Steve Dainard wrote:
Following this guide:

ipa-server-install --setup-dns -p '<password>' -a '<password>' -r
MIOVISION.LINUX -n miovision.linux --hostname ipa1.miovision.linux
--forwarder= --forwarder=

Server host name [ipa1.miovision.linux]:

Warning: skipping DNS resolution of host ipa1.miovision.linux
Unable to resolve IP address for host name
Please provide the IP address to be used for this host name:
Adding [ ipa1.miovision.linux] to your /etc/hosts file
Do you want to configure the reverse zone? [yes]:
Please specify the reverse zone name []:
Using reverse zone

The IPA Master Server will be configured with:
Hostname:      ipa1.miovision.linux
IP address:
Domain name:   miovision.linux
Realm name:    MIOVISION.LINUX

BIND DNS server will be configured to serve IPA domain with:
Reverse zone:

Continue to configure the system with these values? [no]: yes

The following operations may take some minutes to complete.
Please wait until the prompt is returned.

Configuring NTP daemon (ntpd)
   [1/4]: stopping ntpd


Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds
   [1/10]: adding sasl mappings to the directory
   [2/10]: adding kerberos container to the directory
   [3/10]: configuring KDC
   [4/10]: initialize kerberos container
Failed to initialize the realm container
   [5/10]: adding default ACIs
   [6/10]: creating a keytab for the directory
Unexpected error - see /var/log/ipaserver-install.log for details:
CalledProcessError: Command 'kadmin.local -q addprinc -randkey
ldap/ipa1.miovision.linux@MIOVISION.LINUX -x
ipa-setup-override-restrictions' returned non-zero exit status 1


add aci:

3.0; acl "Modify CA Certificates for renewals"; allow(write) userdn =
modifying entry "cn=ipa,cn=etc,dc=miovision,dc=linux"
modify complete

2014-02-04T20:45:51Z DEBUG stderr=ldap_initialize(
ldapi://%2Fvar%2Frun%2Fslapd-MIOVISION-LINUX.socket/??base )

2014-02-04T20:45:51Z DEBUG   duration: 6 seconds
2014-02-04T20:45:51Z DEBUG   [6/10]: creating a keytab for the directory
2014-02-04T20:45:51Z DEBUG args=kadmin.local -q addprinc -randkey
ldap/ipa1.miovision.linux@MIOVISION.LINUX -x ipa-setup-override-restrictions
2014-02-04T20:45:51Z DEBUG stdout=Authenticating as principal
root/admin@MIOVISION.LINUX with password.

2014-02-04T20:45:51Z DEBUG stderr=kadmin.local: No such entry in the
database while initializing kadmin.local interface

2014-02-04T20:45:51Z INFO   File
line 614, in run_script
     return_value = main_function()

   File "/usr/sbin/ipa-server-install", line 1024, in main

line 183, in create_instance

   File "/usr/lib/python2.6/site-packages/ipaserver/install/",
line 358, in start_creation

line 386, in __create_ds_keytab

line 369, in kadmin_addprinc
     kadmin("addprinc -randkey " + principal)

line 366, in kadmin
     "-x", "ipa-setup-override-restrictions"])

   File "/usr/lib/python2.6/site-packages/ipapython/", line
316, in run
     raise CalledProcessError(p.returncode, args)

2014-02-04T20:45:51Z INFO The ipa-server-install command failed,
exception: CalledProcessError: Command 'kadmin.local -q addprinc
-randkey ldap/ipa1.miovision.linux@MIOVISION.LINUX -x
ipa-setup-override-restrictions' returned non-zero exit status 1

Steve sent me the logs out-of-band. I think the problem is an earlier failure after generating the master key:

2014-02-04T20:45:45Z DEBUG args=kdb5_util create -s -r MIOVISION.LINUX -x ipa-setup-override-restrictions
2014-02-04T20:45:45Z DEBUG stdout=Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'MIOVISION.LINUX',
master key name 'K/M@MIOVISION.LINUX'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:

2014-02-04T20:45:45Z DEBUG stderr=kdb5_util: add.c:124: ldap_add_ext: Assertion `ld != ((void *)0)' failed.

What version of krb5_server is installed? Does /var/log/messages indicate a segfault? Are there any failures in /var/log/dirsrv/slapd-MIOVISION-LINUX/errors?


Freeipa-users mailing list

Reply via email to