7:04 p.m.
Hello,
Thank you all for help in past, as I'm keep encountering one after another issue.
Sorry for long email, as posting log. let me know if there is other way.
IPA Server OS: CentOS Linux release 7.0.1406 (Core)
IPA Server RPM: ipa-server-4.4.0-14.el7.centos.7.x86_64
Client OS: CentOS Linux release 7.3.1611 (Core)
IPA client RPM: ipa-client-4.5.0-21.el7.centos.1.2.x86_64 (as well as
ipa-client-4.4.0-14.el7.centos.7.x86_64)
I'm not able to enroll new client recently, and getting following message:
Enrolled in IPA realm EXAMPLE.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm EXAMPLE.COM
trying https://ds01.example.com/ipa/json
[try 1]: Forwarding 'schema' to json server
'https://ds01.example.com/ipa/json'
trying https://ds01.example.com/ipa/session/json
[try 1]: Forwarding 'ping' to json server
'https://ds01.example.com/ipa/session/json'
[try 1]: Forwarding 'ca_is_enabled' to json server
'https://ds01.example.com/ipa/session/json'
Installation failed. Force set so not rolling back changes.
Failed to add EXAMPLE.COM IPA CA to the IPA NSS database.
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more
information
The ipa-client-install.log is:
2017-10-05T23:34:37Z DEBUG Logging to /var/log/ipaclient-install.log
2017-10-05T23:34:37Z DEBUG ipa-client-install was invoked with arguments [] and options:
{'no_dns_sshfp': False, 'force': True, 'verbose': False,
'ip_addresses': None, 'configure_firefox': False, 'realm_name':
None, 'force_ntpd': False, 'on_master': False, 'no_nisdomain':
False, 'ssh_trust_dns': False, 'principal': None, 'keytab': None,
'no_ntp': False, 'domain_name': None, 'request_cert': False,
'fixed_primary': False, 'no_ac': False, 'no_sudo': False,
'ca_cert_files': None, 'all_ip_addresses': False,
'kinit_attempts': None, 'ntp_servers': None, 'enable_dns_updates':
False, 'no_sshd': False, 'no_sssd': False,
'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh':
False, 'force_join': False, 'firefox_dir': None, 'unattended':
False, 'quiet': False, 'nisdomain': None, 'prompt_password':
False, 'host_name': None, 'permit': False, 'automount_location':
None, 'preserve_sssd': False, 'mkhomedir': False, 'log_file':
None, 'uninstall': False}
2017-10-05T23:34:37Z DEBUG IPA version 4.5.0-21.el7.centos.1.2
2017-10-05T23:34:37Z DEBUG Loading Index file from
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:37Z DEBUG Starting external process
2017-10-05T23:34:37Z DEBUG args=/usr/sbin/selinuxenabled
2017-10-05T23:34:37Z DEBUG Process finished, return code=1
2017-10-05T23:34:37Z DEBUG stdout=
2017-10-05T23:34:37Z DEBUG stderr=
2017-10-05T23:34:37Z DEBUG Starting external process
2017-10-05T23:34:37Z DEBUG args=/bin/systemctl is-enabled chronyd.service
2017-10-05T23:34:37Z DEBUG Process finished, return code=0
2017-10-05T23:34:37Z DEBUG stdout=enabled
2017-10-05T23:34:37Z DEBUG stderr=
2017-10-05T23:34:37Z DEBUG [IPA Discovery]
2017-10-05T23:34:37Z DEBUG Starting IPA discovery with domain=None, servers=None,
hostname=groc-5.example.com
2017-10-05T23:34:37Z DEBUG Start searching for LDAP SRV record in "example.com"
(domain of the hostname) and its sub-domains
2017-10-05T23:34:37Z DEBUG Search DNS for SRV record of _ldap._tcp.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ipa01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds02.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds03.example.com.
2017-10-05T23:34:37Z DEBUG [Kerberos realm search]
2017-10-05T23:34:37Z DEBUG Search DNS for TXT record of _kerberos.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: "EXAMPLE.COM"
2017-10-05T23:34:37Z DEBUG Search DNS for SRV record of _kerberos._udp.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ipa01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ds01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ds03.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ds02.example.com.
2017-10-05T23:34:37Z DEBUG [LDAP server check]
2017-10-05T23:34:37Z DEBUG Verifying that ds01.example.com (realm EXAMPLE.COM) is an IPA
server
2017-10-05T23:34:37Z DEBUG Init LDAP connection to: ldap://ds01.example.com:389
2017-10-05T23:34:37Z DEBUG Search LDAP server for IPA base DN
2017-10-05T23:34:37Z DEBUG Check if naming context 'dc=example,dc=com' is for IPA
2017-10-05T23:34:37Z DEBUG Naming context 'dc=example,dc=com' is a valid IPA
context
2017-10-05T23:34:37Z DEBUG Search for (objectClass=krbRealmContainer) in dc=example,dc=com
(sub)
2017-10-05T23:34:37Z DEBUG Found: cn=EXAMPLE.COM,cn=kerberos,dc=example,dc=com
2017-10-05T23:34:37Z DEBUG Discovery result: Success; server=ds01.example.com,
domain=example.com,
kdc=ipa01.example.com,ds01.example.com,ds03.example.com,ds02.example.com,
basedn=dc=example,dc=com
2017-10-05T23:34:37Z DEBUG Validated servers: ds01.example.com
2017-10-05T23:34:37Z DEBUG will use discovered domain: example.com
2017-10-05T23:34:37Z DEBUG Start searching for LDAP SRV record in "example.com"
(Validating DNS Discovery) and its sub-domains
2017-10-05T23:34:37Z DEBUG Search DNS for SRV record of _ldap._tcp.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ipa01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds02.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds03.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds01.example.com.
2017-10-05T23:34:37Z DEBUG DNS validated, enabling discovery
2017-10-05T23:34:37Z DEBUG will use discovered server: ds01.example.com
2017-10-05T23:34:37Z INFO Discovery was successful!
2017-10-05T23:34:37Z DEBUG will use discovered realm: EXAMPLE.COM
2017-10-05T23:34:37Z DEBUG will use discovered basedn: dc=example,dc=com
2017-10-05T23:34:37Z INFO Client hostname: groc-5.example.com
2017-10-05T23:34:37Z DEBUG Hostname source: Machine's FQDN
2017-10-05T23:34:37Z INFO Realm: EXAMPLE.COM
2017-10-05T23:34:37Z DEBUG Realm source: Discovered from LDAP DNS records in
ds01.example.com
2017-10-05T23:34:37Z INFO DNS Domain: example.com
2017-10-05T23:34:37Z DEBUG DNS Domain source: Discovered LDAP SRV records from example.com
(domain of the hostname)
2017-10-05T23:34:37Z INFO IPA Server: ds01.example.com
2017-10-05T23:34:37Z DEBUG IPA Server source: Discovered from LDAP DNS records in
ds01.example.com
2017-10-05T23:34:37Z INFO BaseDN: dc=example,dc=com
2017-10-05T23:34:37Z DEBUG BaseDN source: From IPA server ldap://ds01.example.com:389
2017-10-05T23:34:39Z DEBUG Loading Index file from
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:39Z DEBUG Loading StateFile from
'/var/lib/ipa-client/sysrestore/sysrestore.state'
2017-10-05T23:34:39Z DEBUG Starting external process
2017-10-05T23:34:39Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r EXAMPLE.COM
2017-10-05T23:34:39Z DEBUG Process finished, return code=5
2017-10-05T23:34:39Z DEBUG stdout=
2017-10-05T23:34:39Z DEBUG stderr=realm not found
2017-10-05T23:34:39Z INFO Skipping synchronizing time with NTP server.
2017-10-05T23:34:41Z DEBUG will use principal provided as option: admin
2017-10-05T23:34:41Z DEBUG Starting external process
2017-10-05T23:34:41Z DEBUG args=keyctl get_persistent @s 0
2017-10-05T23:34:41Z DEBUG Process finished, return code=0
2017-10-05T23:34:41Z DEBUG stdout=218715285
2017-10-05T23:34:41Z DEBUG stderr=
2017-10-05T23:34:41Z DEBUG Enabling persistent keyring CCACHE
2017-10-05T23:34:41Z DEBUG Writing Kerberos configuration to /tmp/tmpVCsDCR:
2017-10-05T23:34:41Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
EXAMPLE.COM = {
kdc = ds01.example.com:88
master_kdc = ds01.example.com:88
admin_server = ds01.example.com:749
kpasswd_server = ds01.example.com:464
default_domain = example.com
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
groc-5.example.com = EXAMPLE.COM
2017-10-05T23:34:45Z DEBUG Initializing principal
admin@EXAMPLE.COM<mailto:admin@EXAMPLE.COM> using password
2017-10-05T23:34:45Z DEBUG Starting external process
2017-10-05T23:34:45Z DEBUG args=/usr/bin/kinit
admin@EXAMPLE.COM<mailto:admin@EXAMPLE.COM> -c /tmp/krbccbP9vNK/ccache
2017-10-05T23:34:45Z DEBUG Process finished, return code=0
2017-10-05T23:34:45Z DEBUG stdout=Password for
admin@EXAMPLE.COM<mailto:admin@EXAMPLE.COM>:
2017-10-05T23:34:45Z DEBUG stderr=
2017-10-05T23:34:45Z DEBUG trying to retrieve CA cert via LDAP from ds01.example.com
2017-10-05T23:34:45Z DEBUG retrieving schema for SchemaCache
url=ldap://ds01.example.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at
0x2c25ea8>
2017-10-05T23:34:45Z INFO Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2014-08-03 19:28:18
Valid Until: 2034-08-03 19:28:18
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-05-30 00:17:28
Valid Until: 2037-05-30 00:17:28
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-05-30 00:19:13
Valid Until: 2037-05-30 00:19:13
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-05-30 00:38:33
Valid Until: 2037-05-30 00:38:33
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-06-01 12:55:08
Valid Until: 2037-06-01 12:55:08
2017-10-05T23:34:45Z DEBUG Starting external process
2017-10-05T23:34:45Z DEBUG args=/usr/sbin/ipa-join -s ds01.example.com -b
dc=example,dc=com -h groc-5.example.com
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=Failed to parse result: Failed to decode GetKeytab
Control.
Retrying with pre-4.0 keytab retrieval method...
Failed to retrieve encryption type Camellia-128 CTS mode with CMAC (#25)
Failed to retrieve encryption type Camellia-256 CTS mode with CMAC (#26)
Keytab successfully retrieved and stored in: /etc/krb5.keytab
Certificate subject base is: O=EXAMPLE.COM
2017-10-05T23:34:47Z INFO Enrolled in IPA realm EXAMPLE.COM
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=kdestroy
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Initializing principal
host/groc-5.example.com@EXAMPLE.COM<mailto:host/groc-5.example.com@EXAMPLE.COM>
using keytab /etc/krb5.keytab
2017-10-05T23:34:47Z DEBUG using ccache /etc/ipa/.dns_ccache
2017-10-05T23:34:47Z DEBUG Attempt 1/5: success
2017-10-05T23:34:47Z DEBUG Backing up system configuration file
'/etc/ipa/default.conf'
2017-10-05T23:34:47Z DEBUG -> Not backing up - '/etc/ipa/default.conf'
doesn't exist
2017-10-05T23:34:47Z INFO Created /etc/ipa/default.conf
2017-10-05T23:34:47Z DEBUG Backing up system configuration file
'/etc/sssd/sssd.conf'
2017-10-05T23:34:47Z DEBUG -> Not backing up - '/etc/sssd/sssd.conf'
doesn't exist
2017-10-05T23:34:47Z INFO New SSSD config will be created
2017-10-05T23:34:47Z DEBUG Backing up system configuration file
'/etc/nsswitch.conf'
2017-10-05T23:34:47Z DEBUG Saving Index File to
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:47Z INFO Configured sudoers in /etc/nsswitch.conf
2017-10-05T23:34:47Z INFO Configured /etc/sssd/sssd.conf
2017-10-05T23:34:47Z DEBUG Backing up system configuration file '/etc/krb5.conf'
2017-10-05T23:34:47Z DEBUG Saving Index File to
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=keyctl get_persistent @s 0
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=218715285
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Enabling persistent keyring CCACHE
2017-10-05T23:34:47Z DEBUG Writing Kerberos configuration to /etc/krb5.conf:
2017-10-05T23:34:47Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
EXAMPLE.COM = {
kdc = ds01.example.com:88
master_kdc = ds01.example.com:88
admin_server = ds01.example.com:749
kpasswd_server = ds01.example.com:464
default_domain = example.com
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
groc-5.example.com = EXAMPLE.COM
2017-10-05T23:34:47Z INFO Configured /etc/krb5.conf for IPA realm EXAMPLE.COM
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -N -f
/tmp/tmpzYMe1L/pwdfile.txt -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A -n CA certificate 1
-t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A -n CA certificate 2
-t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A -n CA certificate 3
-t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A -n CA certificate 4
-t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A -n CA certificate 5
-t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Error retrieving cookie from the persistent storage: expected
string or buffer
2017-10-05T23:34:47Z DEBUG failed to find session_cookie in persistent storage for
principal 'host/groc-5.example.com(a)EXAMPLE.COM'
2017-10-05T23:34:47Z INFO trying https://ds01.example.com/ipa/json
2017-10-05T23:34:47Z DEBUG New HTTP connection (ds01.example.com)
2017-10-05T23:34:47Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=c8b0ad6e060540145a210905bd242379;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:47 GMT; Secure;
HttpOnly']'
2017-10-05T23:34:47Z DEBUG storing cookie
'ipa_session=c8b0ad6e060540145a210905bd242379;' for principal
host/groc-5.example.com@EXAMPLE.COM<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:47Z DEBUG Created connection context.rpcclient_53194256
2017-10-05T23:34:47Z INFO [try 1]: Forwarding 'schema' to json server
'https://ds01.example.com/ipa/json'
2017-10-05T23:34:47Z DEBUG HTTP connection keep-alive (ds01.example.com)
2017-10-05T23:34:47Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:47 GMT; Secure;
HttpOnly']'
2017-10-05T23:34:47Z DEBUG storing cookie
'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal
host/groc-5.example.com@EXAMPLE.COM<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z DEBUG Destroyed connection context.rpcclient_53194256
2017-10-05T23:34:48Z DEBUG importing all plugin modules in
ipaclient.remote_plugins.schema$ed0ad850...
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.remote_plugins.schema$ed0ad850.plugins
2017-10-05T23:34:48Z DEBUG importing all plugin modules in ipaclient.plugins...
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.automember
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.automount
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.ca
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.cert
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.certmap
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.certprofile
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.dns
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.hbacrule
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.hbactest
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.host
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.idrange
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.internal
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.location
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.migration
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.misc
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.otptoken
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.otptoken_yubikey
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.passwd
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.permission
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.rpcclient
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.server
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.service
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.sudorule
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.topology
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.trust
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.user
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.vault
2017-10-05T23:34:48Z DEBUG found session_cookie in persistent storage for principal
'host/groc-5.example.com(a)EXAMPLE.COM', cookie:
'ipa_session=0552135805674c077504cbd3fcecfb87'
2017-10-05T23:34:48Z DEBUG setting session_cookie into context
'ipa_session=0552135805674c077504cbd3fcecfb87;'
2017-10-05T23:34:48Z INFO trying https://ds01.example.com/ipa/session/json
2017-10-05T23:34:48Z DEBUG New HTTP connection (ds01.example.com)
2017-10-05T23:34:48Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:48 GMT; Secure;
HttpOnly']'
2017-10-05T23:34:48Z DEBUG storing cookie
'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal
host/groc-5.example.com@EXAMPLE.COM<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z DEBUG Created connection context.rpcclient_94332368
2017-10-05T23:34:48Z DEBUG Try RPC connection
2017-10-05T23:34:48Z INFO [try 1]: Forwarding 'ping' to json server
'https://ds01.example.com/ipa/session/json'
2017-10-05T23:34:48Z DEBUG HTTP connection keep-alive (ds01.example.com)
2017-10-05T23:34:48Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:48 GMT; Secure;
HttpOnly']'
2017-10-05T23:34:48Z DEBUG storing cookie
'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal
host/groc-5.example.com@EXAMPLE.COM<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z INFO [try 1]: Forwarding 'ca_is_enabled' to json server
'https://ds01.example.com/ipa/session/json'
2017-10-05T23:34:48Z DEBUG HTTP connection keep-alive (ds01.example.com)
2017-10-05T23:34:48Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:48 GMT; Secure;
HttpOnly']'
2017-10-05T23:34:48Z DEBUG storing cookie
'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal
host/groc-5.example.com@EXAMPLE.COM<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z DEBUG Starting external process
2017-10-05T23:34:48Z DEBUG args=/usr/bin/certutil -d /etc/ipa/nssdb -N -f
/etc/ipa/nssdb/pwdfile.txt -f /etc/ipa/nssdb/pwdfile.txt
2017-10-05T23:34:48Z DEBUG Process finished, return code=0
2017-10-05T23:34:48Z DEBUG stdout=
2017-10-05T23:34:48Z DEBUG stderr=
2017-10-05T23:34:49Z DEBUG Adding CA certificates to the IPA NSS database.
2017-10-05T23:34:49Z DEBUG Starting external process
2017-10-05T23:34:49Z DEBUG args=/usr/bin/certutil -d /etc/ipa/nssdb -A -n EXAMPLE.COM IPA
CA -t CT,C,C -f /etc/ipa/nssdb/pwdfile.txt
2017-10-05T23:34:49Z DEBUG Process finished, return code=0
2017-10-05T23:34:49Z DEBUG stdout=
2017-10-05T23:34:49Z DEBUG stderr=
2017-10-05T23:34:49Z DEBUG Starting external process
2017-10-05T23:34:49Z DEBUG args=/usr/bin/certutil -d /etc/ipa/nssdb -A -n EXAMPLE.COM IPA
CA -t CT,C,C -f /etc/ipa/nssdb/pwdfile.txt
2017-10-05T23:34:49Z DEBUG Process finished, return code=255
2017-10-05T23:34:49Z DEBUG stdout=
2017-10-05T23:34:49Z DEBUG stderr=certutil: could not add certificate to token or
database: SEC_ERROR_ADDING_CERT: Error adding certificate to database.
2017-10-05T23:34:49Z WARNING Installation failed. Force set so not rolling back changes.
2017-10-05T23:34:49Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 333, in
run
cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 368,
in run
self.execute()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 392,
in execute
for _nothing in self._executor():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434,
in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463,
in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453,
in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424,
in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421,
in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in
run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in
run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658,
in _configure
next(executor)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434,
in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463,
in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521,
in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453,
in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518,
in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453,
in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424,
in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421,
in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in
run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in
run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63,
in _install
for _nothing in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line
3621, in main
install(self)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line
2348, in install
_install(options)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line
2791, in _install
rval=CLIENT_INSTALL_ERROR)
2017-10-05T23:34:49Z DEBUG The ipa-client-install command failed, exception: ScriptError:
Failed to add EXAMPLE.COM IPA CA to the IPA NSS database.
2017-10-05T23:34:49Z ERROR Failed to add EXAMPLE.COM IPA CA to the IPA NSS database.
2017-10-05T23:34:49Z ERROR The ipa-client-install command failed. See
/var/log/ipaclient-install.log for more information
Regards,
Bhavin
3:25 a.m.
On 10/06/2017 02:04 AM, Bhavin Vaidya via FreeIPA-users wrote:
Hello,
Thank you all for help in past, as I'm keep encountering one after
another issue.
Sorry for long email, as posting log. let me know if there is other way.
IPA Server OS: CentOS Linux release 7.0.1406 (Core)
IPA Server RPM: ipa-server-4.4.0-14.el7.centos.7.x86_64
Client OS: CentOS Linux release 7.3.1611 (Core)
IPA client RPM: ipa-client-4.5.0-21.el7.centos.1.2.x86_64 (as well as
ipa-client-4.4.0-14.el7.centos.7.x86_64)
I'm not able to enroll new client recently, and getting following message:
Hi,
it looks like there are multiple versions for the IPA CA certificate,
and one of them is causing the issue. You can see in the log around
2017-10-05T23:34:45Z that CN=Certificate Authority,O=EXAMPLE.COM has
been renewed and corresponds to 5 items that can be found in
cn=certificates,cn=ipa,cn=etc,$SUFFIX.
The installer is trying to append them in /etc/ipa/nssdb and one of them
fails.
A little bit before this step (around 2017-10-05T23:34:47Z), the
installer has validated that the certs are OK by using a temporary NSS
DB, hence I don't think that the certs themselves are the issue, but
rather that /etc/ipa/nssdb already contained something that caused the
problem.
Was the /etc/ipa/nssdb already existing before you launched the
installation? Can you try to run ipa-client-install --uninstall -U, then
remove the files in /etc/ipa/nssdb, run ipa host-del <client> on the
master and re-launch the installation?
Flo
Enrolled in IPA realm EXAMPLE.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm EXAMPLE.COM
trying https://ds01.example.com/ipa/json
[try 1]: Forwarding 'schema' to json server
'https://ds01.example.com/ipa/json'
trying https://ds01.example.com/ipa/session/json
[try 1]: Forwarding 'ping' to json server
'https://ds01.example.com/ipa/session/json'
[try 1]: Forwarding 'ca_is_enabled' to json server
'https://ds01.example.com/ipa/session/json'
Installation failed. Force set so not rolling back changes.
Failed to add EXAMPLE.COM IPA CA to the IPA NSS database.
The ipa-client-install command failed. See
/var/log/ipaclient-install.log for more information
The ipa-client-install.log is:
2017-10-05T23:34:37Z DEBUG Logging to /var/log/ipaclient-install.log
2017-10-05T23:34:37Z DEBUG ipa-client-install was invoked with arguments
[] and options: {'no_dns_sshfp': False, 'force': True, 'verbose':
False,
'ip_addresses': None, 'configure_firefox': False, 'realm_name':
None,
'force_ntpd': False, 'on_master': False, 'no_nisdomain': False,
'ssh_trust_dns': False, 'principal': None, 'keytab': None,
'no_ntp':
False, 'domain_name': None, 'request_cert': False,
'fixed_primary':
False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None,
'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers':
None,
'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False,
'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh':
False,
'force_join': False, 'firefox_dir': None, 'unattended': False,
'quiet':
False, 'nisdomain': None, 'prompt_password': False, 'host_name':
None,
'permit': False, 'automount_location': None, 'preserve_sssd':
False,
'mkhomedir': False, 'log_file': None, 'uninstall': False}
2017-10-05T23:34:37Z DEBUG IPA version 4.5.0-21.el7.centos.1.2
2017-10-05T23:34:37Z DEBUG Loading Index file from
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:37Z DEBUG Starting external process
2017-10-05T23:34:37Z DEBUG args=/usr/sbin/selinuxenabled
2017-10-05T23:34:37Z DEBUG Process finished, return code=1
2017-10-05T23:34:37Z DEBUG stdout=
2017-10-05T23:34:37Z DEBUG stderr=
2017-10-05T23:34:37Z DEBUG Starting external process
2017-10-05T23:34:37Z DEBUG args=/bin/systemctl is-enabled chronyd.service
2017-10-05T23:34:37Z DEBUG Process finished, return code=0
2017-10-05T23:34:37Z DEBUG stdout=enabled
2017-10-05T23:34:37Z DEBUG stderr=
2017-10-05T23:34:37Z DEBUG [IPA Discovery]
2017-10-05T23:34:37Z DEBUG Starting IPA discovery with domain=None,
servers=None, hostname=groc-5.example.com
2017-10-05T23:34:37Z DEBUG Start searching for LDAP SRV record in
"example.com" (domain of the hostname) and its sub-domains
2017-10-05T23:34:37Z DEBUG Search DNS for SRV record of
_ldap._tcp.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ipa01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds02.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds03.example.com.
2017-10-05T23:34:37Z DEBUG [Kerberos realm search]
2017-10-05T23:34:37Z DEBUG Search DNS for TXT record of
_kerberos.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: "EXAMPLE.COM"
2017-10-05T23:34:37Z DEBUG Search DNS for SRV record of
_kerberos._udp.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ipa01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ds01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ds03.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ds02.example.com.
2017-10-05T23:34:37Z DEBUG [LDAP server check]
2017-10-05T23:34:37Z DEBUG Verifying that ds01.example.com (realm
EXAMPLE.COM) is an IPA server
2017-10-05T23:34:37Z DEBUG Init LDAP connection to:
ldap://ds01.example.com:389
2017-10-05T23:34:37Z DEBUG Search LDAP server for IPA base DN
2017-10-05T23:34:37Z DEBUG Check if naming context 'dc=example,dc=com'
is for IPA
2017-10-05T23:34:37Z DEBUG Naming context 'dc=example,dc=com' is a valid
IPA context
2017-10-05T23:34:37Z DEBUG Search for (objectClass=krbRealmContainer) in
dc=example,dc=com (sub)
2017-10-05T23:34:37Z DEBUG Found:
cn=EXAMPLE.COM,cn=kerberos,dc=example,dc=com
2017-10-05T23:34:37Z DEBUG Discovery result: Success;
server=ds01.example.com, domain=example.com,
kdc=ipa01.example.com,ds01.example.com,ds03.example.com,ds02.example.com,
basedn=dc=example,dc=com
2017-10-05T23:34:37Z DEBUG Validated servers: ds01.example.com
2017-10-05T23:34:37Z DEBUG will use discovered domain: example.com
2017-10-05T23:34:37Z DEBUG Start searching for LDAP SRV record in
"example.com" (Validating DNS Discovery) and its sub-domains
2017-10-05T23:34:37Z DEBUG Search DNS for SRV record of
_ldap._tcp.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ipa01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds02.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds03.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds01.example.com.
2017-10-05T23:34:37Z DEBUG DNS validated, enabling discovery
2017-10-05T23:34:37Z DEBUG will use discovered server: ds01.example.com
2017-10-05T23:34:37Z INFO Discovery was successful!
2017-10-05T23:34:37Z DEBUG will use discovered realm: EXAMPLE.COM
2017-10-05T23:34:37Z DEBUG will use discovered basedn: dc=example,dc=com
2017-10-05T23:34:37Z INFO Client hostname: groc-5.example.com
2017-10-05T23:34:37Z DEBUG Hostname source: Machine's FQDN
2017-10-05T23:34:37Z INFO Realm: EXAMPLE.COM
2017-10-05T23:34:37Z DEBUG Realm source: Discovered from LDAP DNS
records in ds01.example.com
2017-10-05T23:34:37Z INFO DNS Domain: example.com
2017-10-05T23:34:37Z DEBUG DNS Domain source: Discovered LDAP SRV
records from example.com (domain of the hostname)
2017-10-05T23:34:37Z INFO IPA Server: ds01.example.com
2017-10-05T23:34:37Z DEBUG IPA Server source: Discovered from LDAP DNS
records in ds01.example.com
2017-10-05T23:34:37Z INFO BaseDN: dc=example,dc=com
2017-10-05T23:34:37Z DEBUG BaseDN source: From IPA server
ldap://ds01.example.com:389
2017-10-05T23:34:39Z DEBUG Loading Index file from
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:39Z DEBUG Loading StateFile from
'/var/lib/ipa-client/sysrestore/sysrestore.state'
2017-10-05T23:34:39Z DEBUG Starting external process
2017-10-05T23:34:39Z DEBUG args=/usr/sbin/ipa-rmkeytab -k
/etc/krb5.keytab -r EXAMPLE.COM
2017-10-05T23:34:39Z DEBUG Process finished, return code=5
2017-10-05T23:34:39Z DEBUG stdout=
2017-10-05T23:34:39Z DEBUG stderr=realm not found
2017-10-05T23:34:39Z INFO Skipping synchronizing time with NTP server.
2017-10-05T23:34:41Z DEBUG will use principal provided as option: admin
2017-10-05T23:34:41Z DEBUG Starting external process
2017-10-05T23:34:41Z DEBUG args=keyctl get_persistent @s 0
2017-10-05T23:34:41Z DEBUG Process finished, return code=0
2017-10-05T23:34:41Z DEBUG stdout=218715285
2017-10-05T23:34:41Z DEBUG stderr=
2017-10-05T23:34:41Z DEBUG Enabling persistent keyring CCACHE
2017-10-05T23:34:41Z DEBUG Writing Kerberos configuration to /tmp/tmpVCsDCR:
2017-10-05T23:34:41Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
EXAMPLE.COM = {
kdc = ds01.example.com:88
master_kdc = ds01.example.com:88
admin_server = ds01.example.com:749
kpasswd_server = ds01.example.com:464
default_domain = example.com
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
groc-5.example.com = EXAMPLE.COM
2017-10-05T23:34:45Z DEBUG Initializing principal admin(a)EXAMPLE.COM
<mailto:admin@EXAMPLE.COM> using password
2017-10-05T23:34:45Z DEBUG Starting external process
2017-10-05T23:34:45Z DEBUG args=/usr/bin/kinit admin(a)EXAMPLE.COM
<mailto:admin@EXAMPLE.COM> -c /tmp/krbccbP9vNK/ccache
2017-10-05T23:34:45Z DEBUG Process finished, return code=0
2017-10-05T23:34:45Z DEBUG stdout=Password for admin(a)EXAMPLE.COM
<mailto:admin@EXAMPLE.COM>:
2017-10-05T23:34:45Z DEBUG stderr=
2017-10-05T23:34:45Z DEBUG trying to retrieve CA cert via LDAP from
ds01.example.com
2017-10-05T23:34:45Z DEBUG retrieving schema for SchemaCache
url=ldap://ds01.example.com:389 conn=<ldap.ldapobject.SimpleLDAPObject
instance at 0x2c25ea8>
2017-10-05T23:34:45Z INFO Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2014-08-03 19:28:18
Valid Until: 2034-08-03 19:28:18
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-05-30 00:17:28
Valid Until: 2037-05-30 00:17:28
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-05-30 00:19:13
Valid Until: 2037-05-30 00:19:13
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-05-30 00:38:33
Valid Until: 2037-05-30 00:38:33
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-06-01 12:55:08
Valid Until: 2037-06-01 12:55:08
2017-10-05T23:34:45Z DEBUG Starting external process
2017-10-05T23:34:45Z DEBUG args=/usr/sbin/ipa-join -s ds01.example.com
-b dc=example,dc=com -h groc-5.example.com
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=Failed to parse result: Failed to
decode GetKeytab Control.
Retrying with pre-4.0 keytab retrieval method...
Failed to retrieve encryption type Camellia-128 CTS mode with CMAC (#25)
Failed to retrieve encryption type Camellia-256 CTS mode with CMAC (#26)
Keytab successfully retrieved and stored in: /etc/krb5.keytab
Certificate subject base is: O=EXAMPLE.COM
2017-10-05T23:34:47Z INFO Enrolled in IPA realm EXAMPLE.COM
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=kdestroy
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Initializing principal
host/groc-5.example.com(a)EXAMPLE.COM
<mailto:host/groc-5.example.com@EXAMPLE.COM> using keytab /etc/krb5.keytab
2017-10-05T23:34:47Z DEBUG using ccache /etc/ipa/.dns_ccache
2017-10-05T23:34:47Z DEBUG Attempt 1/5: success
2017-10-05T23:34:47Z DEBUG Backing up system configuration file
'/etc/ipa/default.conf'
2017-10-05T23:34:47Z DEBUG -> Not backing up - '/etc/ipa/default.conf'
doesn't exist
2017-10-05T23:34:47Z INFO Created /etc/ipa/default.conf
2017-10-05T23:34:47Z DEBUG Backing up system configuration file
'/etc/sssd/sssd.conf'
2017-10-05T23:34:47Z DEBUG -> Not backing up - '/etc/sssd/sssd.conf'
doesn't exist
2017-10-05T23:34:47Z INFO New SSSD config will be created
2017-10-05T23:34:47Z DEBUG Backing up system configuration file
'/etc/nsswitch.conf'
2017-10-05T23:34:47Z DEBUG Saving Index File to
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:47Z INFO Configured sudoers in /etc/nsswitch.conf
2017-10-05T23:34:47Z INFO Configured /etc/sssd/sssd.conf
2017-10-05T23:34:47Z DEBUG Backing up system configuration file
'/etc/krb5.conf'
2017-10-05T23:34:47Z DEBUG Saving Index File to
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=keyctl get_persistent @s 0
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=218715285
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Enabling persistent keyring CCACHE
2017-10-05T23:34:47Z DEBUG Writing Kerberos configuration to /etc/krb5.conf:
2017-10-05T23:34:47Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
EXAMPLE.COM = {
kdc = ds01.example.com:88
master_kdc = ds01.example.com:88
admin_server = ds01.example.com:749
kpasswd_server = ds01.example.com:464
default_domain = example.com
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
groc-5.example.com = EXAMPLE.COM
2017-10-05T23:34:47Z INFO Configured /etc/krb5.conf for IPA realm
EXAMPLE.COM
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -N
-f /tmp/tmpzYMe1L/pwdfile.txt -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A
-n CA certificate 1 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A
-n CA certificate 2 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A
-n CA certificate 3 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A
-n CA certificate 4 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A
-n CA certificate 5 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Error retrieving cookie from the persistent
storage: expected string or buffer
2017-10-05T23:34:47Z DEBUG failed to find session_cookie in persistent
storage for principal 'host/groc-5.example.com(a)EXAMPLE.COM'
2017-10-05T23:34:47Z INFO trying https://ds01.example.com/ipa/json
2017-10-05T23:34:47Z DEBUG New HTTP connection (ds01.example.com)
2017-10-05T23:34:47Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=c8b0ad6e060540145a210905bd242379;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:47
GMT; Secure; HttpOnly']'
2017-10-05T23:34:47Z DEBUG storing cookie
'ipa_session=c8b0ad6e060540145a210905bd242379;' for principal
host/groc-5.example.com(a)EXAMPLE.COM
<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:47Z DEBUG Created connection context.rpcclient_53194256
2017-10-05T23:34:47Z INFO [try 1]: Forwarding 'schema' to json server
'https://ds01.example.com/ipa/json'
2017-10-05T23:34:47Z DEBUG HTTP connection keep-alive (ds01.example.com)
2017-10-05T23:34:47Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:47
GMT; Secure; HttpOnly']'
2017-10-05T23:34:47Z DEBUG storing cookie
'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal
host/groc-5.example.com(a)EXAMPLE.COM
<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z DEBUG Destroyed connection context.rpcclient_53194256
2017-10-05T23:34:48Z DEBUG importing all plugin modules in
ipaclient.remote_plugins.schema$ed0ad850...
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.remote_plugins.schema$ed0ad850.plugins
2017-10-05T23:34:48Z DEBUG importing all plugin modules in
ipaclient.plugins...
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.automember
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.automount
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.ca
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.cert
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.certmap
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.certprofile
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.dns
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.hbacrule
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.hbactest
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.host
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.idrange
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.internal
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.location
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.migration
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.misc
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.otptoken
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.otptoken_yubikey
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.passwd
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.permission
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.rpcclient
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.server
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.service
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.sudorule
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.topology
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.trust
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.user
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.vault
2017-10-05T23:34:48Z DEBUG found session_cookie in persistent storage
for principal 'host/groc-5.example.com(a)EXAMPLE.COM', cookie:
'ipa_session=0552135805674c077504cbd3fcecfb87'
2017-10-05T23:34:48Z DEBUG setting session_cookie into context
'ipa_session=0552135805674c077504cbd3fcecfb87;'
2017-10-05T23:34:48Z INFO trying https://ds01.example.com/ipa/session/json
2017-10-05T23:34:48Z DEBUG New HTTP connection (ds01.example.com)
2017-10-05T23:34:48Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:48
GMT; Secure; HttpOnly']'
2017-10-05T23:34:48Z DEBUG storing cookie
'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal
host/groc-5.example.com(a)EXAMPLE.COM
<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z DEBUG Created connection context.rpcclient_94332368
2017-10-05T23:34:48Z DEBUG Try RPC connection
2017-10-05T23:34:48Z INFO [try 1]: Forwarding 'ping' to json server
'https://ds01.example.com/ipa/session/json'
2017-10-05T23:34:48Z DEBUG HTTP connection keep-alive (ds01.example.com)
2017-10-05T23:34:48Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:48
GMT; Secure; HttpOnly']'
2017-10-05T23:34:48Z DEBUG storing cookie
'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal
host/groc-5.example.com(a)EXAMPLE.COM
<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z INFO [try 1]: Forwarding 'ca_is_enabled' to json
server 'https://ds01.example.com/ipa/session/json'
2017-10-05T23:34:48Z DEBUG HTTP connection keep-alive (ds01.example.com)
2017-10-05T23:34:48Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:48
GMT; Secure; HttpOnly']'
2017-10-05T23:34:48Z DEBUG storing cookie
'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal
host/groc-5.example.com(a)EXAMPLE.COM
<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z DEBUG Starting external process
2017-10-05T23:34:48Z DEBUG args=/usr/bin/certutil -d /etc/ipa/nssdb -N
-f /etc/ipa/nssdb/pwdfile.txt -f /etc/ipa/nssdb/pwdfile.txt
2017-10-05T23:34:48Z DEBUG Process finished, return code=0
2017-10-05T23:34:48Z DEBUG stdout=
2017-10-05T23:34:48Z DEBUG stderr=
2017-10-05T23:34:49Z DEBUG Adding CA certificates to the IPA NSS database.
2017-10-05T23:34:49Z DEBUG Starting external process
2017-10-05T23:34:49Z DEBUG args=/usr/bin/certutil -d /etc/ipa/nssdb -A
-n EXAMPLE.COM IPA CA -t CT,C,C -f /etc/ipa/nssdb/pwdfile.txt
2017-10-05T23:34:49Z DEBUG Process finished, return code=0
2017-10-05T23:34:49Z DEBUG stdout=
2017-10-05T23:34:49Z DEBUG stderr=
2017-10-05T23:34:49Z DEBUG Starting external process
2017-10-05T23:34:49Z DEBUG args=/usr/bin/certutil -d /etc/ipa/nssdb -A
-n EXAMPLE.COM IPA CA -t CT,C,C -f /etc/ipa/nssdb/pwdfile.txt
2017-10-05T23:34:49Z DEBUG Process finished, return code=255
2017-10-05T23:34:49Z DEBUG stdout=
2017-10-05T23:34:49Z DEBUG stderr=certutil: could not add certificate to
token or database: SEC_ERROR_ADDING_CERT: Error adding certificate to
database.
2017-10-05T23:34:49Z WARNING Installation failed. Force set so not
rolling back changes.
2017-10-05T23:34:49Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in
execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py",
line 333, in run
cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 368, in run
self.execute()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 392, in execute
for _nothing in self._executor():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 463, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 658, in _configure
next(executor)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 463, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 521, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 518, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py",
line 63, in _install
for _nothing in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py",
line 3621, in main
install(self)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py",
line 2348, in install
_install(options)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py",
line 2791, in _install
rval=CLIENT_INSTALL_ERROR)
2017-10-05T23:34:49Z DEBUG The ipa-client-install command failed,
exception: ScriptError: Failed to add EXAMPLE.COM IPA CA to the IPA NSS
database.
2017-10-05T23:34:49Z ERROR Failed to add EXAMPLE.COM IPA CA to the IPA
NSS database.
2017-10-05T23:34:49Z ERROR The ipa-client-install command failed. See
/var/log/ipaclient-install.log for more information
Regards,
Bhavin
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
1:31 p.m.
Thank You Florence.
On new client, /etc/ipa/nssdb was empty, I still deleted the nssdb dir on client, ran
uninstall command you mentioned, deleted the host on master, and ran ipa-client-install
and still the same issue.
I have attached certificates from master server as well as the install log.
regards,
Bhavin
________________________________
From: Florence Blanc-Renaud <flo(a)redhat.com>
Sent: Friday, October 6, 2017 1:25 AM
To: FreeIPA users list
Cc: Bhavin Vaidya
Subject: Re: [Freeipa-users] FreeIPA client installation failure
On 10/06/2017 02:04 AM, Bhavin Vaidya via FreeIPA-users wrote:
Hello,
Thank you all for help in past, as I'm keep encountering one after
another issue.
Sorry for long email, as posting log. let me know if there is other way.
IPA Server OS: CentOS Linux release 7.0.1406 (Core)
IPA Server RPM: ipa-server-4.4.0-14.el7.centos.7.x86_64
Client OS: CentOS Linux release 7.3.1611 (Core)
IPA client RPM: ipa-client-4.5.0-21.el7.centos.1.2.x86_64 (as well as
ipa-client-4.4.0-14.el7.centos.7.x86_64)
I'm not able to enroll new client recently, and getting following message:
Hi,
it looks like there are multiple versions for the IPA CA certificate,
and one of them is causing the issue. You can see in the log around
2017-10-05T23:34:45Z that CN=Certificate Authority,O=EXAMPLE.COM has
been renewed and corresponds to 5 items that can be found in
cn=certificates,cn=ipa,cn=etc,$SUFFIX.
The installer is trying to append them in /etc/ipa/nssdb and one of them
fails.
A little bit before this step (around 2017-10-05T23:34:47Z), the
installer has validated that the certs are OK by using a temporary NSS
DB, hence I don't think that the certs themselves are the issue, but
rather that /etc/ipa/nssdb already contained something that caused the
problem.
Was the /etc/ipa/nssdb already existing before you launched the
installation? Can you try to run ipa-client-install --uninstall -U, then
remove the files in /etc/ipa/nssdb, run ipa host-del <client> on the
master and re-launch the installation?
Flo
Enrolled in IPA realm EXAMPLE.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm EXAMPLE.COM
trying https://ds01.example.com/ipa/json
[try 1]: Forwarding 'schema' to json server
'https://ds01.example.com/ipa/json'
trying https://ds01.example.com/ipa/session/json
[try 1]: Forwarding 'ping' to json server
'https://ds01.example.com/ipa/session/json'
[try 1]: Forwarding 'ca_is_enabled' to json server
'https://ds01.example.com/ipa/session/json'
Installation failed. Force set so not rolling back changes.
Failed to add EXAMPLE.COM IPA CA to the IPA NSS database.
The ipa-client-install command failed. See
/var/log/ipaclient-install.log for more information
The ipa-client-install.log is:
2017-10-05T23:34:37Z DEBUG Logging to /var/log/ipaclient-install.log
2017-10-05T23:34:37Z DEBUG ipa-client-install was invoked with arguments
[] and options: {'no_dns_sshfp': False, 'force': True, 'verbose':
False,
'ip_addresses': None, 'configure_firefox': False, 'realm_name':
None,
'force_ntpd': False, 'on_master': False, 'no_nisdomain': False,
'ssh_trust_dns': False, 'principal': None, 'keytab': None,
'no_ntp':
False, 'domain_name': None, 'request_cert': False,
'fixed_primary':
False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None,
'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers':
None,
'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False,
'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh':
False,
'force_join': False, 'firefox_dir': None, 'unattended': False,
'quiet':
False, 'nisdomain': None, 'prompt_password': False, 'host_name':
None,
'permit': False, 'automount_location': None, 'preserve_sssd':
False,
'mkhomedir': False, 'log_file': None, 'uninstall': False}
2017-10-05T23:34:37Z DEBUG IPA version 4.5.0-21.el7.centos.1.2
2017-10-05T23:34:37Z DEBUG Loading Index file from
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:37Z DEBUG Starting external process
2017-10-05T23:34:37Z DEBUG args=/usr/sbin/selinuxenabled
2017-10-05T23:34:37Z DEBUG Process finished, return code=1
2017-10-05T23:34:37Z DEBUG stdout=
2017-10-05T23:34:37Z DEBUG stderr=
2017-10-05T23:34:37Z DEBUG Starting external process
2017-10-05T23:34:37Z DEBUG args=/bin/systemctl is-enabled chronyd.service
2017-10-05T23:34:37Z DEBUG Process finished, return code=0
2017-10-05T23:34:37Z DEBUG stdout=enabled
2017-10-05T23:34:37Z DEBUG stderr=
2017-10-05T23:34:37Z DEBUG [IPA Discovery]
2017-10-05T23:34:37Z DEBUG Starting IPA discovery with domain=None,
servers=None, hostname=groc-5.example.com
2017-10-05T23:34:37Z DEBUG Start searching for LDAP SRV record in
"example.com" (domain of the hostname) and its sub-domains
2017-10-05T23:34:37Z DEBUG Search DNS for SRV record of
_ldap._tcp.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ipa01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds02.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds03.example.com.
2017-10-05T23:34:37Z DEBUG [Kerberos realm search]
2017-10-05T23:34:37Z DEBUG Search DNS for TXT record of
_kerberos.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: "EXAMPLE.COM"
2017-10-05T23:34:37Z DEBUG Search DNS for SRV record of
_kerberos._udp.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ipa01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ds01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ds03.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 88 ds02.example.com.
2017-10-05T23:34:37Z DEBUG [LDAP server check]
2017-10-05T23:34:37Z DEBUG Verifying that ds01.example.com (realm
EXAMPLE.COM) is an IPA server
2017-10-05T23:34:37Z DEBUG Init LDAP connection to:
ldap://ds01.example.com:389
2017-10-05T23:34:37Z DEBUG Search LDAP server for IPA base DN
2017-10-05T23:34:37Z DEBUG Check if naming context 'dc=example,dc=com'
is for IPA
2017-10-05T23:34:37Z DEBUG Naming context 'dc=example,dc=com' is a valid
IPA context
2017-10-05T23:34:37Z DEBUG Search for (objectClass=krbRealmContainer) in
dc=example,dc=com (sub)
2017-10-05T23:34:37Z DEBUG Found:
cn=EXAMPLE.COM,cn=kerberos,dc=example,dc=com
2017-10-05T23:34:37Z DEBUG Discovery result: Success;
server=ds01.example.com, domain=example.com,
kdc=ipa01.example.com,ds01.example.com,ds03.example.com,ds02.example.com,
basedn=dc=example,dc=com
2017-10-05T23:34:37Z DEBUG Validated servers: ds01.example.com
2017-10-05T23:34:37Z DEBUG will use discovered domain: example.com
2017-10-05T23:34:37Z DEBUG Start searching for LDAP SRV record in
"example.com" (Validating DNS Discovery) and its sub-domains
2017-10-05T23:34:37Z DEBUG Search DNS for SRV record of
_ldap._tcp.example.com
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ipa01.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds02.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds03.example.com.
2017-10-05T23:34:37Z DEBUG DNS record found: 0 100 389 ds01.example.com.
2017-10-05T23:34:37Z DEBUG DNS validated, enabling discovery
2017-10-05T23:34:37Z DEBUG will use discovered server: ds01.example.com
2017-10-05T23:34:37Z INFO Discovery was successful!
2017-10-05T23:34:37Z DEBUG will use discovered realm: EXAMPLE.COM
2017-10-05T23:34:37Z DEBUG will use discovered basedn: dc=example,dc=com
2017-10-05T23:34:37Z INFO Client hostname: groc-5.example.com
2017-10-05T23:34:37Z DEBUG Hostname source: Machine's FQDN
2017-10-05T23:34:37Z INFO Realm: EXAMPLE.COM
2017-10-05T23:34:37Z DEBUG Realm source: Discovered from LDAP DNS
records in ds01.example.com
2017-10-05T23:34:37Z INFO DNS Domain: example.com
2017-10-05T23:34:37Z DEBUG DNS Domain source: Discovered LDAP SRV
records from example.com (domain of the hostname)
2017-10-05T23:34:37Z INFO IPA Server: ds01.example.com
2017-10-05T23:34:37Z DEBUG IPA Server source: Discovered from LDAP DNS
records in ds01.example.com
2017-10-05T23:34:37Z INFO BaseDN: dc=example,dc=com
2017-10-05T23:34:37Z DEBUG BaseDN source: From IPA server
ldap://ds01.example.com:389
2017-10-05T23:34:39Z DEBUG Loading Index file from
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:39Z DEBUG Loading StateFile from
'/var/lib/ipa-client/sysrestore/sysrestore.state'
2017-10-05T23:34:39Z DEBUG Starting external process
2017-10-05T23:34:39Z DEBUG args=/usr/sbin/ipa-rmkeytab -k
/etc/krb5.keytab -r EXAMPLE.COM
2017-10-05T23:34:39Z DEBUG Process finished, return code=5
2017-10-05T23:34:39Z DEBUG stdout=
2017-10-05T23:34:39Z DEBUG stderr=realm not found
2017-10-05T23:34:39Z INFO Skipping synchronizing time with NTP server.
2017-10-05T23:34:41Z DEBUG will use principal provided as option: admin
2017-10-05T23:34:41Z DEBUG Starting external process
2017-10-05T23:34:41Z DEBUG args=keyctl get_persistent @s 0
2017-10-05T23:34:41Z DEBUG Process finished, return code=0
2017-10-05T23:34:41Z DEBUG stdout=218715285
2017-10-05T23:34:41Z DEBUG stderr=
2017-10-05T23:34:41Z DEBUG Enabling persistent keyring CCACHE
2017-10-05T23:34:41Z DEBUG Writing Kerberos configuration to /tmp/tmpVCsDCR:
2017-10-05T23:34:41Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
EXAMPLE.COM = {
kdc = ds01.example.com:88
master_kdc = ds01.example.com:88
admin_server = ds01.example.com:749
kpasswd_server = ds01.example.com:464
default_domain = example.com
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
groc-5.example.com = EXAMPLE.COM
2017-10-05T23:34:45Z DEBUG Initializing principal admin(a)EXAMPLE.COM
<mailto:admin@EXAMPLE.COM> using password
2017-10-05T23:34:45Z DEBUG Starting external process
2017-10-05T23:34:45Z DEBUG args=/usr/bin/kinit admin(a)EXAMPLE.COM
<mailto:admin@EXAMPLE.COM> -c /tmp/krbccbP9vNK/ccache
2017-10-05T23:34:45Z DEBUG Process finished, return code=0
2017-10-05T23:34:45Z DEBUG stdout=Password for admin(a)EXAMPLE.COM
<mailto:admin@EXAMPLE.COM>:
2017-10-05T23:34:45Z DEBUG stderr=
2017-10-05T23:34:45Z DEBUG trying to retrieve CA cert via LDAP from
ds01.example.com
2017-10-05T23:34:45Z DEBUG retrieving schema for SchemaCache
url=ldap://ds01.example.com:389 conn=<ldap.ldapobject.SimpleLDAPObject
instance at 0x2c25ea8>
2017-10-05T23:34:45Z INFO Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2014-08-03 19:28:18
Valid Until: 2034-08-03 19:28:18
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-05-30 00:17:28
Valid Until: 2037-05-30 00:17:28
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-05-30 00:19:13
Valid Until: 2037-05-30 00:19:13
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-05-30 00:38:33
Valid Until: 2037-05-30 00:38:33
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2017-06-01 12:55:08
Valid Until: 2037-06-01 12:55:08
2017-10-05T23:34:45Z DEBUG Starting external process
2017-10-05T23:34:45Z DEBUG args=/usr/sbin/ipa-join -s ds01.example.com
-b dc=example,dc=com -h groc-5.example.com
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=Failed to parse result: Failed to
decode GetKeytab Control.
Retrying with pre-4.0 keytab retrieval method...
Failed to retrieve encryption type Camellia-128 CTS mode with CMAC (#25)
Failed to retrieve encryption type Camellia-256 CTS mode with CMAC (#26)
Keytab successfully retrieved and stored in: /etc/krb5.keytab
Certificate subject base is: O=EXAMPLE.COM
2017-10-05T23:34:47Z INFO Enrolled in IPA realm EXAMPLE.COM
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=kdestroy
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Initializing principal
host/groc-5.example.com(a)EXAMPLE.COM
<mailto:host/groc-5.example.com@EXAMPLE.COM> using keytab /etc/krb5.keytab
2017-10-05T23:34:47Z DEBUG using ccache /etc/ipa/.dns_ccache
2017-10-05T23:34:47Z DEBUG Attempt 1/5: success
2017-10-05T23:34:47Z DEBUG Backing up system configuration file
'/etc/ipa/default.conf'
2017-10-05T23:34:47Z DEBUG -> Not backing up - '/etc/ipa/default.conf'
doesn't exist
2017-10-05T23:34:47Z INFO Created /etc/ipa/default.conf
2017-10-05T23:34:47Z DEBUG Backing up system configuration file
'/etc/sssd/sssd.conf'
2017-10-05T23:34:47Z DEBUG -> Not backing up - '/etc/sssd/sssd.conf'
doesn't exist
2017-10-05T23:34:47Z INFO New SSSD config will be created
2017-10-05T23:34:47Z DEBUG Backing up system configuration file
'/etc/nsswitch.conf'
2017-10-05T23:34:47Z DEBUG Saving Index File to
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:47Z INFO Configured sudoers in /etc/nsswitch.conf
2017-10-05T23:34:47Z INFO Configured /etc/sssd/sssd.conf
2017-10-05T23:34:47Z DEBUG Backing up system configuration file
'/etc/krb5.conf'
2017-10-05T23:34:47Z DEBUG Saving Index File to
'/var/lib/ipa-client/sysrestore/sysrestore.index'
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=keyctl get_persistent @s 0
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=218715285
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Enabling persistent keyring CCACHE
2017-10-05T23:34:47Z DEBUG Writing Kerberos configuration to /etc/krb5.conf:
2017-10-05T23:34:47Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
EXAMPLE.COM = {
kdc = ds01.example.com:88
master_kdc = ds01.example.com:88
admin_server = ds01.example.com:749
kpasswd_server = ds01.example.com:464
default_domain = example.com
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
groc-5.example.com = EXAMPLE.COM
2017-10-05T23:34:47Z INFO Configured /etc/krb5.conf for IPA realm
EXAMPLE.COM
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -N
-f /tmp/tmpzYMe1L/pwdfile.txt -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A
-n CA certificate 1 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A
-n CA certificate 2 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A
-n CA certificate 3 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A
-n CA certificate 4 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Starting external process
2017-10-05T23:34:47Z DEBUG args=/usr/bin/certutil -d /tmp/tmpzYMe1L -A
-n CA certificate 5 -t C,, -f /tmp/tmpzYMe1L/pwdfile.txt
2017-10-05T23:34:47Z DEBUG Process finished, return code=0
2017-10-05T23:34:47Z DEBUG stdout=
2017-10-05T23:34:47Z DEBUG stderr=
2017-10-05T23:34:47Z DEBUG Error retrieving cookie from the persistent
storage: expected string or buffer
2017-10-05T23:34:47Z DEBUG failed to find session_cookie in persistent
storage for principal 'host/groc-5.example.com(a)EXAMPLE.COM'
2017-10-05T23:34:47Z INFO trying https://ds01.example.com/ipa/json
2017-10-05T23:34:47Z DEBUG New HTTP connection (ds01.example.com)
2017-10-05T23:34:47Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=c8b0ad6e060540145a210905bd242379;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:47
GMT; Secure; HttpOnly']'
2017-10-05T23:34:47Z DEBUG storing cookie
'ipa_session=c8b0ad6e060540145a210905bd242379;' for principal
host/groc-5.example.com(a)EXAMPLE.COM
<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:47Z DEBUG Created connection context.rpcclient_53194256
2017-10-05T23:34:47Z INFO [try 1]: Forwarding 'schema' to json server
'https://ds01.example.com/ipa/json'
2017-10-05T23:34:47Z DEBUG HTTP connection keep-alive (ds01.example.com)
2017-10-05T23:34:47Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:47
GMT; Secure; HttpOnly']'
2017-10-05T23:34:47Z DEBUG storing cookie
'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal
host/groc-5.example.com(a)EXAMPLE.COM
<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z DEBUG Destroyed connection context.rpcclient_53194256
2017-10-05T23:34:48Z DEBUG importing all plugin modules in
ipaclient.remote_plugins.schema$ed0ad850...
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.remote_plugins.schema$ed0ad850.plugins
2017-10-05T23:34:48Z DEBUG importing all plugin modules in
ipaclient.plugins...
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.automember
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.automount
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.ca
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.cert
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.certmap
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.certprofile
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.dns
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.hbacrule
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.hbactest
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.host
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.idrange
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.internal
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.location
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.migration
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.misc
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.otptoken
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.otptoken_yubikey
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.passwd
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.permission
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.rpcclient
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.server
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.service
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.sudorule
2017-10-05T23:34:48Z DEBUG importing plugin module
ipaclient.plugins.topology
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.trust
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.user
2017-10-05T23:34:48Z DEBUG importing plugin module ipaclient.plugins.vault
2017-10-05T23:34:48Z DEBUG found session_cookie in persistent storage
for principal 'host/groc-5.example.com(a)EXAMPLE.COM', cookie:
'ipa_session=0552135805674c077504cbd3fcecfb87'
2017-10-05T23:34:48Z DEBUG setting session_cookie into context
'ipa_session=0552135805674c077504cbd3fcecfb87;'
2017-10-05T23:34:48Z INFO trying https://ds01.example.com/ipa/session/json
2017-10-05T23:34:48Z DEBUG New HTTP connection (ds01.example.com)
2017-10-05T23:34:48Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:48
GMT; Secure; HttpOnly']'
2017-10-05T23:34:48Z DEBUG storing cookie
'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal
host/groc-5.example.com(a)EXAMPLE.COM
<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z DEBUG Created connection context.rpcclient_94332368
2017-10-05T23:34:48Z DEBUG Try RPC connection
2017-10-05T23:34:48Z INFO [try 1]: Forwarding 'ping' to json server
'https://ds01.example.com/ipa/session/json'
2017-10-05T23:34:48Z DEBUG HTTP connection keep-alive (ds01.example.com)
2017-10-05T23:34:48Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:48
GMT; Secure; HttpOnly']'
2017-10-05T23:34:48Z DEBUG storing cookie
'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal
host/groc-5.example.com(a)EXAMPLE.COM
<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z INFO [try 1]: Forwarding 'ca_is_enabled' to json
server 'https://ds01.example.com/ipa/session/json'
2017-10-05T23:34:48Z DEBUG HTTP connection keep-alive (ds01.example.com)
2017-10-05T23:34:48Z DEBUG received Set-Cookie (<type
'list'>)'['ipa_session=0552135805674c077504cbd3fcecfb87;
Domain=ds01.example.com; Path=/ipa; Expires=Thu, 05 Oct 2017 23:54:48
GMT; Secure; HttpOnly']'
2017-10-05T23:34:48Z DEBUG storing cookie
'ipa_session=0552135805674c077504cbd3fcecfb87;' for principal
host/groc-5.example.com(a)EXAMPLE.COM
<mailto:host/groc-5.example.com@EXAMPLE.COM>
2017-10-05T23:34:48Z DEBUG Starting external process
2017-10-05T23:34:48Z DEBUG args=/usr/bin/certutil -d /etc/ipa/nssdb -N
-f /etc/ipa/nssdb/pwdfile.txt -f /etc/ipa/nssdb/pwdfile.txt
2017-10-05T23:34:48Z DEBUG Process finished, return code=0
2017-10-05T23:34:48Z DEBUG stdout=
2017-10-05T23:34:48Z DEBUG stderr=
2017-10-05T23:34:49Z DEBUG Adding CA certificates to the IPA NSS database.
2017-10-05T23:34:49Z DEBUG Starting external process
2017-10-05T23:34:49Z DEBUG args=/usr/bin/certutil -d /etc/ipa/nssdb -A
-n EXAMPLE.COM IPA CA -t CT,C,C -f /etc/ipa/nssdb/pwdfile.txt
2017-10-05T23:34:49Z DEBUG Process finished, return code=0
2017-10-05T23:34:49Z DEBUG stdout=
2017-10-05T23:34:49Z DEBUG stderr=
2017-10-05T23:34:49Z DEBUG Starting external process
2017-10-05T23:34:49Z DEBUG args=/usr/bin/certutil -d /etc/ipa/nssdb -A
-n EXAMPLE.COM IPA CA -t CT,C,C -f /etc/ipa/nssdb/pwdfile.txt
2017-10-05T23:34:49Z DEBUG Process finished, return code=255
2017-10-05T23:34:49Z DEBUG stdout=
2017-10-05T23:34:49Z DEBUG stderr=certutil: could not add certificate to
token or database: SEC_ERROR_ADDING_CERT: Error adding certificate to
database.
2017-10-05T23:34:49Z WARNING Installation failed. Force set so not
rolling back changes.
2017-10-05T23:34:49Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in
execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py",
line 333, in run
cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 368, in run
self.execute()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 392, in execute
for _nothing in self._executor():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 463, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 658, in _configure
next(executor)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 463, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 521, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 518, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py",
line 63, in _install
for _nothing in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py",
line 3621, in main
install(self)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py",
line 2348, in install
_install(options)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py",
line 2791, in _install
rval=CLIENT_INSTALL_ERROR)
2017-10-05T23:34:49Z DEBUG The ipa-client-install command failed,
exception: ScriptError: Failed to add EXAMPLE.COM IPA CA to the IPA NSS
database.
2017-10-05T23:34:49Z ERROR Failed to add EXAMPLE.COM IPA CA to the IPA
NSS database.
2017-10-05T23:34:49Z ERROR The ipa-client-install command failed. See
/var/log/ipaclient-install.log for more information
Regards,
Bhavin
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
2387
days inactive
2392
days old
freeipa-users@lists.fedorahosted.org
2 comments
2 participants
participants (2)
-
Bhavin Vaidya -
Florence Blanc-Renaud