我想在Centos 6.3上用ldap后端运行kerberos在创buildRealm之后：
kdb5_ldap_util -D "cn=admin,dc=example,dc=com" create -sscope sub -sf /var/kerberos/krb5kdc/example_stash.keyfile -r EXAMPLE.COM -s 我试图运行kdc ，得到：
Starting Kerberos 5 KDC: krb5kdc: cannot initialize realm EXAMPLE.COM - see log file for details
日志显示这样的错误：
krb5kdc: Error reading password from stash: Bind DN entry missing in stash file - while initializing database for realm EXAMPLE.COM
krb5.conf文件：
[logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true [realms] EXAMPLE.COM = { kdc = kerberos.example.com admin_server = kerberos.example.com master_kdc = kerberos.example.com default_domain = example.com database_module = ldap_example } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM kerberos.example.com = EXAMPLE.COM [appdefaults] pam = { debug = true ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } [dbmodules] ldap_example = { db_library = kldap ## DN for the global Kerberos container entry ldap_kerberos_container_dn = ou=kerberos,ou=Services,dc=example,dc=com ldap_kdc_dn = cn=krbadmin,ou=Services,dc=example,dc=com ## this object needs to have READ rights on the realm container, principal container and realm sub-trees ldap_kadmind_dn = "cn=krbadmin,ou=Services,dc=example,dc=com" ## this object needs to have READ and WRITE rights on the realm container, principal container and realm sub-trees ldap_service_password_file = /var/kerberos/krb5kdc/example_stash.keyfile ldap_servers = ldap://kerberos.example.com ldap_conns_per_server = 5 }
ou=kerberos,ou=Services,dc=example,dc=com和cn=krbadmin,ou=Services,dc=example,dc=com存在。 领域在ou=kerberos之下。 kdb5_ldap_util可以列出它：
kdb5_ldap_util -D cn=admin,dc=example,dc=com list -r EXAMPLE.COM Password for "cn=admin,dc=example,dc=com": EXAMPLE.COM
新build的Stash文件在创build领域之前并不存在。 我已经试着问叔叔，但没有运气。
在使用OpenLDAP后端时，与领域一起创build的存储文件不是有用的，因为它不包含DN。 它看起来像独立的存储文件。
你必须创build存储文件：
kdb5_ldap_util -D "cn=admin,dc=example,dc=com" stashsrvpw -f /var/kerberos/krb5kdc/example_stash.keyfile "cn=krbadmin,ou=Services,dc=example,dc=com"
另一件事是krb5.conf不支持内联注释。