Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 2023-07-12T03:50:08Z DEBUG Logging to /var/log/ipaclient-install.log
- 2023-07-12T03:50:08Z DEBUG ipa-client-install was invoked with arguments [] and options: {'unattended': True, 'principal': None, 'prompt_password': False, 'on_master': True, 'ca_cert_files': None, 'force': False, 'configure_firefox': False, 'firefox_dir': None, 'keytab': None, 'mkhomedir': False, 'force_join': False, 'ntp_servers': None, 'ntp_pool': None, 'no_ntp': True, 'force_ntpd': False, 'nisdomain': None, 'no_nisdomain': False, 'ssh_trust_dns': False, 'no_ssh': False, 'no_sshd': False, 'no_sudo': False, 'subid': False, 'no_dns_sshfp': False, 'kinit_attempts': None, 'request_cert': False, 'ip_addresses': None, 'all_ip_addresses': False, 'fixed_primary': False, 'permit': False, 'enable_dns_updates': False, 'no_krb5_offline_passwords': False, 'preserve_sssd': False, 'pkinit_identity': None, 'pkinit_anchors': None, 'automount_location': None, 'domain_name': 'ipa-test.novalocal', 'servers': ['ipamaster.ipa-test.novalocal'], 'realm_name': 'IPA-TEST-NOTLIKEDOMAIN.NOVALOCAL', 'host_name': 'ipamaster.ipa-test.novalocal', 'verbose': True, 'quiet': False, 'log_file': None, 'uninstall': False}
- 2023-07-12T03:50:08Z DEBUG IPA version 4.9.11-alt0.p10.1
- 2023-07-12T03:50:08Z DEBUG IPA platform altlinux
- 2023-07-12T03:50:08Z DEBUG IPA os-release starter kit p10 (Hypericum)
- 2023-07-12T03:50:08Z DEBUG Starting external process
- 2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled']
- 2023-07-12T03:50:08Z DEBUG Process execution failed
- 2023-07-12T03:50:08Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
- 2023-07-12T03:50:08Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
- 2023-07-12T03:50:08Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
- 2023-07-12T03:50:08Z DEBUG Starting external process
- 2023-07-12T03:50:08Z DEBUG args=['sudo', '-V']
- 2023-07-12T03:50:08Z DEBUG Process finished, return code=0
- 2023-07-12T03:50:08Z DEBUG stdout=Sudo version 1.9.13p3
- Configure options: --build=x86_64-alt-linux --host=x86_64-alt-linux --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec/sudo --localstatedir=/var/lib --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --disable-dependency-tracking --disable-silent-rules --without-included-gettext --with-logging=syslog --with-logfac=authpriv --enable-shell-sets-home --enable-log-host --disable-rpath --with-pam --with-ignore-dot --with-env-editor --with-tty-tickets --with-sudoers-mode=0400 --with-editor=/bin/vitmp --with-sendmail=/usr/sbin/sendmail --with-sssd --with-selinux --with-linux-audit --enable-python --docdir=/usr/share/doc/sudo-1.9.13p3 --with-plugindir=/usr/lib64/sudo --libexecdir=/usr/lib64 --with-secure-path=/sbin:/usr/sbin:/usr/local/sbin:/bin:/usr/bin:/usr/local/bin --with-passprompt=[sudo] password for %p:
- Sudoers policy plugin version 1.9.13p3
- Sudoers file grammar version 50
- Sudoers path: /etc/sudoers
- Authentication methods: 'pam'
- Syslog facility if syslog is being used for logging: authpriv
- Syslog priority to use when user authenticates successfully: notice
- Syslog priority to use when user authenticates unsuccessfully: alert
- Ignore '.' in $PATH
- Send mail if the user is not in sudoers
- Lecture user the first time they run sudo
- Require users to authenticate by default
- Root may run sudo
- Log the hostname in the (non-syslog) log file
- Set $HOME to the target user when starting a shell with -s
- Allow some information gathering to give useful error messages
- Visudo will honor the EDITOR environment variable
- Set the LOGNAME and USER environment variables
- Length at which to wrap log file lines (0 for no wrap): 80
- Authentication timestamp timeout: 5.0 minutes
- Password prompt timeout: 5.0 minutes
- Number of tries to enter a password: 3
- Umask to use or 0777 to use user's: 022
- Path to mail program: /usr/sbin/sendmail
- Flags for mail program: -t
- Address to send mail to: root
- Subject line for mail messages: *** SECURITY information for %h ***
- Incorrect password message: Sorry, try again.
- Path to lecture status dir: /var/db/sudo/lectured
- Path to authentication timestamp dir: /run/sudo/ts
- Default password prompt: [sudo] password for %p:
- Default user to run commands as: root
- Value to override user's $PATH with: /sbin:/usr/sbin:/usr/local/sbin:/bin:/usr/bin:/usr/local/bin
- Path to the editor for use by visudo: /bin/vitmp
- When to require a password for 'list' pseudocommand: any
- When to require a password for 'verify' pseudocommand: all
- File descriptors >= 3 will be closed before executing a command
- Reset the environment to a default set of variables
- Environment variables to check for safety:
- TZ
- TERM
- LINGUAS
- LC_*
- LANGUAGE
- LANG
- COLORTERM
- Environment variables to remove:
- *=()*
- RUBYOPT
- RUBYLIB
- PYTHONUSERBASE
- PYTHONINSPECT
- PYTHONPATH
- PYTHONHOME
- TMPPREFIX
- ZDOTDIR
- READNULLCMD
- NULLCMD
- FPATH
- PERL5DB
- PERL5OPT
- PERL5LIB
- PERLLIB
- PERLIO_DEBUG
- JAVA_TOOL_OPTIONS
- SHELLOPTS
- BASHOPTS
- GLOBIGNORE
- PS4
- BASH_ENV
- ENV
- TERMCAP
- TERMPATH
- TERMINFO_DIRS
- TERMINFO
- _RLD*
- LD_*
- PATH_LOCALE
- NLSPATH
- HOSTALIASES
- RES_OPTIONS
- LOCALDOMAIN
- CDPATH
- IFS
- Environment variables to preserve:
- XDG_CURRENT_DESKTOP
- XAUTHORIZATION
- XAUTHORITY
- PS2
- PS1
- PATH
- LS_COLORS
- KRB5CCNAME
- HOSTNAME
- DISPLAY
- COLORS
- Locale to use while parsing sudoers: C
- Directory in which to store input/output logs: /var/log/sudo-io
- File in which to store the input/output log: %{seq}
- Add an entry to the utmp/utmpx file when allocating a pty
- PAM service name to use: sudo
- PAM service name to use for login shells: sudo
- Attempt to establish PAM credentials for the target user
- Create a new PAM session for the command to run in
- Perform PAM account validation management
- Enable sudoers netgroup support
- Check parent directories for writability when editing files with sudoedit
- Allow commands to be run even if sudo cannot write to the audit log
- Allow commands to be run even if sudo cannot write to the log file
- Log entries larger than this value will be split into multiple syslog messages: 960
- File mode to use for the I/O log files: 0600
- Execute commands by file descriptor instead of by path: digest_only
- Type of authentication timestamp record: tty
- Ignore case when matching user names
- Ignore case when matching group names
- Log when a command is allowed by sudoers
- Log when a command is denied by sudoers
- Sudo log server timeout in seconds: 30
- Enable SO_KEEPALIVE socket option on the socket connected to the logserver
- Verify that the log server's certificate is valid
- Set the pam remote user to the user running sudo
- The format of logs to produce: sudo
- Enable SELinux RBAC support
- Allow an intercepted command to run set setuid or setgid programs
- The largest size core dump file that may be created (in bytes): 0,0
- Store plaintext passwords in I/O log input
- List of regular expressions to use when matching a password prompt
- [Pp]assword[: ]*
- The mechanism used by the intercept and log_subcmds options: trace
- Attempt to verify the command and arguments after execution
- Local IP address and netmask pairs:
- 172.28.19.181/255.255.255.0
- 172.17.0.1/255.255.0.0
- fe80::f816:3eff:fee9:64ac/ffff:ffff:ffff:ffff::
- fe80::42:53ff:fef8:ead/ffff:ffff:ffff:ffff::
- fe80::b032:aff:feb6:66bc/ffff:ffff:ffff:ffff::
- Sudoers I/O plugin version 1.9.13p3
- Sudoers audit plugin version 1.9.13p3
- 2023-07-12T03:50:08Z DEBUG stderr=
- 2023-07-12T03:50:08Z WARNING Using existing certificate '/etc/ipa/ca.crt'.
- 2023-07-12T03:50:08Z DEBUG [IPA Discovery]
- 2023-07-12T03:50:08Z DEBUG Starting IPA discovery with domain=ipa-test.novalocal, servers=['ipamaster.ipa-test.novalocal'], hostname=ipamaster.ipa-test.novalocal
- 2023-07-12T03:50:08Z DEBUG Server and domain forced
- 2023-07-12T03:50:08Z DEBUG [Kerberos realm search]
- 2023-07-12T03:50:08Z DEBUG Kerberos realm forced
- 2023-07-12T03:50:08Z DEBUG [LDAP server check]
- 2023-07-12T03:50:08Z DEBUG Verifying that ipamaster.ipa-test.novalocal (realm IPA-TEST-NOTLIKEDOMAIN.NOVALOCAL) is an IPA server
- 2023-07-12T03:50:08Z DEBUG Init LDAP connection to: ldap://ipamaster.ipa-test.novalocal:389
- 2023-07-12T03:50:08Z DEBUG Search LDAP server for IPA base DN
- 2023-07-12T03:50:08Z DEBUG Check if naming context 'dc=ipa-test-notlikedomain,dc=novalocal' is for IPA
- 2023-07-12T03:50:08Z DEBUG Naming context 'dc=ipa-test-notlikedomain,dc=novalocal' is a valid IPA context
- 2023-07-12T03:50:08Z DEBUG Search for (objectClass=krbRealmContainer) in dc=ipa-test-notlikedomain,dc=novalocal (sub)
- 2023-07-12T03:50:08Z DEBUG Found: cn=IPA-TEST-NOTLIKEDOMAIN.NOVALOCAL,cn=kerberos,dc=ipa-test-notlikedomain,dc=novalocal
- 2023-07-12T03:50:08Z DEBUG Discovery result: Success; server=ipamaster.ipa-test.novalocal, domain=ipa-test.novalocal, kdc=ipamaster.ipa-test.novalocal, basedn=dc=ipa-test-notlikedomain,dc=novalocal
- 2023-07-12T03:50:08Z DEBUG Validated servers: ipamaster.ipa-test.novalocal
- 2023-07-12T03:50:08Z DEBUG will use discovered domain: ipa-test.novalocal
- 2023-07-12T03:50:08Z DEBUG Using servers from command line, disabling DNS discovery
- 2023-07-12T03:50:08Z DEBUG will use provided server: ipamaster.ipa-test.novalocal
- 2023-07-12T03:50:08Z DEBUG will use discovered realm: IPA-TEST-NOTLIKEDOMAIN.NOVALOCAL
- 2023-07-12T03:50:08Z DEBUG will use discovered basedn: dc=ipa-test-notlikedomain,dc=novalocal
- 2023-07-12T03:50:08Z INFO Client hostname: ipamaster.ipa-test.novalocal
- 2023-07-12T03:50:08Z DEBUG Hostname source: Provided as option
- 2023-07-12T03:50:08Z INFO Realm: IPA-TEST-NOTLIKEDOMAIN.NOVALOCAL
- 2023-07-12T03:50:08Z DEBUG Realm source: Discovered from LDAP DNS records in ipamaster.ipa-test.novalocal
- 2023-07-12T03:50:08Z INFO DNS Domain: ipa-test.novalocal
- 2023-07-12T03:50:08Z DEBUG DNS Domain source: Forced
- 2023-07-12T03:50:08Z INFO IPA Server: ipamaster.ipa-test.novalocal
- 2023-07-12T03:50:08Z DEBUG IPA Server source: Provided as option
- 2023-07-12T03:50:08Z INFO BaseDN: dc=ipa-test-notlikedomain,dc=novalocal
- 2023-07-12T03:50:08Z DEBUG BaseDN source: From IPA server ldap://ipamaster.ipa-test.novalocal:389
- 2023-07-12T03:50:08Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
- 2023-07-12T03:50:08Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
- 2023-07-12T03:50:08Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
- 2023-07-12T03:50:08Z DEBUG Saving StateFile to '/var/lib/ipa-client/sysrestore/sysrestore.state'
- 2023-07-12T03:50:08Z DEBUG Skipping attempt to configure and synchronize time with CHRONY server as it has been already done on master.
- 2023-07-12T03:50:08Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf'
- 2023-07-12T03:50:08Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index'
- 2023-07-12T03:50:08Z INFO Configured /etc/sssd/sssd.conf
- 2023-07-12T03:50:08Z DEBUG Initializing principal host/[email protected] using keytab /data/etc/krb5.keytab
- 2023-07-12T03:50:08Z DEBUG using ccache /etc/ipa/.dns_ccache
- 2023-07-12T03:50:08Z DEBUG Attempt 1/5: success
- 2023-07-12T03:50:08Z DEBUG Starting external process
- 2023-07-12T03:50:08Z DEBUG args=['/usr/bin/certutil', '-d', '/tmp/tmpgi6acve3', '-N', '-f', '/tmp/tmpgi6acve3/pwdfile.txt', '-@', '/tmp/tmpgi6acve3/pwdfile.txt']
- 2023-07-12T03:50:08Z DEBUG Process finished, return code=0
- 2023-07-12T03:50:08Z DEBUG stdout=
- 2023-07-12T03:50:08Z DEBUG stderr=
- 2023-07-12T03:50:08Z DEBUG Starting external process
- 2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled']
- 2023-07-12T03:50:08Z DEBUG Process execution failed
- 2023-07-12T03:50:08Z DEBUG Starting external process
- 2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled']
- 2023-07-12T03:50:08Z DEBUG Process execution failed
- 2023-07-12T03:50:08Z DEBUG Starting external process
- 2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled']
- 2023-07-12T03:50:08Z DEBUG Process execution failed
- 2023-07-12T03:50:08Z DEBUG Starting external process
- 2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled']
- 2023-07-12T03:50:08Z DEBUG Process execution failed
- 2023-07-12T03:50:08Z DEBUG Starting external process
- 2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled']
- 2023-07-12T03:50:08Z DEBUG Process execution failed
- 2023-07-12T03:50:08Z DEBUG Starting external process
- 2023-07-12T03:50:08Z DEBUG args=['/usr/bin/certutil', '-d', 'sql:/tmp/tmpgi6acve3', '-A', '-n', 'CA certificate 1', '-t', 'C,,', '-a', '-f', '/tmp/tmpgi6acve3/pwdfile.txt']
- 2023-07-12T03:50:08Z DEBUG Process finished, return code=0
- 2023-07-12T03:50:08Z DEBUG stdout=
- 2023-07-12T03:50:08Z DEBUG stderr=
- 2023-07-12T03:50:08Z DEBUG failed to find session_cookie in persistent storage for principal 'host/[email protected]'
- 2023-07-12T03:50:08Z DEBUG trying https://ipamaster.ipa-test.novalocal/ipa/json
- 2023-07-12T03:50:08Z DEBUG Created connection context.rpcclient_139827748309840
- 2023-07-12T03:50:08Z DEBUG [try 1]: Forwarding 'schema' to json server 'https://ipamaster.ipa-test.novalocal/ipa/json'
- 2023-07-12T03:50:08Z DEBUG ENTERING SINGLE_REQUEST
- 2023-07-12T03:50:08Z DEBUG HOST:i (ipamaster.ipa-test.novalocal)
- 2023-07-12T03:50:08Z DEBUG HANDLER: (/ipa/json)
- 2023-07-12T03:50:08Z DEBUG REQUEST_BODY: (b'{"method": "schema", "params": [[], {"version": "2.170"}], "id": 0}')
- 2023-07-12T03:50:08Z DEBUG New HTTP connection (ipamaster.ipa-test.novalocal)
- 2023-07-12T03:50:08Z DEBUG HTTP connection destroyed (ipamaster.ipa-test.novalocal)
- Traceback (most recent call last):
- File "/usr/lib64/python3/site-packages/ipaclient/remote_plugins/__init__.py", line 120, in get_package
- plugins = api._remote_plugins
- AttributeError: 'API' object has no attribute '_remote_plugins'
- During handling of the above exception, another exception occurred:
- Traceback (most recent call last):
- File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 727, in single_request
- if not self._auth_complete(response):
- File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 673, in _auth_complete
- raise errors.KerberosError(
- ipalib.errors.KerberosError: No valid Negotiate header in server response
- 2023-07-12T03:50:08Z DEBUG Destroyed connection context.rpcclient_139827748309840
- 2023-07-12T03:50:08Z DEBUG File "/usr/lib64/python3/site-packages/ipapython/admintool.py", line 180, in execute
- return_value = self.run()
- File "/usr/lib64/python3/site-packages/ipapython/install/cli.py", line 344, in run
- return cfgr.run()
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 360, in run
- return self.execute()
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 386, in execute
- for rval in self._executor():
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 431, in __runner
- exc_handler(exc_info)
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
- self._handle_exception(exc_info)
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 450, in _handle_exception
- six.reraise(*exc_info)
- File "/usr/lib/python3/site-packages/six.py", line 703, in reraise
- raise value
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 421, in __runner
- step()
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 418, in <lambda>
- step = lambda: next(self.__gen)
- File "/usr/lib64/python3/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
- six.reraise(*exc_info)
- File "/usr/lib/python3/site-packages/six.py", line 703, in reraise
- raise value
- File "/usr/lib64/python3/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
- value = gen.send(prev_value)
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 655, in _configure
- next(executor)
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 431, in __runner
- exc_handler(exc_info)
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
- self._handle_exception(exc_info)
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 518, in _handle_exception
- self.__parent._handle_exception(exc_info)
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 450, in _handle_exception
- six.reraise(*exc_info)
- File "/usr/lib/python3/site-packages/six.py", line 703, in reraise
- raise value
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 515, in _handle_exception
- super(ComponentBase, self)._handle_exception(exc_info)
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 450, in _handle_exception
- six.reraise(*exc_info)
- File "/usr/lib/python3/site-packages/six.py", line 703, in reraise
- raise value
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 421, in __runner
- step()
- File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 418, in <lambda>
- step = lambda: next(self.__gen)
- File "/usr/lib64/python3/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
- six.reraise(*exc_info)
- File "/usr/lib/python3/site-packages/six.py", line 703, in reraise
- raise value
- File "/usr/lib64/python3/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
- value = gen.send(prev_value)
- File "/usr/lib64/python3/site-packages/ipapython/install/common.py", line 65, in _install
- for unused in self._installer(self.parent):
- File "/usr/lib64/python3/site-packages/ipaclient/install/client.py", line 4041, in main
- install(self)
- File "/usr/lib64/python3/site-packages/ipaclient/install/client.py", line 2643, in install
- _install(options, dict())
- File "/usr/lib64/python3/site-packages/ipaclient/install/client.py", line 123, in inner
- func(options, tdict)
- File "/usr/lib64/python3/site-packages/ipaclient/install/client.py", line 2965, in _install
- api.finalize()
- File "/usr/lib64/python3/site-packages/ipalib/plugable.py", line 753, in finalize
- self.__do_if_not_done('load_plugins')
- File "/usr/lib64/python3/site-packages/ipalib/plugable.py", line 432, in __do_if_not_done
- getattr(self, name)()
- File "/usr/lib64/python3/site-packages/ipalib/plugable.py", line 632, in load_plugins
- for package in self.packages:
- File "/usr/lib64/python3/site-packages/ipalib/__init__.py", line 952, in packages
- ipaclient.remote_plugins.get_package(self),
- File "/usr/lib64/python3/site-packages/ipaclient/remote_plugins/__init__.py", line 128, in get_package
- plugins = schema.get_package(server_info, client)
- File "/usr/lib64/python3/site-packages/ipaclient/remote_plugins/schema.py", line 546, in get_package
- schema = Schema(client)
- File "/usr/lib64/python3/site-packages/ipaclient/remote_plugins/schema.py", line 395, in __init__
- fingerprint, ttl = self._fetch(client, ignore_cache=read_failed)
- File "/usr/lib64/python3/site-packages/ipaclient/remote_plugins/schema.py", line 420, in _fetch
- schema = client.forward(u'schema', **kwargs)['result']
- File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 1149, in forward
- return self._call_command(command, params)
- File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 1125, in _call_command
- return command(*params)
- File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 1279, in _call
- return self.__request(name, args)
- File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 1242, in __request
- response = self.__transport.request(
- File "/usr/lib64/python3.9/xmlrpc/client.py", line 1166, in request
- return self.single_request(host, handler, request_body, verbose)
- File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 727, in single_request
- if not self._auth_complete(response):
- File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 673, in _auth_complete
- raise errors.KerberosError(
- 2023-07-12T03:50:08Z DEBUG The ipa-client-install command failed, exception: KerberosError: No valid Negotiate header in server response
- 2023-07-12T03:50:08Z ERROR No valid Negotiate header in server response
- 2023-07-12T03:50:08Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
Advertisement
Add Comment
Please, Sign In to add comment