freeipa

#9630 ipa service randomly raises socket.gaierror in gethostfqdn() after system boot
Opened by ichundes. Modified

Open
Close Issue

Issue

On both a IPA master and replica I have this issue in the default configuration where the server would fail to start with a socket.gaierror in the gethostfqdn. I think the DNS is properly set up:

$ grep -v '^#' /etc/resolv.conf
nameserver 127.0.0.53
options edns0 trust-ad
search ipa.loping.net
$ grep -v '^#' /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.0.5 auth.ipa.loping.net auth
$ cat /etc/hostname
auth
$ getent hosts
127.0.0.1       localhost localhost.localdomain localhost4 localhost4.localdomain4
127.0.0.1       localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.0.5     auth.apollo.loping.net auth
$ grep hosts /etc/nsswitch.conf
hosts:      files resolve [!UNAVAIL=return] myhostname dns

It randomly produces this error in the ipa.service log:

Jul 13 11:43:00 auth systemd[1]: Starting ipa.service - Identity, Policy, Audit...
Jul 13 11:43:01 auth ipactl[731]: auth
Jul 13 11:43:01 auth ipactl[731]: Traceback (most recent call last):
Jul 13 11:43:01 auth ipactl[731]:   File "/usr/sbin/ipactl", line 21, in <module>
Jul 13 11:43:01 auth ipactl[731]:     from ipaserver.install import installutils
Jul 13 11:43:01 auth ipactl[731]:   File "/usr/lib/python3.12/site-packages/ipaserver/install/installutils.py", line 47, in <module>
Jul 13 11:43:01 auth ipactl[731]:     from ipalib import facts
Jul 13 11:43:01 auth ipactl[731]:   File "/usr/lib/python3.12/site-packages/ipalib/__init__.py", line 919, in <module>
Jul 13 11:43:01 auth ipactl[731]:     from ipalib import plugable
Jul 13 11:43:01 auth ipactl[731]:   File "/usr/lib/python3.12/site-packages/ipalib/plugable.py", line 43, in <module>
Jul 13 11:43:01 auth ipactl[731]:     from ipalib import errors
Jul 13 11:43:01 auth ipactl[731]:   File "/usr/lib/python3.12/site-packages/ipalib/errors.py", line 109, in <module>
Jul 13 11:43:01 auth ipactl[731]:     from ipalib.text import ngettext as ungettext
Jul 13 11:43:01 auth ipactl[731]:   File "/usr/lib/python3.12/site-packages/ipalib/text.py", line 139, in <module>
Jul 13 11:43:01 auth ipactl[731]:     from ipalib.request import context
Jul 13 11:43:01 auth ipactl[731]:   File "/usr/lib/python3.12/site-packages/ipalib/request.py", line 28, in <module>
Jul 13 11:43:01 auth ipactl[731]:     from ipalib.base import ReadOnly, lock
Jul 13 11:43:01 auth ipactl[731]:   File "/usr/lib/python3.12/site-packages/ipalib/base.py", line 26, in <module>
Jul 13 11:43:01 auth ipactl[731]:     from ipalib.constants import NAME_REGEX, NAME_ERROR
Jul 13 11:43:01 auth ipactl[731]:   File "/usr/lib/python3.12/site-packages/ipalib/constants.py", line 37, in <module>
Jul 13 11:43:01 auth ipactl[731]:     FQDN = gethostfqdn()
Jul 13 11:43:01 auth ipactl[731]:            ^^^^^^^^^^^^^
Jul 13 11:43:01 auth ipactl[731]:   File "/usr/lib/python3.12/site-packages/ipapython/fqdn.py", line 23, in gethostfqdn
Jul 13 11:43:01 auth ipactl[731]:     gai = socket.getaddrinfo(
Jul 13 11:43:01 auth ipactl[731]:           ^^^^^^^^^^^^^^^^^^^
Jul 13 11:43:01 auth ipactl[731]:   File "/usr/lib64/python3.12/socket.py", line 964, in getaddrinfo
Jul 13 11:43:01 auth ipactl[731]:     for res in _socket.getaddrinfo(host, port, family, type, proto, flags):
Jul 13 11:43:01 auth ipactl[731]:                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Jul 13 11:43:01 auth ipactl[731]: socket.gaierror: [Errno -5] No address associated with hostname
Jul 13 11:43:01 auth systemd[1]: ipa.service: Main process exited, code=exited, status=1/FAILURE
Jul 13 11:43:01 auth systemd[1]: ipa.service: Failed with result 'exit-code'.
Jul 13 11:43:01 auth systemd[1]: Failed to start ipa.service - Identity, Policy, Audit.

I saw the comment in fqdn.py saying:

# this call can never fail except for misconfigured nsswitch.conf
# without nss-myhostname provider. The myhostname provider translates
# gethostname() to local interfaces.

Which got me to try moving the myhostname entry in /etc/nsswitch.conf before the !UNAVAIL=return like this:

hosts:      files resolve myhostname [!UNAVAIL=return] dns

This makes the service start every time. IIUC there seems to be some race condition there.

Steps to Reproduce

  1. Install FreeIPA
  2. Reboot system
  3. Maybe 50% chance it does not come up

Actual behavior

IPA service is not started

Expected behavior

IPA service is started

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.11.1-4.fc40.x86_64
freeipa-client-4.11.1-4.fc40.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-3.0.2-1.fc40.x86_64
package pki-ca is not installed
krb5-server-1.21.2-5.fc40.x86_64

You're not alone, reporter. I've just run into this this on Fedora 40 with freeipa-server-4.12.1-1.fc40.x86_64. For me it's pretty consistent with ipa.service failing to start on every reboot, but starting properly when asked soon afterwards.

This machine has a static IP address configured with systemd-networkd. The machine's FQDN and IP address are listed in /etc/hosts. My resolv.conf is like yours, except for a Tailnet in the search directory.

I've tried your nsswitch.conf edit and will see if that works.

I wonder if this is actually an issue in authselect? See https://bodhi.fedoraproject.org/updates/FEDORA-2024-d7caacc700
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.