fedora-infrastructure

#12648 On staging, the IPA servers can't do ldap queries on each other
Closed: Fixed with Explanation by kevin. Opened by abompard.

Closed: Fixed with Explanation
Reopen Issue

It looks like the LDAPs port (636) is not opened between the IPA servers in staging. It works in prod.

[root@ipa01 ~][STG]# ldapsearch -H ldaps://ipa02.stg.rdu3.fedoraproject.org -o nettimeout=10 -b cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=stg,dc=fedoraproject,dc=org 
ldap_sasl_interactive_bind: Can't contact LDAP server (-1)

Using the regular LDAP port fails at the GSSAPI auth step:

[root@ipa01 ~][STG]# ldapsearch -H ldap://ipa02.stg.rdu3.fedoraproject.org -o nettimeout=10 -b cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=stg,dc=fedoraproject,dc=org 
SASL/GSSAPI authentication started
[hangs there]

This works in prod as well. Not sure whether it's a local firewall thing or a network-level thing.

Metadata Update from @kevin:
- Issue assigned to kevin

I don't think this can be a RHIT firewall issue because those 3 servers are in the same network.

ah. I see. Somehow they still have the mtu 9000 there. ;(

Fixed. They had the right config, but somehow linux-system-roles/network didn't refresh the live interface. A 'nmcli c up eth0' fixed it.

Metadata Update from @kevin:
- Issue close_status updated to: Fixed with Explanation
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue status updated to: Closed (was: Open)
- Issue tagged with: low-trouble, medium-gain
Metadata

low-trouble medium-gain

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.