On 01/06/2018 08:51 PM, lejeczek via FreeIPA-users wrote: > > hi everyone > > I'm trying a client, when I do: > > $ ipa-client-install --no-ntp --force-join > Discovery was successful! > ... > Also note that following ports are necessary for > ipa-client working properly after enrollment: >       TCP: 464 >       UDP: 464, 123 (if NTP enabled) > Failed to obtain host TGT: Major (851968): Unspecified > GSS failure. Minor code may provide more information, > Minor (2529638936): Preauthentication failed > Installation failed. Rolling back changes. > -- end > > At server's end(one single server in domain): > .. > Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560685](info): closing down fd 11 > Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560686](info): AS_REQ (8 etypes {18 17 20 19 16 > 23 25 26}) 10.5.6.17: NEEDED_PREAUTH: > host/dzien.priv.xx.xx.priv.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x > for > krbtgt/PRIVATE.xx.xx.PRIVATE.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x, > Additional pre-authentication required > Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560686](info): closing down fd 11 > Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560686](info): preauth (encrypted_timestamp) > verify failure: Preauthentication failed > Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560686](info): AS_REQ (8 etypes {18 17 20 19 16 > 23 25 26}) 10.5.6.17: PREAUTH_FAILED: > host/dzien.priv.xx.xx.priv.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x > for > krbtgt/PRIVATE.xx.xx.PRIVATE.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x, > Preauthentication failed > Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560686](info): closing down fd 11 > Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560681](info): AS_REQ (8 etypes {18 17 20 19 16 > 23 25 26}) 10.5.6.17: NEEDED_PREAUTH: > admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x for > krbtgt/PRIVATE.xx.xx.PRIVATE.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x, > Additional pre-authentication required > Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560681](info): closing down fd 11 > Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560686](info): AS_REQ (8 etypes {18 17 20 19 16 > 23 25 26}) 10.5.6.17: ISSUE: authtime 1515250943, etypes > {rep=18 tkt=18 ses=18}, > admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x for > krbtgt/PRIVATE.xx.xx.PRIVATE.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x > > Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560686](info): closing down fd 11 > Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560686](info): TGS_REQ (8 etypes {18 17 20 19 16 > 23 25 26}) 10.5.6.17: ISSUE: authtime 1515250943, etypes > {rep=18 tkt=18 ses=18}, > admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x for > ldap/swir.priv.xx.xx.priv.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x > > Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560686](info): closing down fd 11 > Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x > krb5kdc[1560686](info): TGS_REQ (8 etypes {18 17 20 19 16 > 23 25 26}) 10.5.6.17: ISSUE: authtime 1515250943, etypes > {rep=18 tkt=18 ses=18}, > admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x for > HTTP/swir.priv.xx.xx.priv.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x > > -- end > > But after many tries(randomly) suddenly it would succeed. > Client said to use  --force-join. > VERSION: 4.5.0, API_VERSION: 2.228 > > What can a problem? > > regards, L. > _______________________________________________ > FreeIPA-users mailing list -- > freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org Hi, what is the content of /etc/krb5.conf on your client? Does it contain "includedir /etc/krb5.conf.d/" and if it is the case, what is the content of the included files? During the client installation, a temp krb5.conf is created and also contains "includedir /etc/krb5.conf.d/". If there are snippets in this directory which define parameters for the IPA realm, then the parameters might be conflicting with the ones needed by the installer. Flo

lejeczek via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt; writes: > $ ipa-client-install --no-ntp --force-join > > krb5kdc[1560686](info): preauth (encrypted_timestamp) verify > failure: Preauthentication failed > > But after many tries(randomly) suddenly it would succeed. Do the clocks match on the client and server? Thanks, --Robbie

On 08/01/18 08:46, Florence Blanc-Renaud wrote: > On 01/06/2018 08:51 PM, lejeczek via FreeIPA-users wrote: >> >> $ ipa-client-install --no-ntp --force-join >> Discovery was successful! >> ... >> Also note that following ports are necessary for >> ipa-client working properly after enrollment: >>       TCP: 464 >>       UDP: 464, 123 (if NTP enabled) >> Failed to obtain host TGT: Major (851968): Unspecified >> GSS failure. Minor code may provide more information, >> Minor (2529638936): Preauthentication failed >> Installation failed. Rolling back changes. >> -- end >> >> At server's end(one single server in domain): >> .. >> Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560685](info): closing down fd 11 >> Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560686](info): AS_REQ (8 etypes {18 17 20 19 16 >> 23 25 26}) 10.5.6.17: NEEDED_PREAUTH: >> host/dzien.priv.xx.xx.priv.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x >> for >> krbtgt/PRIVATE.xx.xx.PRIVATE.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x, >> Additional pre-authentication required >> Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560686](info): closing down fd 11 >> Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560686](info): preauth (encrypted_timestamp) >> verify failure: Preauthentication failed >> Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560686](info): AS_REQ (8 etypes {18 17 20 19 16 >> 23 25 26}) 10.5.6.17: PREAUTH_FAILED: >> host/dzien.priv.xx.xx.priv.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x >> for >> krbtgt/PRIVATE.xx.xx.PRIVATE.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x, >> Preauthentication failed >> Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560686](info): closing down fd 11 >> Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560681](info): AS_REQ (8 etypes {18 17 20 19 16 >> 23 25 26}) 10.5.6.17: NEEDED_PREAUTH: >> admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x for >> krbtgt/PRIVATE.xx.xx.PRIVATE.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x, >> Additional pre-authentication required >> Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560681](info): closing down fd 11 >> Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560686](info): AS_REQ (8 etypes {18 17 20 19 16 >> 23 25 26}) 10.5.6.17: ISSUE: authtime 1515250943, etypes >> {rep=18 tkt=18 ses=18}, >> admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x for >> krbtgt/PRIVATE.xx.xx.PRIVATE.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x >> >> Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560686](info): closing down fd 11 >> Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560686](info): TGS_REQ (8 etypes {18 17 20 19 16 >> 23 25 26}) 10.5.6.17: ISSUE: authtime 1515250943, etypes >> {rep=18 tkt=18 ses=18}, >> admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x for >> ldap/swir.priv.xx.xx.priv.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x >> >> Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560686](info): closing down fd 11 >> Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x >> krb5kdc[1560686](info): TGS_REQ (8 etypes {18 17 20 19 16 >> 23 25 26}) 10.5.6.17: ISSUE: authtime 1515250943, etypes >> {rep=18 tkt=18 ses=18}, >> admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x for >> HTTP/swir.priv.xx.xx.priv.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x >> >> -- end >> >> But after many tries(randomly) suddenly it would succeed. >> Client said to use  --force-join. >> VERSION: 4.5.0, API_VERSION: 2.228 > > what is the content of /etc/krb5.conf on your client? Does > it contain "includedir /etc/krb5.conf.d/" and if it is the > case, what is the content of the included files? > > During the client installation, a temp krb5.conf is > created and also contains "includedir /etc/krb5.conf.d/". > If there are snippets in this directory which define > parameters for the IPA realm, then the parameters might be > conflicting with the ones needed by the installer. I try to make sure that I do clean re-install, thus I do first: $ yum remove -y `rpm -qa ipa* 389*` pki-base krb5-pkinit krb5-server krb5-workstation ipa-python certmonger then I install IPA, at this point there is already a /etc/krb5.conf.d/ipa-certauth created, before any -install is run, but there is no "include" in /etc/krb5.conf.

In /etc/krb5.conf.d/ipa-certauth [plugins]  certauth = {   module = ipakdb:kdb/ipadb.so   enable_only = ipakdb  } So, should I remove that /etc/krb5.conf.d/ipa-certauth before client installation? I did, even then client installation fails the same way. Like I said(maybe most importantly), it would suddenly(randomly?) succeed after a number of tries - why?

Probably one thing I should mention: I have a IPA domain/realm already on the network. I've set up another separate server(master fist) for the same domain and now I'm trying to install a client to that new "stand-alone" server. (details on reason of doing something this weird I'd not go into just yet)

As I understand it, because it's all in DNS, the fact that there are two servers/replicas separately, should not matter to the client candidate which via dns/resolver sees only the new server, the "stand-alone" I point the client to. Installation of that new "stand-alone" server went okey. Client candidate resolves all bits okey. To check, I've also tried --domain= --server --realm, it fails the same way. A the moment a have no means to try another box/system to try as a client to rule out, see, if the network is the culprit here(but how could it be if everything else, in terms of net communication, works fine between "stand-alone" and client candidate.

On 06/01/18 19:51, lejeczek via FreeIPA-users wrote: > Failed to obtain host TGT: Major (851968): Unspecified GSS failure. > Minor code may provide more information, Minor (2529638936): > Preauthentication failed hi guys, I hit that error again. What I noticed is - on that candidate client when I changed resolver to look only at 127.0.0.1(which was not running) and used --server & --domain (thus essentially no dns) then client installation succeeded. Would that be just a coincidence and DNS plays no role at this stage?