On 20.04.2016 18:00, Gady Notrica wrote:
Hello World,
I am having these errors trying to install ipa-client-install. Every
other machine is fine and they IPA servers are functioning perfectly
Error trying to clean keytab: /usr/sbin/ipa-rmkeytab returned 1
Kerberos authentication failed: kinit: Improper format of Kerberos
configuration file while initializing Kerberos 5 library
Then I have “/Installation failed. Rolling back changes.”/
I have tried everything I know with no luck. Any idea on how to FIX
this? Below is the full log.
-----------------------------------------------------------
/Continue to configure the system with these values? [no]: yes/
/Error trying to clean keytab: /usr/sbin/ipa-rmkeytab returned 1/
/Skipping synchronizing time with NTP server./
/User authorized to enroll computers: admin/
/Password for ad...@ipa.domain.com:/
/Please make sure the following ports are opened in the firewall
settings:/
/TCP: 80, 88, 389/
/UDP: 88 (at least one of TCP/UDP ports 88 has to be open)/
/Also note that following ports are necessary for ipa-client working
properly after enrollment:/
/TCP: 464/
/UDP: 464, 123 (if NTP enabled)/
/Kerberos authentication failed: kinit: Improper format of Kerberos
configuration file while initializing Kerberos 5 library/
//
/Installation failed. Rolling back changes./
/Failed to list certificates in /etc/ipa/nssdb: Command
''/usr/bin/certutil' '-d' '/etc/ipa/nssdb' '-L'' returned non-zero
exit status 255/
/Disabling client Kerberos and LDAP configurations/
/Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to
/etc/sssd/sssd.conf.deleted/
/Restoring client configuration files/
/nscd daemon is not installed, skip configuration/
/nslcd daemon is not installed, skip configuration/
/Client uninstall complete./
/---------------------------------------------------------------/
Gady
Hello,
IMO you have an old invalid keytab on that machine. Can you manually
remove it and try to reinstall client? (Of course only if you are sure
that keytab there is not needed)
The keytab should be located here /etc/krb5.keytab
Martin
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project