freeipa

#7824 ipa-replica-install failure
Closed: invalid by cheimes. Opened by georgeperfect.

Closed: invalid
Reopen Issue

Issue

ipa-replica-install fails with "Connection check failed!"

Steps to Reproduce

  1. Create and configure a mast IPA server with ipa-server-install and web UI
  2. Create a second server with free-ipa-server and free-ipa-server-dns installed. Enroll in the domain created in step 1 then try to promote with ipa-replica-install --setup-ca --setup-kra --setup-dns --forwarder=192.168.100.5 --forwarder=192.168.100.6

Actual behavior

The ipa-replica-install-command fails with (ultimately) "Connection check failed!":

Password for admin@ANADIGI.LOC:
Checking DNS forwarders, please wait ...
Run connection check to master
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

Connection check failed!
See /var/log/ipareplica-conncheck.log for more information.
If the check results are not valid it can be skipped with --skip-conncheck parameter.
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

Expected behavior

The second server to be upgraded to a replica

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.7.2-1.fc29.x86_64
freeipa-client-4.7.2-1.fc29.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-1.4.0.20-1.fc29.x86_64
pki-ca-10.6.8-3.fc29.noarch
krb5-server-1.16.1-23.fc29.x86_64

uname -a
Linux anamas2.anadigi.loc 4.19.13-300.fc29.x86_64 #1 SMP Sat Dec 29 22:54:28 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux (Fedora 29 fully up to date)

Additional info:

The problem arises during the reverse connection check from the established master (anamas1) to the second server trying to be promoted (anamas2). All ports are open (firewalld is stopped) and all usual DNS checks (eg; with dig or nslookup on both forward and reverse IPs) work as expected. Examination of /var/log/ipareplica-install.log shows that the correct IP address is initially identified for anamas2 (192.168.100.12) the RDNS correctly checked and the relevant ports opened on that server for the check but according to the logs the check tries to contact anamas2 on IP 192.168.10.121 causing the failure (there is no device with that address on the network and no DNS entry with that value) - see /var/log/ipareplica-install.log, below.

If an attempt to perform ipa-replica-install is made with --skip-conncheck the install it fails with similar results though leaving the system partially configured requiring use of ipa-replica-manage del anamas2.anadigi.loc on the master server and ipa-replica-install --uninstall on anamas2 - followed by replacement of the RDNS entry for 192.168.100.12 (anamas2) on anamas1 and re-enrollment of the ipa-client stage.

cat /var/log/ipareplica-install.log
2019-01-04T09:07:51Z DEBUG Logging to /var/log/ipareplica-install.log
2019-01-04T09:07:51Z DEBUG ipa-replica-install was invoked with arguments [] and options: {'unattended': False, 'ip_addresses': None, 'domain_name': None, 'servers': None, 'realm_name': None, 'host_name': None, 'principal': None, 'setup_adtrust': False, 'setup_ca': True, 'setup_kra': True, 'setup_dns': True, 'no_pkinit': False, 'no_ui_redirect': False, 'dirsrv_config_file': None, 'dirsrv_cert_files': None, 'http_cert_files': None, 'pkinit_cert_files': None, 'dirsrv_cert_name': None, 'http_cert_name': None, 'pkinit_cert_name': None, 'keytab': None, 'mkhomedir': False, 'force_join': False, 'ntp_servers': None, 'ntp_pool': None, 'no_ntp': False, 'force_ntpd': False, 'ssh_trust_dns': False, 'no_ssh': False, 'no_sshd': False, 'no_dns_sshfp': False, 'skip_schema_check': False, 'allow_zone_overlap': False, 'reverse_zones': None, 'no_reverse': False, 'auto_reverse': False, 'forwarders': [CheckedIPAddressLoopback('192.168.100.5'), CheckedIPAddressLoopback('192.168.100.6')], 'no_forwarders': False, 'auto_forwarders': False, 'forward_policy': None, 'no_dnssec_validation': False, 'no_host_dns': False, 'add_sids': False, 'add_agents': False, 'enable_compat': False, 'netbios_name': None, 'no_msdcs': False, 'rid_base': None, 'secondary_rid_base': None, 'skip_conncheck': False, 'verbose': False, 'quiet': False, 'log_file': None}
2019-01-04T09:07:51Z DEBUG IPA version 4.7.2-1.fc29
2019-01-04T09:07:51Z DEBUG Searching for an interface of IP address: ::1
2019-01-04T09:07:51Z DEBUG Testing local IP address: ::1/128 (interface: lo)
2019-01-04T09:07:51Z DEBUG Starting external process
2019-01-04T09:07:51Z DEBUG args=['/usr/sbin/selinuxenabled']
2019-01-04T09:07:51Z DEBUG Process finished, return code=1
2019-01-04T09:07:51Z DEBUG stdout=
2019-01-04T09:07:51Z DEBUG stderr=
2019-01-04T09:07:51Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2019-01-04T09:07:51Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2019-01-04T09:07:51Z DEBUG httpd is not configured
2019-01-04T09:07:51Z DEBUG kadmin is not configured
2019-01-04T09:07:51Z DEBUG dirsrv is not configured
2019-01-04T09:07:51Z DEBUG pki-tomcatd is not configured
2019-01-04T09:07:51Z DEBUG install is not configured
2019-01-04T09:07:51Z DEBUG krb5kdc is not configured
2019-01-04T09:07:51Z DEBUG named is not configured
2019-01-04T09:07:51Z DEBUG filestore is tracking no files
2019-01-04T09:07:51Z DEBUG Starting external process
2019-01-04T09:07:51Z DEBUG args=['/bin/systemctl', 'is-enabled', 'ntpd.service']
2019-01-04T09:07:52Z DEBUG Process finished, return code=1
2019-01-04T09:07:52Z DEBUG stdout=
2019-01-04T09:07:52Z DEBUG stderr=Failed to get unit file state for ntpd.service: No such file or directory

2019-01-04T09:07:52Z DEBUG Starting external process
2019-01-04T09:07:52Z DEBUG args=['/bin/systemctl', 'is-active', 'ntpd.service']
2019-01-04T09:07:52Z DEBUG Process finished, return code=3
2019-01-04T09:07:52Z DEBUG stdout=inactive

2019-01-04T09:07:52Z DEBUG stderr=
2019-01-04T09:07:52Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2019-01-04T09:07:52Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2019-01-04T09:07:52Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2019-01-04T09:07:52Z DEBUG importing all plugin modules in ipaserver.plugins...
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.aci
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.automember
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.automount
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.baseldap
2019-01-04T09:07:52Z DEBUG ipaserver.plugins.baseldap is not a valid plugin module
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.baseuser
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.batch
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.ca
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.caacl
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.cert
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.certmap
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.certprofile
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.config
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.delegation
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.dns
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.dnsserver
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.dogtag
2019-01-04T09:07:52Z DEBUG skipping plugin module ipaserver.plugins.dogtag: dogtag not selected as RA plugin
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.domainlevel
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.group
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.hbac
2019-01-04T09:07:52Z DEBUG ipaserver.plugins.hbac is not a valid plugin module
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.hbacrule
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.hbacsvc
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.hbacsvcgroup
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.hbactest
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.host
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.hostgroup
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.idrange
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.idviews
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.internal
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.join
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.krbtpolicy
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.ldap2
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.location
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.migration
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.misc
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.netgroup
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.otp
2019-01-04T09:07:52Z DEBUG ipaserver.plugins.otp is not a valid plugin module
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.otpconfig
2019-01-04T09:07:52Z DEBUG importing plugin module ipaserver.plugins.otptoken
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.passwd
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.permission
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.ping
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.pkinit
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.privilege
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.pwpolicy
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.rabase
2019-01-04T09:07:53Z DEBUG ipaserver.plugins.rabase is not a valid plugin module
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.radiusproxy
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.realmdomains
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.role
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.schema
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.selfservice
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.selinuxusermap
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.server
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.serverrole
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.serverroles
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.service
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.servicedelegation
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.session
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.stageuser
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.sudo
2019-01-04T09:07:53Z DEBUG ipaserver.plugins.sudo is not a valid plugin module
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.sudocmd
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.sudocmdgroup
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.sudorule
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.topology
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.trust
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.user
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.vault
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.virtual
2019-01-04T09:07:53Z DEBUG ipaserver.plugins.virtual is not a valid plugin module
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.whoami
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.plugins.xmlserver
2019-01-04T09:07:53Z DEBUG importing all plugin modules in ipaserver.install.plugins...
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.adtrust
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.ca_renewal_master
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.dns
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.fix_replica_agreements
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.rename_managed
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_ca_topology
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_dna_shared_config
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_fix_duplicate_cacrt_in_ldap
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_idranges
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_ldap_server_list
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_managed_permissions
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_nis
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_pacs
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_passsync
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_ra_cert_store
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_referint
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_services
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.update_uniqueness
2019-01-04T09:07:53Z DEBUG importing plugin module ipaserver.install.plugins.upload_cacrt
2019-01-04T09:07:59Z DEBUG Check if anamas2.anadigi.loc is a primary hostname for localhost
2019-01-04T09:07:59Z DEBUG Primary hostname for localhost: anamas2.anadigi.loc
2019-01-04T09:07:59Z DEBUG Search DNS for anamas2.anadigi.loc
2019-01-04T09:07:59Z DEBUG Check if anamas2.anadigi.loc is not a CNAME
2019-01-04T09:07:59Z DEBUG Check reverse address of 192.168.100.12
2019-01-04T09:07:59Z DEBUG Found reverse name: anamas2.anadigi.loc
2019-01-04T09:07:59Z DEBUG Check if anamas1.anadigi.loc is a primary hostname for localhost
2019-01-04T09:07:59Z DEBUG Primary hostname for localhost: anamas1.anadigi.loc
2019-01-04T09:07:59Z DEBUG Search DNS for anamas1.anadigi.loc
2019-01-04T09:07:59Z DEBUG Check if anamas1.anadigi.loc is not a CNAME
2019-01-04T09:07:59Z DEBUG Check reverse address of 192.168.100.11
2019-01-04T09:07:59Z DEBUG Found reverse name: anamas1.anadigi.loc
2019-01-04T09:07:59Z DEBUG Initializing principal host/anamas2.anadigi.loc@ANADIGI.LOC using keytab /etc/krb5.keytab
2019-01-04T09:07:59Z DEBUG using ccache /tmp/krbcc0qieohqo/ccache
2019-01-04T09:07:59Z DEBUG Attempt 1/1: success
2019-01-04T09:07:59Z DEBUG importing all plugin modules in ipaserver.plugins...
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.aci
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.automember
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.automount
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.baseldap
2019-01-04T09:07:59Z DEBUG ipaserver.plugins.baseldap is not a valid plugin module
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.baseuser
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.batch
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.ca
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.caacl
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.cert
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.certmap
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.certprofile
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.config
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.delegation
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.dns
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.dnsserver
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.dogtag
2019-01-04T09:07:59Z DEBUG skipping plugin module ipaserver.plugins.dogtag: dogtag not selected as RA plugin
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.domainlevel
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.group
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.hbac
2019-01-04T09:07:59Z DEBUG ipaserver.plugins.hbac is not a valid plugin module
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.hbacrule
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.hbacsvc
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.hbacsvcgroup
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.hbactest
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.host
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.hostgroup
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.idrange
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.idviews
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.internal
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.join
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.krbtpolicy
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.ldap2
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.location
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.migration
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.misc
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.netgroup
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.otp
2019-01-04T09:07:59Z DEBUG ipaserver.plugins.otp is not a valid plugin module
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.otpconfig
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.otptoken
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.passwd
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.permission
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.ping
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.pkinit
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.privilege
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.pwpolicy
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.rabase
2019-01-04T09:07:59Z DEBUG ipaserver.plugins.rabase is not a valid plugin module
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.radiusproxy
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.realmdomains
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.role
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.schema
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.selfservice
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.selinuxusermap
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.server
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.serverrole
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.serverroles
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.service
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.servicedelegation
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.session
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.stageuser
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.sudo
2019-01-04T09:07:59Z DEBUG ipaserver.plugins.sudo is not a valid plugin module
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.sudocmd
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.sudocmdgroup
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.sudorule
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.topology
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.trust
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.user
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.vault
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.virtual
2019-01-04T09:07:59Z DEBUG ipaserver.plugins.virtual is not a valid plugin module
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.whoami
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.plugins.xmlserver
2019-01-04T09:07:59Z DEBUG importing all plugin modules in ipaserver.install.plugins...
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.adtrust
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.ca_renewal_master
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.dns
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.fix_replica_agreements
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.rename_managed
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_ca_topology
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_dna_shared_config
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_fix_duplicate_cacrt_in_ldap
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_idranges
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_ldap_server_list
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_managed_permissions
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_nis
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_pacs
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_passsync
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_ra_cert_store
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_referint
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_services
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.update_uniqueness
2019-01-04T09:07:59Z DEBUG importing plugin module ipaserver.install.plugins.upload_cacrt
2019-01-04T09:08:05Z DEBUG failed to find session_cookie in persistent storage for principal 'host/anamas2.anadigi.loc@ANADIGI.LOC'
2019-01-04T09:08:05Z DEBUG trying https://anamas1.anadigi.loc/ipa/json
2019-01-04T09:08:05Z DEBUG Created connection context.jsonclient_140650149120936
2019-01-04T09:08:05Z DEBUG [try 1]: Forwarding 'env' to json server 'https://anamas1.anadigi.loc/ipa/json'
2019-01-04T09:08:05Z DEBUG New HTTP connection (anamas1.anadigi.loc)
2019-01-04T09:08:05Z DEBUG received Set-Cookie ()'['ipa_session=MagBearerToken=Gau0rFI8D5Qmm%2b2cpunqgb%2bQwWGc%2fyumH2z1EtGG7iHUOYypazYQdqYYK7XEmlpxypIk4%2fYChh%2bX7r1YqI2BofmB79KmbY8iXO4uEW%2fMwznP1yc%2fKN6caNayngcsZT7IuQE3c%2fePqOx4a%2bT%2fpTHYzZ2klub%2f7Pfj78%2fuF5OolcHawEfQMtVQHD56GZmmKj2dKTqBOCHo3%2bQyF3DVPEN8FemBV2oiDZ3DIUKnp0MDlckx4LmdeOode9mwHRSymcdeSn9W6N7bbCAsX2y8uHBg0A%3d%3d;path=/ipa;httponly;secure;']'
2019-01-04T09:08:05Z DEBUG storing cookie 'ipa_session=MagBearerToken=Gau0rFI8D5Qmm%2b2cpunqgb%2bQwWGc%2fyumH2z1EtGG7iHUOYypazYQdqYYK7XEmlpxypIk4%2fYChh%2bX7r1YqI2BofmB79KmbY8iXO4uEW%2fMwznP1yc%2fKN6caNayngcsZT7IuQE3c%2fePqOx4a%2bT%2fpTHYzZ2klub%2f7Pfj78%2fuF5OolcHawEfQMtVQHD56GZmmKj2dKTqBOCHo3%2bQyF3DVPEN8FemBV2oiDZ3DIUKnp0MDlckx4LmdeOode9mwHRSymcdeSn9W6N7bbCAsX2y8uHBg0A%3d%3d;' for principal host/anamas2.anadigi.loc@ANADIGI.LOC
2019-01-04T09:08:05Z DEBUG [try 1]: Forwarding 'env' to json server 'https://anamas1.anadigi.loc/ipa/json'
2019-01-04T09:08:05Z DEBUG HTTP connection keep-alive (anamas1.anadigi.loc)
2019-01-04T09:08:05Z DEBUG received Set-Cookie ()'['ipa_session=MagBearerToken=GBNXj3VkNzBhdEhHx3IdOWZj0D9fKeCfiqQp%2fO18xrAKSy0RCaBVy9tFskVF3%2bHZ8T8DNRrC8qdhOsLueeZa1Sxlvt9S6IH1eGZE4IwICRTHrIgHEpNqpmgdogJWMe7pvq7ADlwuPb2TAC5z6sftbLqBl8AQqm5ndpYNcl4WB%2bj6i4qGTN9Pq4GBnIWjdfqvpaf6TfgNG%2bLvjrBjPg%2bqFkEzTRM5T6ZpdANefsLFB5en16Z%2bpmsQPOemRhXa53007kNGOBp9NoVTot%2bYPwJnVg%3d%3d;path=/ipa;httponly;secure;']'
2019-01-04T09:08:05Z DEBUG storing cookie 'ipa_session=MagBearerToken=GBNXj3VkNzBhdEhHx3IdOWZj0D9fKeCfiqQp%2fO18xrAKSy0RCaBVy9tFskVF3%2bHZ8T8DNRrC8qdhOsLueeZa1Sxlvt9S6IH1eGZE4IwICRTHrIgHEpNqpmgdogJWMe7pvq7ADlwuPb2TAC5z6sftbLqBl8AQqm5ndpYNcl4WB%2bj6i4qGTN9Pq4GBnIWjdfqvpaf6TfgNG%2bLvjrBjPg%2bqFkEzTRM5T6ZpdANefsLFB5en16Z%2bpmsQPOemRhXa53007kNGOBp9NoVTot%2bYPwJnVg%3d%3d;' for principal host/anamas2.anadigi.loc@ANADIGI.LOC
2019-01-04T09:08:05Z DEBUG Destroyed connection context.jsonclient_140650149120936
2019-01-04T09:08:05Z DEBUG Created connection context.ldap2_140650158217816
2019-01-04T09:08:05Z DEBUG flushing ldaps://anamas1.anadigi.loc from SchemaCache
2019-01-04T09:08:05Z DEBUG retrieving schema for SchemaCache url=ldaps://anamas1.anadigi.loc conn=
2019-01-04T09:08:06Z DEBUG raw: domainlevel_get(version='2.230')
2019-01-04T09:08:06Z DEBUG domainlevel_get(version='2.230')
2019-01-04T09:08:06Z DEBUG raw: hostgroup_find(None, cn='ipaservers', version='2.230', host=['anamas2.anadigi.loc'])
2019-01-04T09:08:06Z DEBUG hostgroup_find(None, cn='ipaservers', all=False, raw=False, version='2.230', no_members=True, pkey_only=False, host=('anamas2.anadigi.loc',))
2019-01-04T09:08:06Z DEBUG KRB5CCNAME set to None
2019-01-04T09:08:07Z DEBUG Failed to find default ccache: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (39756044): Credential cache is empty
2019-01-04T09:08:12Z DEBUG Initializing principal admin@ANADIGI.LOC using password
2019-01-04T09:08:12Z DEBUG Starting external process
2019-01-04T09:08:12Z DEBUG args=['/usr/bin/kinit', 'admin@ANADIGI.LOC', '-c', '/tmp/tmpv2e3qgkj']
2019-01-04T09:08:12Z DEBUG Process finished, return code=0
2019-01-04T09:08:12Z DEBUG stdout=Password for admin@ANADIGI.LOC:

2019-01-04T09:08:12Z DEBUG stderr=
2019-01-04T09:08:12Z DEBUG Destroyed connection context.ldap2_140650158217816
2019-01-04T09:08:12Z DEBUG Created connection context.ldap2_140650158217816
2019-01-04T09:08:12Z DEBUG raw: hostgroup_show('ipaservers', rights=True, all=True, version='2.230')
2019-01-04T09:08:12Z DEBUG hostgroup_show('ipaservers', rights=True, all=True, raw=False, version='2.230', no_members=False)
2019-01-04T09:08:12Z DEBUG flushing ldaps://anamas1.anadigi.loc from SchemaCache
2019-01-04T09:08:12Z DEBUG retrieving schema for SchemaCache url=ldaps://anamas1.anadigi.loc conn=
2019-01-04T09:08:13Z DEBUG Destroyed connection context.ldap2_140650158217816
2019-01-04T09:08:13Z DEBUG Created connection context.ldap2_140650158217816
2019-01-04T09:08:13Z DEBUG flushing ldaps://anamas1.anadigi.loc from SchemaCache
2019-01-04T09:08:13Z DEBUG retrieving schema for SchemaCache url=ldaps://anamas1.anadigi.loc conn=
2019-01-04T09:08:13Z DEBUG Check forward/reverse DNS resolution
2019-01-04T09:08:13Z DEBUG Search DNS server anamas1.anadigi.loc (['192.168.100.11', '192.168.100.11', '192.168.100.11']) for anamas1.anadigi.loc
2019-01-04T09:08:13Z DEBUG Check reverse address 192.168.100.11 (anamas1.anadigi.loc)
2019-01-04T09:08:13Z DEBUG Address 192.168.100.11 resolves to: anamas1.anadigi.loc..
2019-01-04T09:08:13Z DEBUG Search DNS server anamas1.anadigi.loc (['192.168.100.11', '192.168.100.11', '192.168.100.11']) for anamas2.anadigi.loc
2019-01-04T09:08:13Z DEBUG Check reverse address 192.168.100.12 (anamas2.anadigi.loc)
2019-01-04T09:08:13Z DEBUG Address 192.168.100.12 resolves to: anamas2.anadigi.loc..
2019-01-04T09:08:13Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2019-01-04T09:08:13Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2019-01-04T09:08:13Z DEBUG raw: kra_is_enabled(version='2.230')
2019-01-04T09:08:13Z DEBUG kra_is_enabled(version='2.230')
2019-01-04T09:08:13Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2019-01-04T09:08:13Z DEBUG raw: dns_is_enabled(version='2.230')
2019-01-04T09:08:13Z DEBUG dns_is_enabled(version='2.230')
2019-01-04T09:08:13Z DEBUG Name anamas2.anadigi.loc resolved to {UnsafeIPAddress('192.168.100.12')}
2019-01-04T09:08:13Z DEBUG Searching for an interface of IP address: 192.168.100.12
2019-01-04T09:08:13Z DEBUG Testing local IP address: 127.0.0.1/255.0.0.0 (interface: lo)
2019-01-04T09:08:13Z DEBUG Testing local IP address: 192.168.100.12/255.255.255.0 (interface: enp4s0)
2019-01-04T09:08:13Z DEBUG IP address 192.168.100.12 belongs to a private range, using forward policy only
2019-01-04T09:08:13Z DEBUG Checking DNS server: 192.168.100.5
2019-01-04T09:08:14Z DEBUG Checking DNS server: 192.168.100.6
2019-01-04T09:08:14Z DEBUG will use DNS forwarders: [CheckedIPAddressLoopback('192.168.100.5'), CheckedIPAddressLoopback('192.168.100.6')]

2019-01-04T09:08:14Z DEBUG Destroyed connection context.ldap2_140650158217816
2019-01-04T09:08:14Z DEBUG Starting external process
2019-01-04T09:08:14Z DEBUG args=['/usr/sbin/ipa-replica-conncheck', '--master', 'anamas1.anadigi.loc', '--auto-master-check', '--realm', 'ANADIGI.LOC', '--hostname', 'anamas2.anadigi.loc', '--password', XXXXXXXX, '--ca-cert-file', '/etc/ipa/ca.crt']
2019-01-04T09:08:50Z DEBUG Process finished, return code=1
2019-01-04T09:08:50Z DEBUG stdout=
2019-01-04T09:08:50Z DEBUG stderr=Check connection from replica to remote master 'anamas1.anadigi.loc':
Directory Service: Unsecure port (389): OK
Directory Service: Secure port (636): OK
Kerberos KDC: TCP (88): OK
Kerberos Kpasswd: TCP (464): OK
HTTP Server: Unsecure port (80): OK
HTTP Server: Secure port (443): OK

The following list of ports use UDP protocol and would need to be
checked manually:
Kerberos KDC: UDP (88): SKIPPED
Kerberos Kpasswd: UDP (464): SKIPPED

Connection from replica to master is OK.
Start listening on required ports for remote master check
Get credentials to log in to remote master
Check RPC connection to remote master
Execute check on remote master
Check connection from master to remote replica 'anamas2.anadigi.loc':
Failed to connect to port 389 tcp on 192.168.100.121
Directory Service: Unsecure port (389): FAILED
Failed to connect to port 636 tcp on 192.168.100.121
Directory Service: Secure port (636): FAILED
Failed to connect to port 88 tcp on 192.168.100.121
Kerberos KDC: TCP (88): FAILED
Failed to connect to port 88 udp on 192.168.100.121
Kerberos KDC: UDP (88): WARNING
Failed to connect to port 464 tcp on 192.168.100.121
Kerberos Kpasswd: TCP (464): FAILED
Failed to connect to port 464 udp on 192.168.100.121
Kerberos Kpasswd: UDP (464): WARNING
Failed to connect to port 80 tcp on 192.168.100.121
HTTP Server: Unsecure port (80): FAILED
Failed to connect to port 443 tcp on 192.168.100.121
HTTP Server: Secure port (443): FAILED
The following UDP ports could not be verified as open: 88, 464
This can happen if they are already bound to an application
and ipa-replica-conncheck cannot attach own UDP responder.
ERROR: Port check failed! Inaccessible port(s): 389 (TCP), 636 (TCP), 88 (TCP), 464 (TCP), 80 (TCP), 443 (TCP)
ERROR: Remote master check failed with following error message(s):
ipa-replica-conncheck returned non-zero exit code

2019-01-04T09:08:50Z DEBUG File "/usr/lib/python3.7/site-packages/ipapython/admintool.py", line 179, in execute
return_value = self.run()
File "/usr/lib/python3.7/site-packages/ipapython/install/cli.py", line 347, in run
return cfgr.run()
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 358, in run
self.validate()
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 368, in validate
for _nothing in self._validator():
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 431, in runner
exc_handler(exc_info)
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 455, in _handle_validate_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python3.7/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 421, in __runner
step()
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 418, in
step = lambda: next(self.__gen)
File "/usr/lib/python3.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(exc_info)
File "/usr/lib/python3.7/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 633, in _configure
next(validator)
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 431, in __runner
exc_handler(exc_info)
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 455, in _handle_validate_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python3.7/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python3.7/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 421, in __runner
step()
File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 418, in
step = lambda: next(self.__gen)
File "/usr/lib/python3.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python3.7/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python3.7/site-packages/ipapython/install/common.py", line 65, in _install
for unused in self._installer(self.parent):
File "/usr/lib/python3.7/site-packages/ipaserver/install/server/__init.py", line 581, in main
replica_promote_check(self)
File "/usr/lib/python3.7/site-packages/ipaserver/install/server/replicainstall.py", line 400, in decorated
func(installer)
File "/usr/lib/python3.7/site-packages/ipaserver/install/server/replicainstall.py", line 422, in decorated
func(installer)
File "/usr/lib/python3.7/site-packages/ipaserver/install/server/replicainstall.py", line 1120, in promote_check
ca_cert_file=cafile)
File "/usr/lib/python3.7/site-packages/ipaserver/install/replication.py", line 127, in replica_conn_check
"Connection check failed!"

2019-01-04T09:08:50Z DEBUG The ipa-replica-install command failed, exception: ScriptError: Connection check failed!
See /var/log/ipareplica-conncheck.log for more information.
If the check results are not valid it can be skipped with --skip-conncheck parameter.
2019-01-04T09:08:50Z ERROR Connection check failed!
See /var/log/ipareplica-conncheck.log for more information.
If the check results are not valid it can be skipped with --skip-conncheck parameter.
2019-01-04T09:08:50Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

Er .. typos [sigh]:

As is clear from the logs the master attempts its reverse connection checks to 192.168.100.121 NOT 192.168.10.121 as written - ie; it is only the fourth IP octet that is corrupt.

Failure is identical even if --ip-address for the (to be) replica server is entered on the command line. So, {command as before} --ip-address=192.168.100.12 faiils with identical logs showing reverse check is made against IP 192.168.100.121

I suspect this is a typo in /etc/hosts on the existing master.

Rob, you just hit a hole in one sir! And, apart from saving my old white hair after I had spent days on trying to figure this out, achieved the considerable feat of making me feel foolish.

Thank you - the procedure completed perfectly with one small typo removed.

You get 100% from me and a gold star.

I am not sure how necessary it is to create /etc/hosts entries - it's something I normally never do - and this typo incident - made in the process of slavishly following installation procedures - is a good example of why. It's so long since I set up a machine with any sort of /etc/hosts file that, having done so here, I forgot that the file (unless overridden) takes precedence over DNS.

Am I correct in assuming that IPA does not need /etc/hosts but the instruction to put the file in place is there to provide fallback in case of DNS failure?

Again, many thanks for your help.

Thanks for the info. Typos can be annoying and hard to debug.

I'm closing this issue as invalid.

Metadata Update from @cheimes:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.