Forgetting something? krb5kdc: No such file or directory - while initializing database for realm COMCAST.COM

[Mathew Rowley]

I am trying to start up a freshly installed/configured MIT kerberos
(1.6.1-31) implementation, but I am obviously missing something.  I am using
an LDAP backend, but the service will not start. Here is what I have done,
can anyone see something I am missing? Or know of a way I can get more
logging?  Thanks.

1. Modified /var/kerberos/krb5kdc/krb.conf to set up the realm

2. Modified /etc/krb5.conf to include ldap information:
[dbdefaults]
 ldap_kerberos_container_dn = cn=krbcontainer,dc=comcast,dc=com
[dbmodules]
 openldap_ldapconf = {
  db_library = kldap
  ldap_kerberos_container_dn = cn=krbcontainer,dc=comcast,dc=com
  ldap_kdc_dn = "cn=kdc,dc=comcast,dc=com"
  # this object needs to have read rights on
  # the realm container, principal container and realm sub-trees
  ldap_kadmind_dn = "cn=kadmin,dc=comcast,dc=com"
  # this object needs to have read and write rights on
  # the realm container, principal container and realm sub-trees
  ldap_service_password_file = /var/kerberos/krb5kdc/kdc5.keyfile
  ldap_servers = ldap://kdc01.security.lab.comcast.net
  ldap_conns_per_server = 5
 }

3. Created the ldap users (kadmin, kdc)

4. Initialized the ldap backed with kdb5_ldap_util ( kdb5_ldap_util -H
ldap://10.252.152.78 -D 'cn=manager,dc=comcast,dc=com' create -subtrees
'dc=comcast,dc=com' -r COMCAST.NET ­s)

5. Stased kadmin and kdc passwords in /var/kerberos/krb5kdc/kdc5.keyfile
using kdb5_ldap_util (kdb5_ldap_util stashsrvpw -f
/var/kerberos/krb5kdc/kdc5.keyfile 'cn=kadmin,dc=comcast,dc=com')

6. Modified ldap ACL as according to
http://web.mit.edu/kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-admin.html but with
my kadmin/kdc name and my dn
(using ldap 2.4.15 ­ with new cn=config)
olcAccess: to dn.base="" by * read
olcAccess: to dn.base="cn=Subschema" by * read
olcAccess: to attrs=userPassword,userPKCS12 by self write
           by * read
olcAccess: to dn.subtree="dc=comcast,dc=com" by
dn.exact="cn=kdc,dc=comcast,dc=com" read
           by dn.exact="cn=kadmin,dc=comcast,dc=com" write
           by * none
olcAccess: to dn.subtree="cn=COMCAST.COM,cn=krbcontainer,dc=comcast,dc=com"
by dn.exact="cn=kdc,dc=comcast,dc=com" read
           by dn.exact="cn=kadmin,dc=comcast,dc=com" write
           by * none
olcAccess: to * by * read

7. Confirmed I can ldapsearch with kadmin and kdc ldap users

8. Tried to start krb5kdc - /etc/init.d/krb5kdc start:
[root at kdc01 krb5kdc]# /etc/init.d/krb5kdc start
Starting Kerberos 5 KDC: krb5kdc: cannot initialize realm COMCAST.COM - see
log file for details
                                                           [FAILED]
[root at kdc01 krb5kdc]# cat /var/log/krb5kdc.log
krb5kdc: No such file or directory - while initializing database for realm
COMCAST.COM

Any ideas?  Thanks for any help.

-- 
MAT