Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to run kerberos with ldap back-end on Centos 6.3 After creating Realm with:

kdb5_ldap_util -D "cn=admin,dc=example,dc=com" create -sscope sub -sf /var/kerberos/krb5kdc/example_stash.keyfile -r EXAMPLE.COM -s

I'm trying to run kdc and got:

Starting Kerberos 5 KDC: krb5kdc: cannot initialize realm EXAMPLE.COM - see log file for details

Logs shows such error:

krb5kdc: Error reading password from stash:  Bind DN entry missing in stash file - while initializing database for realm EXAMPLE.COM

krb5.conf file:

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
EXAMPLE.COM = {
kdc = kerberos.example.com
admin_server = kerberos.example.com
master_kdc = kerberos.example.com
default_domain = example.com
database_module = ldap_example
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
kerberos.example.com = EXAMPLE.COM
[appdefaults]
pam = {
debug = true
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
[dbmodules]
ldap_example = {
db_library = kldap
## DN for the global Kerberos container entry
ldap_kerberos_container_dn = ou=kerberos,ou=Services,dc=example,dc=com
ldap_kdc_dn = cn=krbadmin,ou=Services,dc=example,dc=com       ## this object needs to have READ rights on the realm container, principal container and realm sub-trees
ldap_kadmind_dn = "cn=krbadmin,ou=Services,dc=example,dc=com" ## this object needs to have READ and WRITE rights on the realm container, principal container and realm sub-trees
ldap_service_password_file = /var/kerberos/krb5kdc/example_stash.keyfile
ldap_servers = ldap://kerberos.example.com
ldap_conns_per_server = 5
}

Both ou=kerberos,ou=Services,dc=example,dc=com and cn=krbadmin,ou=Services,dc=example,dc=com exists. Realm is under ou=kerberos. kdb5_ldap_util can list it:

kdb5_ldap_util -D cn=admin,dc=example,dc=com list -r EXAMPLE.COM
Password for "cn=admin,dc=example,dc=com": 
EXAMPLE.COM

Stash file is freshly created it didn't existed before creating realm. I already tried to ask Uncle, but without luck

share|improve this question

1 Answer 1

The stash file created along with realm isn't useful while using OpenLDAP back-end as it doesn't contain DN. It looks like standalone stash file.

You have to create stash file with:

kdb5_ldap_util -D "cn=admin,dc=example,dc=com" stashsrvpw -f /var/kerberos/krb5kdc/example_stash.keyfile "cn=krbadmin,ou=Services,dc=example,dc=com"

Another thing that krb5.conf doesn't support inline comments.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.