freeipa

#6576 can not promote IPA client to IPA replica
Closed: Invalid Opened by faywang300.

Closed: Invalid
Reopen Issue

I installed ipa server on one system:

ipa-server-install --idstart=100000 --idmax=199999 -a Admin123 -p Admin123 --domain=my.com --realm=MY.COM --no-host-dns --no-ntp --setup-dns --no-forwarders -U

and ipa client on another system:

ipa-client-install --domain=my.com --server=server1.my.com -p admin -w Admin123 --mkhomedir --force-join --no-ntp --enable-dns-updates -U

So far so good. ipa host-find --all shows two hosts.

I then tried to promote the client to be replica:

ipa-replica-install -p Admin123 -w Admin123 --no-host-dns --no-ntp --skip-conncheck --setup-ca --setup-dns --no-forwarders -U

It failed:

  [28/44]: restarting directory server
ipa         : CRITICAL Failed to restart the directory server (Command '/bin/systemctl restart dirs                                                            rv@EYANG-131-DAL10-BI-BICLOUD-COM.service' returned non-zero exit status 1). See the installation l                                                            og for details.

I googled around and found the same issue being posted here:

https://www.redhat.com/archives/freeipa-users/2016-October/msg00337.html

I also tried the command below in the client/replica machine. No "Server-Cert" was printed out:

certutil -L -d /etc/dirsrv/slapd-XXX
These are the files in /etc/dirsrv/slapd-XXX:
-rw-------. 1 dirsrv root   65536 Dec 20 18:47 cert8.db
-rw-rw----. 1 dirsrv dirsrv 65536 Dec 20 18:48 cert8.db.orig
-r--r-----. 1 dirsrv dirsrv  1640 Dec 20 18:47 certmap.conf
-rw-------. 1 dirsrv dirsrv 92251 Dec 20 18:48 dse.ldif
-rw-------. 2 dirsrv dirsrv 92251 Dec 20 18:48 dse.ldif.bak
-rw-------. 2 dirsrv dirsrv 92251 Dec 20 18:48 dse.ldif.startOK
-r--r-----. 1 dirsrv dirsrv 36685 Dec 20 18:47 dse_original.ldif
-rw-------. 1 dirsrv root   16384 Dec 20 18:47 key3.db
-rw-rw----. 1 dirsrv dirsrv 16384 Dec 20 18:48 key3.db.orig
-r--------. 1 dirsrv dirsrv    66 Dec 20 18:48 pin.txt
-rw-------. 1 dirsrv dirsrv    40 Dec 20 18:47 pwdfile.txt
drwxrwx---. 2 dirsrv dirsrv  4096 Dec 20 18:48 schema
-rw-------. 1 dirsrv root   16384 Dec 20 18:48 secmod.db
-rw-rw----. 1 dirsrv dirsrv 16384 Dec 20 18:47 secmod.db.orig
-r--r-----. 1 dirsrv dirsrv 15142 Dec 20 18:47 slapd-collations.conf

This is my ipa version:
ipa-server-4.4.0-14.el7.centos.x86_64

This is my OS version:
CentOS Linux release 7.3.1611 (Core)

I am running out of idea. Any help is highly appreciated!

-fay

error log
errors

Thanks for filing a ticket, you might see a very slow response due to holidays for the next two weeks.

Thanks for the prompt attention. Please let me know how to fix this issue at your earliest convenience!

Could you post ipareplica-install.log ?

I'd recommend not to use --skip-conncheck, using it might hide some issues which can lead to replica installation failure.

I've a hunch that this issue might be a duplicate of #6575 - root cause that PKI is not listening on port 8009. To confirm it. Could you check whether master is internally listening on port 8009 by:
ss -ln | grep 8009

If not then make sure that IPv6 stack is enabled on both master and replica and that master has following line in /etc/hosts

Then restart IPA on master and try again.

ipareplica-install.log is attached.

Also, port 8009 is no tup.

How to enable IPv6 stack?

I encountered a different issue now. On a native system (server-1.my.com) ,

(1) install ipa server with setup-dns flag:

ipa-server-install --idstart=100000 --idmax=199999 -a Admin123 -p Admin123 --domain=my.com --realm=MY.COM --no-host-dns --no-ntp -setup-dns --no-forwarders --no-reverse -U

The domain name has been determined based on the host name.Checking DNS domain my.com., please wait ...
ipa.ipapython.install.cli.install_tool(Server): ERROR DNS zone my.com. already exists in DNS and is handled by server(s): zzzzzzz.com., zzzzzz1.com.
ipa.ipapython.install.cli.install_tool(Server): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

(2) install ipa server without setup-dns flag

ipa-server-install --idstart=100000 --idmax=199999 -a Admin123 -p Admin123 --domain=my.com --realm=MY.COM --no-host-dns --no-ntp -U

During installation,

ipa : ERROR unable to resolve host name server-1.my.com. to IP address, ipa-ca DNS record will be incomplete
Please add records in this file to your DNS system: /tmp/ipa.system.records.CvSKns.db

After installation, port 8009 is up.

ss -nlp | grep 8009

tcp LISTEN 0 100 ::1:8009 :::* users:(("java",pid=18446,fd=84))

(3) install ipa-client on another native system (server-2.my.com):

ipa-client-install --domain=my.com --server=server-1.my.com -p admin -w Admin123 --mkhomedir --force-join --no-ntp -U

(4) promote client to replica failed:
ipa-replica-install -P admin -p Admin123 -w Admin123 --no-host-dns --no-ntp -U

Warning: skipping DNS resolution of host server-1.my.com

Warning: skipping DNS resolution of host server-2.my.com

No usable IP address provided nor resolved.
ipa.ipapython.install.cli.install_tool(Replica): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

In /var/log/ipareplica-install.log:

2016-12-24T23:57:53Z DEBUG No IPA DNS servers, skipping forward/reverse resolution check
2016-12-24T23:57:58Z DEBUG Name server-2.my.com. does not have any address: [Errno -2] Name or service not known
2016-12-24T23:57:58Z DEBUG Destroyed connection context.ldap2_79692624
2016-12-24T23:57:58Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 318, in run
cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 308, in run
self.validate()

Any help is highly appreciated!

Question here is what is the desired DNS setup you want to have.

In 1., IPA tries to avoid situation that it would redefine already existing DNS zone which is handled by other server. It might be desired e.g. in testing environment but problematic in production. This check can be overridden.

Closing - insufficient info.

Metadata Update from @faywang300:
- Issue assigned to someone
- Issue set to the milestone: 0.0 NEEDS_TRIAGE
Metadata
None
None
None
Normal
defect
IPA
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.