Chris Mohler via FreeIPA-users wrote: > Here are some fresh errors. With the correct domain.com > > [root@ipa1 user]# systemctl start dirsrv@CS-OBERLIN-EDU httpd krb5kdc > pki-tomcatd@pki-tomcat > Job for krb5kdc.service failed because the control process exited with > error code. See "systemctl status krb5kdc.service" and "journalctl -xe" > for details. > > [root@ipa1 user]# systemctl status krb5kdc.service > ● krb5kdc.service - Kerberos 5 KDC > Loaded: loaded (/usr/lib/systemd/system/krb5kdc.service; disabled; > vendor preset: disabled) > Active: failed (Result: exit-code) since Thu 2018-12-20 11:29:39 EST; > 20s ago > Process: 6328 ExecStart=/usr/sbin/krb5kdc -P /var/run/krb5kdc.pid > $KRB5KDC_ARGS (code=exited, status=1/FAILURE)
The KDC didn't start. The log is in /var/log/krb5kdc.log Rather than starting everything on one line I suppose it would be better to start dirsrv, wait for it to settle down, then one by one start the other services. rob > > Dec 20 11:29:39 ipa1.cs.oberlin.edu systemd[1]: Starting Kerberos 5 KDC... > Dec 20 11:29:39 ipa1.cs.oberlin.edu krb5kdc[6328]: krb5kdc: cannot > initialize realm CS.OBERLIN.EDU - see log file for details > Dec 20 11:29:39 ipa1.cs.oberlin.edu systemd[1]: krb5kdc.service: control > process exited, code=exited status=1 > Dec 20 11:29:39 ipa1.cs.oberlin.edu systemd[1]: Failed to start Kerberos > 5 KDC. > Dec 20 11:29:39 ipa1.cs.oberlin.edu systemd[1]: Unit krb5kdc.service > entered failed state. > Dec 20 11:29:39 ipa1.cs.oberlin.edu systemd[1]: krb5kdc.service failed. > > > [root@ipa1 user]# journalctl -xe > Dec 20 11:29:44 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:44.896674586 -0500] - ERR - NSACLPlugin - acl_parse - > The ACL target cn=vaults,cn=kra,dc=cs,dc=oberlin,dc=edu does not exist > Dec 20 11:29:44 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:44.899381296 -0500] - ERR - NSACLPlugin - acl_parse - > The ACL target cn=vaults,cn=kra,dc=cs,dc=oberlin,dc=edu does not exist > Dec 20 11:29:44 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:44.903264399 -0500] - ERR - NSACLPlugin - acl_parse - > The ACL target cn=ad,cn=etc,dc=cs,dc=oberlin,dc=edu does not exist > Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:45.040709963 -0500] - ERR - NSACLPlugin - acl_parse - > The ACL target cn=automember rebuild membership,cn=tasks,cn=config does > Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:45.048762794 -0500] - ERR - cos-plugin - > cos_dn_defs_cb - Skipping CoS Definition cn=Password > Policy,cn=accounts,dc=cs,dc=ober > Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:45.100326075 -0500] - ERR - set_krb5_creds - Could > not get initial credentials for principal [ldap/[email protected] > Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:45.111839823 -0500] - INFO - slapd_daemon - slapd > started. Listening on All Interfaces port 389 for LDAP requests > Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1 > Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1 > Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:45.117194087 -0500] - INFO - slapd_daemon - Listening > on All Interfaces port 636 for LDAPS requests > Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI Error: > Unspecified GSS failure. Minor code may provide more information (No > Kerberos credentials available (default cache: /tmp/krb5cc_38 > Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:45.119103939 -0500] - INFO - slapd_daemon - Listening > on /var/run/slapd-CS-OBERLIN-EDU.socket for LDAPI requests > Dec 20 11:29:45 ipa1.cs.oberlin.edu systemd[1]: Started 389 Directory > Server CS-OBERLIN-EDU.. > -- Subject: Unit [email protected] has finished start-up > -- Defined-By: systemd > -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel > -- > -- Unit [email protected] has finished starting up. > -- > -- The start-up result is done. > Dec 20 11:29:45 ipa1.cs.oberlin.edu polkitd[3318]: Unregistered > Authentication Agent for unix-process:6321:1000965 (system bus name > :1.37, object path /org/freedesktop/PolicyKit1/AuthenticationAgen > Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:45.143848383 -0500] - ERR - slapi_ldap_bind - Error: > could not send startTLS request: error -1 (Can't contact LDAP server) err > Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:45.146250152 -0500] - ERR - NSMMReplicationPlugin - > bind_and_check_pwp - agmt="cn=masterAgreement1-ipa.cs.oberlin.edu-pki-tomc > Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:45.221754444 -0500] - ERR - schema-compat-plugin - > schema-compat-plugin tree scan will start in about 5 seconds! > Dec 20 11:29:48 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:48.233735556 -0500] - ERR - set_krb5_creds - Could > not get initial credentials for principal [ldap/[email protected] > Dec 20 11:29:48 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:48.240356284 -0500] - ERR - slapi_ldap_bind - Error: > could not send startTLS request: error -1 (Can't contact LDAP server) err > Dec 20 11:29:48 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1 > Dec 20 11:29:48 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1 > Dec 20 11:29:48 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI Error: > Unspecified GSS failure. Minor code may provide more information (No > Kerberos credentials available (default cache: /tmp/krb5cc_38 > Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: WARNING: Exception > processing realm com.netscape.cms.tomcat.ProxyRealm@20492fd8 background > process > Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: > javax.ws.rs.ServiceUnavailableException: Subsystem unavailable > Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at > com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137) > Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at > org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356) > > Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at > org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958) > > Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542) > > Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552) > > Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552) > > Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520) > > Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at > java.lang.Thread.run(Thread.java:748) > Dec 20 11:29:51 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:51.176732756 -0500] - ERR - schema-compat-plugin - > warning: no entries set up under cn=computers, cn=compat,dc=cs,dc=oberlin,d > Dec 20 11:29:51 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:51.179418586 -0500] - ERR - schema-compat-plugin - > Finished plugin initialization. > Dec 20 11:29:54 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:54.250696593 -0500] - ERR - set_krb5_creds - Could > not get initial credentials for principal [ldap/[email protected] > Dec 20 11:29:54 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:29:54.257694833 -0500] - ERR - slapi_ldap_bind - Error: > could not send startTLS request: error -1 (Can't contact LDAP server) err > Dec 20 11:29:54 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1 > Dec 20 11:29:54 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1 > Dec 20 11:29:54 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI Error: > Unspecified GSS failure. Minor code may provide more information (No > Kerberos credentials available (default cache: /tmp/krb5cc_38 > Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: WARNING: Exception > processing realm com.netscape.cms.tomcat.ProxyRealm@20492fd8 background > process > Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: > javax.ws.rs.ServiceUnavailableException: Subsystem unavailable > Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at > com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137) > Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at > org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356) > > Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at > org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958) > > Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542) > > Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552) > > Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552) > > Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520) > > Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at > java.lang.Thread.run(Thread.java:748) > Dec 20 11:30:06 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:30:06.269784404 -0500] - ERR - set_krb5_creds - Could > not get initial credentials for principal [ldap/[email protected] > Dec 20 11:30:06 ipa1.cs.oberlin.edu ns-slapd[6334]: > [20/Dec/2018:11:30:06.278382823 -0500] - ERR - slapi_ldap_bind - Error: > could not send startTLS request: error -1 (Can't contact LDAP server) err > Dec 20 11:30:06 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1 > Dec 20 11:30:06 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1 > Dec 20 11:30:06 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI Error: > Unspecified GSS failure. Minor code may provide more information (No > Kerberos credentials available (default cache: /tmp/krb5cc_38 > [root@ipa1 user]# > > KRb Log > Dec 20 11:31:18 ipa1 ns-slapd: [20/Dec/2018:11:31:18.366362542 -0500] - > ERR - set_krb5_creds - Could not get initial credentials for principal > [ldap/[email protected]] in keytab > [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for > requested realm) > Dec 20 11:31:18 ipa1 ns-slapd: [20/Dec/2018:11:31:18.373255123 -0500] - > ERR - slapi_ldap_bind - Error: could not send startTLS request: error -1 > (Can't contact LDAP server) errno 107 (Transport endpoint is not connected) > Dec 20 11:31:18 ipa1 ns-slapd: GSSAPI Error: Unspecified GSS failure. > Minor code may provide more information (No Kerberos credentials > available (default cache: /tmp/krb5cc_389)) > Dec 20 11:31:21 ipa1 server: WARNING: Exception processing realm > com.netscape.cms.tomcat.ProxyRealm@20492fd8 background process > Dec 20 11:31:21 ipa1 server: javax.ws.rs.ServiceUnavailableException: > Subsystem unavailable > Dec 20 11:31:21 ipa1 server: at > com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137) > Dec 20 11:31:21 ipa1 server: at > org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356) > > Dec 20 11:31:21 ipa1 server: at > org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958) > > Dec 20 11:31:21 ipa1 server: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542) > > Dec 20 11:31:21 ipa1 server: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552) > > Dec 20 11:31:21 ipa1 server: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552) > > Dec 20 11:31:21 ipa1 server: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520) > > Dec 20 11:31:21 ipa1 server: at java.lang.Thread.run(Thread.java:748) > Dec 20 11:31:31 ipa1 server: WARNING: Exception processing realm > com.netscape.cms.tomcat.ProxyRealm@20492fd8 background process > Dec 20 11:31:31 ipa1 server: javax.ws.rs.ServiceUnavailableException: > Subsystem unavailable > Dec 20 11:31:31 ipa1 server: at > com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137) > Dec 20 11:31:31 ipa1 server: at > org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356) > > Dec 20 11:31:31 ipa1 server: at > org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958) > > Dec 20 11:31:31 ipa1 server: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542) > > Dec 20 11:31:31 ipa1 server: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552) > > Dec 20 11:31:31 ipa1 server: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552) > > Dec 20 11:31:31 ipa1 server: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520) > > Dec 20 11:31:31 ipa1 server: at java.lang.Thread.run(Thread.java:748) > > dirserv log > Feb 13 09:11:57 ipa1.cs.oberlin.edu krb5kdc[4246](info): IPA certauth > plugin un-loaded. > krb5kdc: Server error - while fetching master key K/M for realm > CS.OBERLIN.EDU > krb5kdc: Server error - while fetching master key K/M for realm > CS.OBERLIN.EDU > krb5kdc: Server error - while fetching master key K/M for realm > CS.OBERLIN.EDU > (END) > > systemctl restart certmonger > Dec 20 11:28:11 ipa1 systemd: Stopping Certificate monitoring and PKI > enrollment... > Dec 20 11:28:11 ipa1 systemd: Stopped Certificate monitoring and PKI > enrollment. > Dec 20 11:28:11 ipa1 systemd: Starting Certificate monitoring and PKI > enrollment... > Dec 20 11:28:12 ipa1 systemd: Started Certificate monitoring and PKI > enrollment. > Dec 20 11:28:21 ipa1 server: WARNING: Exception processing realm > com.netscape.cms.tomcat.ProxyRealm@43df7c0 background process > Dec 20 11:28:21 ipa1 server: javax.ws.rs.ServiceUnavailableException: > Subsystem unavailable > Dec 20 11:28:21 ipa1 server: at > com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137) > Dec 20 11:28:21 ipa1 server: at > org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356) > > Dec 20 11:28:21 ipa1 server: at > org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958) > > Dec 20 11:28:21 ipa1 server: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542) > > Dec 20 11:28:21 ipa1 server: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552) > > Dec 20 11:28:21 ipa1 server: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552) > > Dec 20 11:28:21 ipa1 server: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520) > > Dec 20 11:28:21 ipa1 server: at java.lang.Thread.run(Thread.java:748) > > getcert list: > [root@ipa1 user]# getcert list > Number of certificates and requests being tracked: 9. > Request ID '20180131032610': > status: CA_UNREACHABLE > ca-error: Internal error > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU > subject: CN=CA Audit,O=CS.OBERLIN.EDU > expires: 2018-12-31 13:28:03 UTC > key usage: digitalSignature,nonRepudiation > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "auditSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20180131032614': > status: CA_UNREACHABLE > ca-error: Internal error > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > cert-pki-ca',token='NSS > Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > cert-pki-ca',token='NSS > Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU > subject: CN=OCSP Subsystem,O=CS.OBERLIN.EDU > expires: 2018-12-31 13:26:43 UTC > eku: id-kp-OCSPSigning > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "ocspSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20180131032615': > status: CA_UNREACHABLE > ca-error: Internal error > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU > subject: CN=CA Subsystem,O=CS.OBERLIN.EDU > expires: 2018-12-31 13:26:53 UTC > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "subsystemCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20180131032616': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU > subject: CN=Certificate Authority,O=CS.OBERLIN.EDU > expires: 2038-12-31 03:18:40 UTC > key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "caSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20180131032623': > status: CA_UNREACHABLE > ca-error: Internal error > stuck: no > key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' > certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU > subject: CN=IPA RA,O=CS.OBERLIN.EDU > expires: 2018-12-31 13:27:15 UTC > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre > post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert > track: yes > auto-renew: yes > Request ID '20180131032624': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU > subject: CN=ipa1.cs.oberlin.edu,O=CS.OBERLIN.EDU > expires: 2019-06-25 15:44:03 UTC > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "Server-Cert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20180131032626': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/dirsrv/slapd-CS-OBERLIN-EDU',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/dirsrv/slapd-CS-OBERLIN-EDU/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/dirsrv/slapd-CS-OBERLIN-EDU',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU > subject: CN=ipa1.cs.oberlin.edu,O=CS.OBERLIN.EDU > expires: 2019-07-06 15:22:41 UTC > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv > CS-OBERLIN-EDU > track: yes > auto-renew: yes > Request ID '20180131032637': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU > subject: CN=ipa1.cs.oberlin.edu,O=CS.OBERLIN.EDU > expires: 2019-07-06 15:22:43 UTC > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/libexec/ipa/certmonger/restart_httpd > track: yes > auto-renew: yes > Request ID '20180131032703': > status: MONITORING > stuck: no > key pair storage: > type=FILE,location='/var/kerberos/krb5kdc/kdc.key' > certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' > CA: SelfSign > issuer: CN=ipa1.cs.oberlin.edu,O=CS.OBERLIN.EDU > subject: CN=ipa1.cs.oberlin.edu,O=CS.OBERLIN.EDU > expires: 2020-02-05 02:11:51 UTC > principal name: krbtgt/[email protected] > certificate template/profile: KDCs_PKINIT_Certs > pre-save command: > post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert > track: yes > auto-renew: yes > > > > > On 2/13/2019 11:20 AM, Rob Crittenden wrote: >> Chris Mohler via FreeIPA-users wrote: >>> Sorry for the delay, It's been busy and I was not able to take the >>> server down for even a few minutes to check. >>> >>> Here is the output from the commands you asked about: >>> >>> [root@ipa1 user]# date >>> Thu Dec 20 11:27:02 EST 2018 >>> [root@ipa1 user]# ipactl stop >>> Stopping ipa-otpd Service >>> Stopping pki-tomcatd Service >>> Stopping ntpd Service >>> Stopping ipa-custodia Service >>> Stopping httpd Service >>> Stopping kadmin Service >>> Stopping krb5kdc Service >>> Stopping Directory Service >>> ipa: INFO: The ipactl command was successful >>> [root@ipa1 user]# systemctl start [email protected] httpd krb5kdc >>> pki-tomcatd@pki-tomcat >>> Job for [email protected] failed because a configured resource >>> limit was exceeded. See "systemctl status [email protected]" and >>> "journalctl -xe" for details. >>> Job for krb5kdc.service failed because the control process exited with >>> error code. See "systemctl status krb5kdc.service" and "journalctl -xe" >>> for details. >>> >>> [root@ipa1 user]# systemctl status [email protected] >>> ● [email protected] - 389 Directory Server domain.com. >>> Loaded: loaded (/usr/lib/systemd/system/[email protected]; enabled; >>> vendor preset: disabled) >>> Active: failed (Result: resources) >> Sorry, that's the wrong service. >> >> systemctl -a |grep dirsrv >> >> Start the one appropriate for your realm. >> >> Without dirsrv nothing else will work so the rest of the errors are >> expected. >> >> rob > _______________________________________________ > FreeIPA-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/[email protected] > _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
