Bug 868419
Summary: | samba4 smb and winbind init scripts missing export KRB5CCNAME | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 6 | Reporter: | Scott Poore <spoore> |
Component: | samba4 | Assignee: | Andreas Schneider <asn> |
Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> |
Severity: | unspecified | Docs Contact: | |
Priority: | unspecified | ||
Version: | 6.4 | CC: | sbose |
Target Milestone: | rc | ||
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | samba4-4.0.0-38.el6.rc3 | Doc Type: | Bug Fix |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2013-02-21 08:36:47 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Scott Poore
2012-10-19 19:22:53 UTC
Verified. Version :: samba4-4.0.0-44.el6.rc4.x86_64 Manual Test Results :: [root@rhel6-1 ~]# grep KRB5CCNAME /etc/init.d/* /etc/init.d/smb:KRB5CCNAME=/var/run/samba/krb5cc_samba /etc/init.d/smb:export KRB5CCNAME /etc/init.d/winbind:KRB5CCNAME=/var/run/samba/krb5cc_samba /etc/init.d/winbind:export KRB5CCNAME [root@rhel6-1 ~]# ipa-adtrust-install The log file for this installation can be found in /var/log/ipaserver-install.log ============================================================================== This program will setup components needed to establish trust to AD domains for the FreeIPA Server. This includes: * Configure Samba * Add trust related objects to FreeIPA LDAP server To accept the default shown in brackets, press the Enter key. IPA generated smb.conf detected. Overwrite smb.conf? [no]: yes The following operations may take some minutes to complete. Please wait until the prompt is returned. Enter the NetBIOS name for the IPA domain. Only up to 15 uppercase ASCII letters and digits are allowed. Example: EXAMPLE. NetBIOS domain name [TESTRELM]: Configuring cross-realm trusts for IPA server requires password for user 'admin'. This user is a regular system account used for IPA server administration. admin password: Configuring CIFS [1/18]: stopping smbd [2/18]: creating samba domain object [3/18]: creating samba config registry [4/18]: writing samba config file [5/18]: adding cifs Kerberos principal [6/18]: adding cifs principal to S4U2Proxy targets cifs principal already targeted, nothing to do. [7/18]: adding admin(group) SIDs Admin SID already set, nothing to do Admin group SID already set, nothing to do [8/18]: adding RID bases RID bases already set, nothing to do [9/18]: updating Kerberos config 'dns_lookup_kdc' already set to 'true', nothing to do. [10/18]: activating CLDAP plugin CLDAP plugin already configured, nothing to do [11/18]: activating sidgen plugin and task Sidgen plugin already configured, nothing to do Sidgen task plugin already configured, nothing to do [12/18]: activating extdom plugin Extdom plugin already configured, nothing to do [13/18]: configuring smbd to start on boot [14/18]: adding special DNS service records [15/18]: restarting Directory Server to take MS PAC and LDAP plugins changes into account [16/18]: adding fallback group Fallback group already set, nothing to do [17/18]: setting SELinux booleans [18/18]: starting CIFS services Done configuring CIFS. ============================================================================= Setup complete You must make sure these network ports are open: TCP Ports: * 138: netbios-dgm * 139: netbios-ssn * 445: microsoft-ds UDP Ports: * 138: netbios-dgm * 139: netbios-ssn * 389: (C)LDAP * 445: microsoft-ds Additionally you have to make sure the FreeIPA LDAP server is not reachable by any domain controller in the Active Directory domain by closing down the following ports for these servers: TCP Ports: * 389, 636: LDAP/LDAPS You may want to choose to REJECT the network packets instead of DROPing them to avoid timeouts on the AD domain controllers. ============================================================================= [root@rhel6-1 ~]# kinit admin Password for admin: [root@rhel6-1 ~]# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: admin Valid starting Expires Service principal 11/08/12 12:33:27 11/09/12 12:33:25 krbtgt/TESTRELM.COM [root@rhel6-1 ~]# ipactl restart Restarting Directory Service Shutting down dirsrv: PKI-IPA... [ OK ] TESTRELM-COM... [ OK ] Starting dirsrv: PKI-IPA... [ OK ] TESTRELM-COM... [ OK ] Restarting krb5kdc Service Stopping Kerberos 5 KDC: [ OK ] Starting Kerberos 5 KDC: [ OK ] Restarting kadmin Service Stopping Kerberos 5 Admin Server: [ OK ] Starting Kerberos 5 Admin Server: [ OK ] Restarting named Service Stopping named: . [ OK ] Starting named: [ OK ] Restarting ipa_memcached Service Stopping ipa_memcached: [ OK ] Starting ipa_memcached: [ OK ] Restarting httpd Service Stopping httpd: [ OK ] Starting httpd: [ OK ] Restarting pki-cad Service Stopping pki-ca: [ OK ] Starting pki-ca: [ OK ] Restarting smb Service Shutting down SMB services: [ OK ] Starting SMB services: [ OK ] Restarting winbind Service Shutting down Winbind services: [ OK ] Starting Winbind services: [ OK ] [root@rhel6-1 ~]# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: admin Valid starting Expires Service principal 11/08/12 12:33:27 11/09/12 12:33:25 krbtgt/TESTRELM.COM So, principal didn't switch to cifs and exports seen in init scripts so looks fixed to me. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0506.html |