AFP548 Changing the world one server at a time.

Reuilding Kerberos

Home › Forums › OS X Server and Client Discussion › Open Directory › Reuilding Kerberos

Viewing 2 posts - 1 through 2 (of 2 total)
  • Author
    Posts
  • May 2, 2006 at 5:37 pm #366082
    withayanda
    Participant

    (Sorry for cross-posting from Apple’s boards, but I’m in a bit of a bind here and really need to get this back up.)

    I had to rebuild an OpenDirectory master and Samba PDC the other night after everything came crashing down. I’m still not sure what caused it; my support staff couldn’t give me a straight answer what they were doing when this occurred.

    Anyway, everything is up and running fine now with the exception of Kerberos. I’ve tried doing slapconfig -kerberize diradmin EXAMPLE.COM but it hangs when it gets to mkpassdb -kerberize. Oh, I’m on 10.4.6, btw. And yes, hostname returns the FQDN correctly.

    Any tips on what I should do? Thanks.

    May 2, 2006 at 7:22 pm #366088
    withayanda
    Participant

    Thanks for the response, Josh. Here’s a log of the latest attempt. I let mkpassdb run for 30 minutes before finally killing it. If it matters at all, there are only about 40 users defined on this.

    2006-05-02 13:27:28 -0400 – slapconfig -kerberize
    2006-05-02 13:27:38 -0400 – command: /sbin/kerberosautoconfig -r EXAMPLE.COM -m server01.example.com -u -v 1
    2006-05-02 13:27:38 -0400 – command: /usr/sbin/kdcsetup -f /LDAPv3/127.0.0.1 -w -a diradmin -p **** -v 1 EXAMPLE.COM
    2006-05-02 13:27:44 -0400 – kdcsetup command output:
    Contacting the Directory Server
    Authenticating to the Directory Server
    Creating Kerberos directory
    Creating KDC Config File
    Creating Admin ACL File
    Creating Kerberos Master Key
    Creating Kerberos Database
    Creating Kerberos Admin user
    WARNING: no policy specified for diradmin@EXAMPLE.COM; defaulting to no policy
    Adding kerberos auth authority to admin user
    Creating keytab for the admin tools
    Adding KDC & kadmind to launchd
    edu.mit.kadmind: Already loaded
    Adding the new KDC into the KerberosClient config record
    com.apple.kdcmond: Already loaded
    AddKDCToConfig: KDC is already present in record
    Finished
    2006-05-02 13:27:44 -0400 – command: /usr/sbin/sso_util configure -r EXAMPLE.COM -f /LDAPv3/127.0.0.1 -a diradmin -p **** -v 1 all
    2006-05-02 13:27:45 -0400 – sso_util command output:
    Contacting the directory server
    Creating the service list
    Creating the service principals
    kadmin: Incorrect password while initializing kadmin interface
    kadmin: Incorrect password while initializing kadmin interface
    kadmin: Incorrect password while initializing kadmin interface
    kadmin: Incorrect password while initializing kadmin interface
    kadmin: Incorrect password while initializing kadmin interface
    kadmin: Incorrect password while initializing kadmin interface
    kadmin: Incorrect password while initializing kadmin interface
    kadmin: Incorrect password while initializing kadmin interface
    kadmin: Incorrect password while initializing kadmin interface
    kadmin: Incorrect password while initializing kadmin interface
    kadmin: Incorrect password while initializing kadmin interface
    kadmin: Incorrect password while initializing kadmin interface
    2006-05-02 13:27:45 -0400 – sso_util command failed with status 2
    2006-05-02 13:27:45 -0400 – command: /usr/sbin/sso_util configure -r EXAMPLE.COM -f /LDAPv3/127.0.0.1 -a diradmin -p **** -v 1 ldap
    2006-05-02 13:27:45 -0400 – sso_util command output:
    Contacting the directory server
    Creating the service list
    Creating the service principals
    kadmin: Incorrect password while initializing kadmin interface
    2006-05-02 13:27:45 -0400 – sso_util command failed with status 2
    2006-05-02 13:27:45 -0400 – command: /usr/sbin/mkpassdb -kerberize

  • Author
    Posts
Viewing 2 posts - 1 through 2 (of 2 total)
  • You must be logged in to reply to this topic.