mailing list: >> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> >> Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project >> >> >> >> > > > -- > Thank you, > Dmitri Pal > > Sr. Engineering Manager IdM portfolio > Red Hat, Inc. > > > -- > Manage your subscription for the Freeipa-users mailing list: > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> > Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project > > > > </div></div></blockquote></div> </div>