lynn said the following on 05/02/2013 07:51 AM:

On 02/05/13 13:07, Anton Aylward wrote:

...

lynn said the following on 05/02/2013 03:06 AM:

...

Question: Why doesn't the kinit work?

Did you enable that service? No. It is a unit;)

Did you use systemctl to see if it had been attempted and failed?

rc-local.service loaded active exited /etc/init.d/boot.local Compatibility

Eh? I thought you said it was a 'unit' Here's its a service.

...

id you use the debug facilities that come with systemd? No. Did you look in the journal? Yes.

And what did that report?

...

Did you try adding logging to the script to see if it did execute at that time but failed? No.

*sigh* That's so obvious! You don't know if sss failed or what. maybe sss needs some precondition that doesn't exist at 'boot time' Remember, systemd is asynchronous and runs stuff in parallel whereas the old sysinit is sequential. The example you have had one and only dependency, that networking is up and running. Just a side note: the .service for spamassassin I first had was like that, but spamassassin as I run it uses 'razor' and so it also needed named to be up and running. I also use the long list of exclusions from http://pgl.yoyo.org/ and that can take a while to load. So I had to make spamassassin.service dependent on named.service. I also needed to make the fetchmail service dependent on spamassassin. Oh and there was postfix which also needed named in order to be able to use spamassassin. All those .service files had to be updated on my system. So if something works from the command line and doesn't work from boot, you may well have an necessary precondition you've overlooked. That's why I'm so hot on checking logs and return code.

...

Systemd logs and traces everything it does, including stuff that it tries to do that fails.

I;'m really disappointed with you in this instance, Lynn. You haven't even attempted to to the very basic investigations that are obvious from reading the man pages.

Thanks. Can anyone help?

I have, bit it seems you've taken offence when I point at the basics. That's why I say I'm disappointed. -- The deepest sin against the human mind is to believe things without evidence. Thomas H. Huxley -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

lynn said the following on 05/02/2013 12:31 PM:

On 02/05/13 14:31, Anton Aylward wrote:

...

*sigh* That's so obvious! You don't know if sss failed or what. maybe sss needs some precondition that doesn't exist at 'boot time' Remember, systemd is asynchronous and runs stuff in parallel whereas the old sysinit is sequential. sssd runs fine. Please look at the original post.

That's no justification for failing to to make sure that the script checks. You only said that it runs when you run it manually. My whole point was that running it manually means that things like DNS and other rpc services are now up.

The network must be available when the script runs as sssd first has to hit the DNS before it then again goes over the wire to request a TGT which it then uses get the ticket for ldap. It produces its cache just fine. My workaround is to copy the sssd cache to /tmp and rename it krb5cc_0.

I think you've jsut proven my point. Being dependent on just network services doesn't m1ean that DNS is available. That's what I got bitten on about spamassassin and why I included that note as an example. That is why I suggested the 'defensive programming' It would show you what was going on at boot time.

I need a standard MIT cache for autofs'd cifs. If it's not there the user shares are not mounted. On the KDC, I can see the mechanism. The user authenticates OK but is refused a cifs ticket until the client machine authenticates.

Just give me the kinit and I'll shut up. Honest.

The way you've set you the dependency systemd will run boot.local any time after the Ethernet port becomes live. This is not sysvinit, there is no defined sequence. It is, as i said, synchronous. It may not even have to work the same way each time :-) It almost certainly will try to run boot.local BEFORE DNS and other very basic network services are up. You might, based on what you've written above, also, and I mean also as in addition to what else I'm suggesting, make the cifs stuff, samba or whatever, dependent on boot.local. That way you're not going to get the cifst stuff unless and until kinit in boot.local runs, which is how I'm reading what you're saying above. I repeat: you need to set up your dependency properly. -- Marketing is the science of convincing us that What You Get Is What You Want. -- John Carter -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 02/05/13 16:03, Anton Aylward wrote:

lynn said the following on 05/02/2013 03:06 AM:

...

sssd kinit -k -t /etc/krb5.keytab CATRAL$

How about making that

sssd || { logger "sshd failed at boot.local" ; exit 10 } kinit -k -t /etc/krb5.keytab CATRAL$ || { \ logger "kinit failed at boot.local"; \ exit 11 } Yep. OK: sssd || { logger "sssd failed at boot.local"; exit 10; } kinit -k -t /etc/krb5.keytab CATRAL$ || { logger "kinit failed at boot.local"; exit 11; }

Nothing. I tested the error condition by moving the sssd and kinit binaries and rebooting, whereupon the error messages duly appeared in journalctl. At least we can take sssd out of the equation. That boots fine. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 02/05/13 21:56, Anton Aylward wrote:

lynn said the following on 05/02/2013 01:37 PM:

...

On 02/05/13 16:03, Anton Aylward wrote:

...

lynn said the following on 05/02/2013 03:06 AM:

...

sssd kinit -k -t /etc/krb5.keytab CATRAL$ How about making that

sssd || { logger "sshd failed at boot.local" ; exit 10 } kinit -k -t /etc/krb5.keytab CATRAL$ || { \ logger "kinit failed at boot.local"; \ exit 11 } Yep. OK: sssd || { logger "sssd failed at boot.local"; exit 10; } kinit -k -t /etc/krb5.keytab CATRAL$ || { logger "kinit failed at boot.local"; exit 11; }

Nothing. I tested the error condition by moving the sssd and kinit binaries and rebooting, whereupon the error messages duly appeared in journalctl.

At least we can take sssd out of the equation. That boots fine. So migrate that 'kinit' into a script and do the same kind or metrication on that too.

But first set up your dependencies properly! They way you have it set up ... see my other post....

Solved offlist. Will post solution here. We need: Requires=network.target in [Unit] Thanks. L x -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org