fedora-infrastructure

#11672 Unable to contact id.fedoraproject.org from some hosts of our network (Fedora Zuul CI)
Closed: Fixed by fbo. Opened by fbo.

Closed: Fixed
Reopen Issue

Hello,

Since today, CI jobs performing Koji scratch builds fail to authenticate on Kerberos.
Reported here: https://pagure.io/fedora-ci/general/issue/449

The issue happen from two different hosts: 38.102.83.139 and 38.102.83.54

From other hosts of our network we are not able to reproduce the issue.

KRB5_TRACE=/dev/stdout kinit zuul@FEDORAPROJECT.ORG
[456] 1702047410.011961: Getting initial credentials for zuul@FEDORAPROJECT.ORG
[456] 1702047410.011963: Sending unauthenticated request
[456] 1702047410.011964: Sending request (207 bytes) to FEDORAPROJECT.ORG
[456] 1702047410.011965: Resolving hostname id.fedoraproject.org
[456] 1702047410.011966: Terminating TCP connection to https 38.145.60.20:443
[456] 1702047410.011967: Terminating TCP connection to https 38.145.60.21:443
kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials

Trying a simple curl:

curl -v https://38.145.60.20
*   Trying 38.145.60.20:443...
* connect to 38.145.60.20 port 443 failed: Connection refused
* Failed to connect to 38.145.60.20 port 443 after 23 ms: Couldn't connect to server
* Closing connection 0
curl: (7) Failed to connect to 38.145.60.20 port 443 after 23 ms: Couldn't connect to server
curl -v https://id.fedoraproject.org
*   Trying 38.145.60.20:443...
* connect to 38.145.60.20 port 443 failed: Connection refused
*   Trying 38.145.60.21:443...
* connect to 38.145.60.21 port 443 failed: Connection refused
* Failed to connect to id.fedoraproject.org port 443 after 257 ms: Couldn't connect to server
* Closing connection 0
curl: (7) Failed to connect to id.fedoraproject.org port 443 after 257 ms: Couldn't connect to server

This same curl command is working as expected from other hosts of our network excepted from the both specified IP addresses.
```

Could it be possible that those IP addresses have been banned ?

Thanks for your help

Ditto from IP 67.169.215.NNN , ICMP "tcp port https unreachable".

sorry about that. We have been getting large spikes in koji requests, driving the db load way up, and I tried blocking ip's with a lot of requests around those times. ;(

Unfortunately this blocked some legit ip's as well.

I have cleared them all out for now, as that wasn't in the end really helping the load issues either. ;(

Please confirm you are all able to access things again now and we can then close this.

All clear from me on the 67.169.215.NNN IP, thanks!

@fbo can you confirm you are back and working?

@kevin thanks yes it's back and working as expected.

Metadata Update from @fbo:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.