freeipa

#7575 ipa-replica-install fails due to dirsrv listening on ipv6 only
Closed: wontfix Opened by jdshewey.

Closed: wontfix
Reopen Issue

Issue

When installing a replica, during step 27 of 40 of Configuring directory server (dirsrv), setup fails to replicate because the ldap server is allegedly unreachable on port 389.

Steps to Reproduce

  1. run ipa-replica-prepare ldap2.example.com on existing master
  2. Copy the gpg key to the new RHEL 7.4 host
  3. install ipa-server on this host
  4. sudo ipa-replica-install /var/lib/ipa/replica-info-ldap2.example.com --setup-ca --skip-conncheck

Version/Release/Distribution

ipa-server-4.5.0-22.el7_4.x86_64
ipa-client-4.5.0-22.el7_4.x86_64
ipa-server-4.5.0-22.el7_4.x86_64
ipa-client-4.5.0-22.el7_4.x86_64
389-ds-base-1.3.6.1-24.el7_4.x86_64
pki-ca-10.4.1-17.el7_4.noarch
krb5-server-1.15.1-8.el7.x86_64

Root cause:

This happens because the 389 server is listening on ::: and not on 0.0.0.0. As a workaround, users can create a file at /var/lib/dirsrv/boot.ldif with the contents:

dn: cn=config
changetype: modify
replace: nsslapd-listenhost
nsslapd-listenhost: 0.0.0.0

This will cause the INF template defined in ./ipaserver/install/dsinstance.py (line 180) to import the contents of this file at setup and force the 389 server to listen on the correct interface.

This is detailed upstream at https://lists.fedoraproject.org/pipermail/389-users/2010-May/011477.html

FreeIPA relies on IPv6 stack being enabled. 389-ds listens using IPv6 API because it is enough to have both IPv4 and IPv6 covered with the same API -- see man page ipv6(7) for details.

Yes. In this case, the IPv6 Stack IS enabled. The issue is that 389-ds is listening only via ipv6 by default on a fresh install of the OS and not via ipv4. Then during the install, the installer tries to talk with the ipv4 interface, which fails because the 389 server is not listening there. So FreeIPA relies on IPv6 to be enabled, but it isn't using it exclusively for installation, which is causing the installer to fail.
Edited by jdshewey

As I said, listening using IPv6-only on a wildcard address is fine: port space is common between IPv4 and IPv6, so all connections get noticed. On my system it is the same:

# netstat -nltp|grep 389
tcp6       0      0 :::389                  :::*                    LISTEN      16050/ns-slapd      
# ncat -v -4 `hostname` 389
Ncat: Version 7.60 ( https://nmap.org/ncat )
Ncat: Connected to IP.AD.DR.ES:389.
Ncat: 0 bytes sent, 0 bytes received in 0.91 seconds.
#

Is there an update on this? It is working as expected from our perspective.

My suspicion is that the difference is if FIPS-140-2 compliance is enabled. In any event, this method of replica installation is no longer supported in domain 1, so this can probably be closed as a wontfix as it only affects legacy promotion.

Metadata Update from @rcritten:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.