On Tue, 25 Jan 2011 14:33:14 -0500 James Roman <[email protected]> wrote:
> On 01/25/2011 12:42 PM, Simo Sorce wrote: > > On Tue, 25 Jan 2011 12:04:25 -0500 > > James Roman<[email protected]> wrote: > > > >> I noticed today that one of our FreeIPA 1.2.2 servers has stopped > >> issuing tickets. When I attempt to restart all the IPA services the > >> krb5kdc service failed to restart with the following error: > >> > >> krb5kdc: Unable to access Kerberos database - while initializing > >> database for realm DOMAIN.COM > >> > >> I don't see any issues with the local LDAP database, or the kdc > >> account in the LDAP database. I suspect the problem is with the > >> ticket granting ticket on the problem server, but am unsure how to > >> go about validating this assertion. I have not tried to restart > >> the ipa services on the working server for fera that it might stop > >> working. > > Do you see errors in /var/log/krb5kdc.log ? > > > > Simo. > > > The error above is the only one that repeats in the krb5kdc.log when > I attempt to restart the krb5kdc service. The actual error that is > shown in standard out is: > > Starting Kerberos 5 KDC: krb5kdc: cannot initialize realm DOMAIN.COM > - see log file for details Ok can you check the dirsrv logs and see if the KDC is actually trying (and perhaps getting auth refused) at all ? /var/log/dirsrv/slapd-DOMAIN-COM/access should show your KDC attempts to access the LDAP server and bind as the uid=kdc..... user. Simo. -- Simo Sorce * Red Hat, Inc * New York _______________________________________________ Freeipa-users mailing list [email protected] https://www.redhat.com/mailman/listinfo/freeipa-users
