Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 2 ■ CENTRALIZING YOUR NETWORK: KERBEROS, LDAP, AND NFSTroubleshootingHere are some things to look for if it doesn’t work:• Check the permissions on /etc/ldap/cacert.pem. They need to be world-readable.• Check /etc/hosts if the hostname is resolving incorrectly. This will show up in thedebugging output. Your client must be trying server.example.com, not just server,because it must match what’s in the certificate.• If you get the error “Key version for principal in keytable is incorrect,” there is amismatch between the Kerberos keytab and the master server. On the LDAP host,run kadmin -p krbadm, and execute the following:ktrem ldap/server.example.comdelprinc ldap/server.example.comaddprinc -randkey ldap/server.example.comktadd ldap/server.example.com• If you get the error “GSSAPI Error: Miscellaneous failure (Permission denied),”check that the LDAP keytab is readable by the LDAP user (openldap) and that slapdis looking at the correct keytab. You can test this quickly by also addingldap/server.example.com to the system keytab at /etc/krb5.keytab and makingthat world-readable:kadmin -p krbadm -q "ktadd -k /etc/krb5.keytab ldap/server.example.com"chmod a+r /etc/krb5.keytabIf that starts things working, then your keytab may be the problem. Remember tochange /etc/krb5.keytab back to root-only afterward:chmod go-r /etc/krb5.keytaband remove the ldap/server.example.com entry from your main keytab:kadmin -p krbadm -q “ktrem -k /etc/krb5.keytab ldap/server.example.com”• Add -d 16383 to the ldapsearch line to enable copious debugging output.However, having high levels of debugging will slow things down hugely. That’sfine when setting up but not good for a production server. Turn debugging off ordown (set loglevel in /etc/ldap/slapd.conf to 0 or 1) once things are working. Ifyou are not getting errors but ldapsearch appears to be hanging, try reducing thelog levels in /etc/ldap/slapd.conf and restarting slapd.2-5. Populating the LDAP DatabaseThere are many options to populate the database. If you already have users, you’ll want to migrate yourdata. Use the migrationtools package on Debian. This works fine for regular Unix setup (/etc/passwd,/etc/shadow, /etc/groups) and also for NIS. With some adjustment, it will also work for NIS+. You’ll needto take a look at your NIS+ files and the migrationtools scripts and edit them as necessary. You will,however, need to migrate your passwords to Kerberos by hand. This may be a good moment to makeeveryone change their passwords!35Download at WoweBook.Com