ipa-replica-install failing - operations error: the changelog directory already exists and is not empty
by Sinh Lam
Hi Everyone -
I’m running into this odd issue I can’t seem to find a resolution to. Long
story short, my IPA master was on a system that had a power failure. Upon
bring up, the dirsrv failed to start up due to a zero byte dse.ldif file.
Used a “backup” of the file and my master seemed to have came back up ok
however replication seems to have stopped working.
When I noticed that replication wasn’t working from the replicas to the
master I went digging and found this (which led me to try to recover by
removing the old replicas and trying to do a reinstall) :
replica.domain.net: replica
last update status: Error (6) Replication error acquiring replica: Unable
to acquire replica: there is no replicated area on the consumer server.
Replication is aborting. (no such replica)
last update ended: 2021-05-20 15:29:28+00:00
The above “last update” corresponds with the power outage that took down
the IPA master.
I’m trying to re-initialize the replication by doing a reinstall of the
replica server but I’m failing with the following error :
Disabled p11-kit-proxy
Configuring directory server (dirsrv). Estimated time: 30 seconds
[1/42]: creating directory server instance
[2/42]: configure autobind for root
[3/42]: tune ldbm plugin
[4/42]: stopping directory server
[5/42]: updating configuration in dse.ldif
[6/42]: starting directory server
[7/42]: adding default schema
[8/42]: enabling memberof plugin
[9/42]: enabling winsync plugin
[10/42]: configure password logging
[11/42]: configuring replication version plugin
[12/42]: enabling IPA enrollment plugin
[13/42]: configuring uniqueness plugin
[14/42]: configuring uuid plugin
[15/42]: configuring modrdn plugin
[16/42]: configuring DNS plugin
[17/42]: enabling entryUSN plugin
[18/42]: configuring lockout plugin
[19/42]: configuring topology plugin
[20/42]: creating indices
[21/42]: enabling referential integrity plugin
[22/42]: configuring certmap.conf
[23/42]: configure new location for managed entries
[24/42]: configure dirsrv ccache and keytab
[25/42]: enabling SASL mapping fallback
[26/42]: restarting directory server
[27/42]: creating DS keytab
[28/42]: ignore time skew for initial replication
[29/42]: setting up initial replication
[error] DatabaseError: Operations error: The changelog directory
[/var/lib/dirsrv/slapd-REPLICA-DOMAIN-NET/cldb] already exists and is not
empty. Please choose a directory that does not exist or is empty.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
Operations error: The changelog directory
[/var/lib/dirsrv/slapd-REPLICA-DOMAIN-NET/cldb] already exists and is not
empty. Please choose a directory that does not exist or is empty.
The ipa-replica-install command failed. See /var/log/ipareplica-install.log
for more information
I’ve since done several uninstalls and verified at each uninstall the
/var/lib/dirsrv directory is empty.
Any pointers on how to get past this issue would be great since I have
about 10 more replicas to get back up.
Thanks.
Sinh
3 years
groups imported incorrectly (made compat tree look out of sync memberUid)
by Scott Serr
A few months ago, using IPA 4.8.7, I imported users and groups from
OpenLDAP:
ipa -v migrate-ds --with-compat \
--bind-dn="cn=Manager,dc=example,dc=com" \
--user-container="ou=People,dc=example,dc=com" \
--user-objectclass="posixAccount" \
--group-container="ou=Group,dc=example,dc=com" \
--group-objectclass="posixGroup" \
--group-overwrite-gid \
--schema=RFC2307 \
ldap://openldap-server:389
Now, I've found a problem...
In addition to the expected "member" attribute list on the group dn, I
also have a memberUid attribute list. These memberUid attributes are
not created when using IPA to assign users to groups, just during my import.
An imported user:
dn: cn=wahoo,cn=groups,cn=accounts,dc=example,dc=com
member: uid=fred,cn=users,cn=accounts,dc=example,dc=com
memberUid: fred
dn: cn=wahoo,cn=groups,cn=compat,dc=example,dc=com
memberUid: fred
So, no harm done yet. Then I remove fred from the group wahoo. And I
end up with this:
dn: cn=wahoo,cn=groups,cn=accounts,dc=example,dc=com
memberUid: fred
dn: cn=wahoo,cn=groups,cn=compat,dc=example,dc=com
memberUid: fred
Now, anything pointing to my compat tree, still thinks fred is in the
wahoo group.
The solution is removing the memberUids from the
cn=groups,cn=accounts,dc=example,dc=com tree, and the compat tree
automatically reflects that change.
Question:
Is this a bug or did I do something wrong on the import?
Thanks,
Scott
PS- If someone else runs into this, I hope I saved you time.
3 years
Re: IPA Reinstall
by Robert.Mattson＠L3Harris.com
Hi Florence,
Thank you for taking the time to respond.
We have a number of replicas in various campus locations around our region, and our state and country is currently locked-down with COVID restrictions, and it would take days to get to the replicas even without restrictions. We have had wide-scale WAN outages over weeks for this system.
To describe our problem in a simplified manner;
We had the IPA replicas ‘Location1R1’ and ‘Location2R1’ talking happily when the WAN between them went away, while it was down we added ‘Location2R2’ to ‘Location2R1’, and manually added some user-ranges for accounts at Location2. We also added a number of ipa-clients at Location2. When the WAN came back, ‘Location1R1’ and ‘Location2R1’ stopped sharing data because the CSN updates were dropped weeks ago. We re-initialized ‘Location2R1’ from ‘Location1R1’, however that has resulted in isolation of ‘Location2R2’. Most logins at Location2 fail, depending on where the DNS round-robin points SSSD at the time of login.
We have multiple locations, each with a flavor of this issue. No replica has a complete picture of all replication agreements, host accounts and user accounts. Though we have had some success with continually re-initializing replicas.
It was my hope, once the WAN was stabilized to remove and re ipa-server-install at our first server, then remove and re-run ipa-client-install then ipa-replica-install at each secondary server. I believe this would re-constitute the system, effectively by re-installation of that specific service. And yes, this would all be done via SSH.
However, we meet the obstacles described in my initial email when performing the install a second time.
Sincerely, and with many thanks in advance,
Rob
From: Florence Renaud via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
Sent: Wednesday, 2 June 2021 2:16 AM
To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
Cc: Mattson, Robert (FP) <Robert.Mattson(a)L3Harris.com>; Florence Renaud <flo(a)redhat.com>
Subject: [EXTERNAL] [Freeipa-users] Re: IPA Reinstall
Hi,
the recommended way to uninstall a replica and reinstall it is described in the doc:
1. Uninstall the replica (https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...) with ipa server-del and ipa-server-install --uninstall
2. re-install the replica as if it was a new one: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
Was there any reason to backup files and restore them? The replica installation should re-create everything.
flo
On Wed, May 26, 2021 at 7:32 AM Robert.Mattson--- via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> wrote:
Dear Community,
I'd like to uninstall and reinstall IPA from a CentOS box because its easier than reinstalling the OS completely.
We have a number of replicas, and this host is installed using ipa-client-install and then ipa-replica-install.
To remove it, I backup some data like /var/kerberos/krb5kdc/{cacert.pem,kd*} and /etc/httpd/conf/password.conf
and then run '/usr/sbin/ipa-server-install --uninstall -U --ignore-topology-disconnect'.
I then sed '/Environment=K/d', '/ExecStartPre/d', '/ExecStopPost/d' /etc/systemd/system/httpd.service
I recreate the host-account on another replica using ipa host-add, then ipa hostgroup-add-member.
On the now-removed host, I do some housekeeping like restoring the backed up files and then I run;
/usr/sbin/ipa-client-install \
--password=${otp} \
--mkhomedir \
--no-ntp \
--unattended \
--domain=realm.name<http://realm.name> \
--realm=REALM.NAME<http://REALM.NAME> \
--ca-cert-file=/etc/pki/ca-trust/source/ca.crt
then
/usr/sbin/ipa-replica-install \
--dirsrv-cert-file=/etc/pki/tls/private/ipa.pkcs12 \
--http-cert-file=/etc/pki/tls/private/ipa.pkcs12 \
--dirsrv-pin=pwd \
--http-pin=pwd \
--unattended \
--no-pkinit \
--no-ntp
I seem to get the following keytab request problem followed by dirsrv failure. from ipa-replica-install (4.6.4-10.el7.centos.3.x86_64). If I upgrade to 4.6.8-5.el7.centos.4.noarch.rpm, I get the same problem.[1]
On serverb, the host which receives the binding request for the reinstall, I get permission denied the bind dn “” does not have permission in dirsrv error log…?
Does anyone have any thoughts,
Cheers and many thanks in advance,
Rob
[1]
2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa.conf'
2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa.conf' doesn't exist
2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa-rewrite.conf'
2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa-rewrite.conf' doesn't exist
2021-05-26T02:50:56Z DEBUG duration: 0 seconds
2021-05-26T02:50:56Z DEBUG [10/21]: setting up httpd keytab
2021-05-26T02:50:56Z DEBUG raw: service_add(u'HTTP/servera.system(a)REALM.NAME<mailto:servera.system@REALM.NAME>', force=True, version=u'2.230')
2021-05-26T02:50:56Z DEBUG service_add(ipapython.kerberos.Principal('HTTP/servera.system(a)REALM.NAME<mailto:servera.system@REALM.NAME>'), force=True, all=False, raw=False, version=u'2.230', no_members=False)
2021-05-26T02:50:56Z DEBUG flushing ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket from SchemaCache
2021-05-26T02:50:56Z DEBUG retrieving schema for SchemaCache url=ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f0d29f50368>
2021-05-26T02:50:57Z DEBUG raw: host_show(u'servera.system', version=u'2.230')
2021-05-26T02:50:57Z DEBUG host_show(u'servera.system', rights=False, all=False, raw=False, version=u'2.230', no_members=False)
2021-05-26T02:50:57Z DEBUG Backing up system configuration file '/var/lib/ipa/gssproxy/http.keytab'
2021-05-26T02:50:57Z DEBUG -> Not backing up - '/var/lib/ipa/gssproxy/http.keytab' doesn't exist
2021-05-26T02:50:57Z DEBUG Starting external process
2021-05-26T02:50:57Z DEBUG args=/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL
2021-05-26T02:50:57Z DEBUG Process finished, return code=9
2021-05-26T02:50:57Z DEBUG stdout=
2021-05-26T02:50:57Z DEBUG stderr=Failed to parse result: unsupported extended operation
Retrying with pre-4.0 keytab retrieval method...
Failed to parse result: unsupported extended operation
Failed to get keytab!
Failed to get keytab
2021-05-26T02:50:57Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab
super(HTTPInstance, self).request_service_keytab()
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab
self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab
ipautil.run(args, nolog=nolog)
File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run
raise CalledProcessError(p.returncode, arg_string, str(output))
CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9
2021-05-26T02:50:57Z DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9
2021-05-26T02:50:57Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run
return cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run
return self.execute()
exc_handler(exc_info)
<snip />
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install
for unused in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main
replica_install(self)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated
func(installer)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1487, in install
fstore=fstore)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 173, in install_http
subject_base=config.subject_base, master_fqdn=config.master_host_name)
File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 188, in create_instance
self.start_creation()
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab
super(HTTPInstance, self).request_service_keytab()
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab
self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab
ipautil.run(args, nolog=nolog)
File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run
raise CalledProcessError(p.returncode, arg_string, str(output))
2021-05-26T02:50:57Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9
2021-05-26T02:50:57Z ERROR Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9
2021-05-26T02:50:57Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
[2]
[26/May/2021:12:50:47.240285166 +1000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToservera.system" (servera:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica.
[26/May/2021:12:50:47.858057379 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToservera.system" (servera:389)".
[26/May/2021:12:50:50.679652092 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Finished total update of replica "agmt="cn=meToservera.system" (servera:389)". Sent 582 entries.
[26/May/2021:12:50:52.158394667 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later.
[26/May/2021:12:50:55.079367688 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later.
[26/May/2021:12:50:58.084381230 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later.
[26/May/2021:12:51:01.092727541 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later.
CONFIDENTIALITY NOTICE: This email and any attachments are for the sole use of the intended recipient and may contain material that is proprietary, confidential, privileged or otherwise legally protected or restricted under applicable government laws. Any review, disclosure, distributing or other use without expressed permission of the sender is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies without reading, printing, or saving.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org>
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
3 years
custom tls certtificate for web UI
by iulian roman
Hello everybody,
I tried to change the WEB UI certificate with a custom certificate signed by our internal CA. The custom certificate was provided as a bundle (certificate + intermediates). The root ca which signs the intermediate was added in the truststore with ipa-cacert-manage.
Everything was successful but when I accessed the Web UI I noticed that IPA provides only the certificate, not the full chain, which makes the certificate not trusted by the browsers (they are configured to trust only our internal root ca).
Is there any method to configure IPA/Idm to provide the full certificate chain (certificate + intermediate) to the http clients or is there anything I configured wrong ?
3 years
cleanup of removed masters
by Stijn De Weirdt
hi all,
our ipa-healthcheck gives some seemingly odd output:
> Internal server error HTTPSConnectionPool(host='oldm2.domain', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=3 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7f32581cb748>: Failed to establish a new connection: [Errno -2] Name or service not known',))
> [
> {
> "source": "pki.server.healthcheck.clones.connectivity_and_data",
> "check": "ClonesConnectivyAndDataCheck",
> "result": "ERROR",
> "uuid": "c7694559-157f-42da-9722-29ab4308d8bc",
> "when": "20210601115956Z",
> "duration": "0.424097",
> "kw": {
> "status": "ERROR: pki-tomcat : Internal error testing CA clone. Host: oldm2.domain Port: 443"
> }
> },
googling the error itself, i find references to this being a false
positive; but looking closer (and also the initial server error) give an
actual error: they reference an old master (it's obviously not called
oldm2, so i had to read it a few times to see it was actually this old
host).
a while ago we migrated our centos7 setup (oldm1 and oldm2) to rhel82
(newm3 and newm4), by following the migration guide
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
i'm quite sure we followed all steps, including the final uninstall on
oldm1 and oldm2.
however, after starting to run ipa-healthcheck recently and seeing this
error, we looked for other traces of the old servers and started to
clean them up. the old hosts are no longer around, so no chance to rerun
things or check logs.
so far we removed a bunch of DNS entries where the oldm1 was still used,
but we now also have some other ones that reference oldm2: e.g. the pki
related error above, but also oldm2 is still referenced in some entries
in our dirserv dse.ldif (2 nsslapd-referral, 3 nsds50ruv and 3
nsruvReplicaLastModified). the traces are only of oldm2, not sign of
oldm1 there.
i'd appreciate some tips/guidance for removing the pki reference to
oldm2 and things we can do to cleanup the dse.ldif
many many thanks,
stijn
3 years
IPA Reinstall
by Robert.Mattson＠L3Harris.com
Dear Community,
I'd like to uninstall and reinstall IPA from a CentOS box because its easier than reinstalling the OS completely.
We have a number of replicas, and this host is installed using ipa-client-install and then ipa-replica-install.
To remove it, I backup some data like /var/kerberos/krb5kdc/{cacert.pem,kd*} and /etc/httpd/conf/password.conf
and then run '/usr/sbin/ipa-server-install --uninstall -U --ignore-topology-disconnect'.
I then sed '/Environment=K/d', '/ExecStartPre/d', '/ExecStopPost/d' /etc/systemd/system/httpd.service
I recreate the host-account on another replica using ipa host-add, then ipa hostgroup-add-member.
On the now-removed host, I do some housekeeping like restoring the backed up files and then I run;
/usr/sbin/ipa-client-install \
--password=${otp} \
--mkhomedir \
--no-ntp \
--unattended \
--domain=realm.name \
--realm=REALM.NAME \
--ca-cert-file=/etc/pki/ca-trust/source/ca.crt
then
/usr/sbin/ipa-replica-install \
--dirsrv-cert-file=/etc/pki/tls/private/ipa.pkcs12 \
--http-cert-file=/etc/pki/tls/private/ipa.pkcs12 \
--dirsrv-pin=pwd \
--http-pin=pwd \
--unattended \
--no-pkinit \
--no-ntp
I seem to get the following keytab request problem followed by dirsrv failure. from ipa-replica-install (4.6.4-10.el7.centos.3.x86_64). If I upgrade to 4.6.8-5.el7.centos.4.noarch.rpm, I get the same problem.[1]
On serverb, the host which receives the binding request for the reinstall, I get permission denied the bind dn "" does not have permission in dirsrv error log...?
Does anyone have any thoughts,
Cheers and many thanks in advance,
Rob
[1]
2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa.conf'
2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa.conf' doesn't exist
2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa-rewrite.conf'
2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa-rewrite.conf' doesn't exist
2021-05-26T02:50:56Z DEBUG duration: 0 seconds
2021-05-26T02:50:56Z DEBUG [10/21]: setting up httpd keytab
2021-05-26T02:50:56Z DEBUG raw: service_add(u'HTTP/servera.system(a)REALM.NAME', force=True, version=u'2.230')
2021-05-26T02:50:56Z DEBUG service_add(ipapython.kerberos.Principal('HTTP/servera.system(a)REALM.NAME'), force=True, all=False, raw=False, version=u'2.230', no_members=False)
2021-05-26T02:50:56Z DEBUG flushing ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket from SchemaCache
2021-05-26T02:50:56Z DEBUG retrieving schema for SchemaCache url=ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f0d29f50368>
2021-05-26T02:50:57Z DEBUG raw: host_show(u'servera.system', version=u'2.230')
2021-05-26T02:50:57Z DEBUG host_show(u'servera.system', rights=False, all=False, raw=False, version=u'2.230', no_members=False)
2021-05-26T02:50:57Z DEBUG Backing up system configuration file '/var/lib/ipa/gssproxy/http.keytab'
2021-05-26T02:50:57Z DEBUG -> Not backing up - '/var/lib/ipa/gssproxy/http.keytab' doesn't exist
2021-05-26T02:50:57Z DEBUG Starting external process
2021-05-26T02:50:57Z DEBUG args=/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL
2021-05-26T02:50:57Z DEBUG Process finished, return code=9
2021-05-26T02:50:57Z DEBUG stdout=
2021-05-26T02:50:57Z DEBUG stderr=Failed to parse result: unsupported extended operation
Retrying with pre-4.0 keytab retrieval method...
Failed to parse result: unsupported extended operation
Failed to get keytab!
Failed to get keytab
2021-05-26T02:50:57Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab
super(HTTPInstance, self).request_service_keytab()
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab
self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab
ipautil.run(args, nolog=nolog)
File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run
raise CalledProcessError(p.returncode, arg_string, str(output))
CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9
2021-05-26T02:50:57Z DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9
2021-05-26T02:50:57Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run
return cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run
return self.execute()
exc_handler(exc_info)
<snip />
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install
for unused in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main
replica_install(self)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated
func(installer)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1487, in install
fstore=fstore)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 173, in install_http
subject_base=config.subject_base, master_fqdn=config.master_host_name)
File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 188, in create_instance
self.start_creation()
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab
super(HTTPInstance, self).request_service_keytab()
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab
self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab
ipautil.run(args, nolog=nolog)
File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run
raise CalledProcessError(p.returncode, arg_string, str(output))
2021-05-26T02:50:57Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9
2021-05-26T02:50:57Z ERROR Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9
2021-05-26T02:50:57Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
[2]
[26/May/2021:12:50:47.240285166 +1000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToservera.system" (servera:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica.
[26/May/2021:12:50:47.858057379 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToservera.system" (servera:389)".
[26/May/2021:12:50:50.679652092 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Finished total update of replica "agmt="cn=meToservera.system" (servera:389)". Sent 582 entries.
[26/May/2021:12:50:52.158394667 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later.
[26/May/2021:12:50:55.079367688 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later.
[26/May/2021:12:50:58.084381230 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later.
[26/May/2021:12:51:01.092727541 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later.
CONFIDENTIALITY NOTICE: This email and any attachments are for the sole use of the intended recipient and may contain material that is proprietary, confidential, privileged or otherwise legally protected or restricted under applicable government laws. Any review, disclosure, distributing or other use without expressed permission of the sender is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies without reading, printing, or saving.
3 years
Kerberos Issues
by Mark Potter
Long story short, we had to redeploy part of our FreeIPA cluster. As far as
I know I followed all of the proper procedures and everything seems to be
working from the client side however we are getting a TON of these messages
in krb5kdc.log
ipa3.example.com krb5kdc[31232](info): TGS_REQ (8 etypes {18 17 20 19 16 23
25 26}) 10.6.21.19: LOOKING_UP_SERVER: authtime 0, host/
client100.example.com(a)EXAMPLE.COM for nfs/nfs1.example.com(a)EXAMPLE.COM,
Server not found in Kerberos database
client100.example.com has working forward and reverse DNS entries that
resolve from all FreeIPA servers and from itself.
nfs1.example.com has working forward and reverse entries that resolve from
all FreeIPA servers and from itself, it is not part of the FreeIPA domain
at all, it is still using the authentication we are replacing with FreeIPA.
It is used for automount homedirs in FreeIPA but is not kerberized
All of the clients reporting this error still properly automount homedirs
and that is the only thing on nfs1.example.com. There is another
mountpoint, also not kerberized, in the automount setup that is not
throwing any errors and access extremely frequently.
I am happy to provide any logs necessary to track this down.
--
*Mark Potter*
3 years
ACME admin replication conflict
by Stijn De Weirdt
hello all,
in our setup ipa-healthcheck reports an issue with a replication
conflict on "dn: cn=Enterprise ACME Administrators,ou=groups,o=ipaca"
the conflict and valid entry are almost identical:
> Valid Entry:
>
> dn: cn=Enterprise ACME Administrators,ou=groups,o=ipaca
> cn: Enterprise ACME Administrators
> description: ACME RA accounts
> objectClass: top
> objectClass: groupOfUniqueNames
> uniqueMember: uid=acme-master2.domain,ou=people,o=ipaca
> uniqueMember: uid=ipara,ou=people,o=ipaca
with the conflicting entry the same, except for the line
> uniqueMember: uid=acme-master1.domain,ou=people,o=ipaca
i would like some guidance what this means and how to proceed: delete
the conflicting entry, swap to the conflicting entry, merge it (somehow)
many thanks,
stijn
3 years
Re: Can't Add Replica: The changelog directory CLDB already exists and is not empty
by Sinh Lam
This is an old thread but I’m running into this issue and was wondering if there was ever a resolution to this.
Tldr -
My master failed and was not able to start up due to the dse.ldif being a zero byte file and the .bak file was unusable as well. Ended up using the startOK file and that got my IPA master back up. I didn’t find out till a week or so later that my replication has stopped working and I’ve been trying to resolve this ever since.
The error I’m getting when trying to set up a new replica is the error in the subject. These are the last couple entries in the journal logs for the dirsrv service :
May 20 16:11:40 ns-slapd[5273]: [20/May/2021:16:11:40.900845676 +0000] - NOTICE - bdb_start - Detected Disorderly Shutdown last time Directory Server was running, recovering database.
May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.103929069 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES
May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.106523128 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.281157478 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES
May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.284236656 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.287235192 +0000] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption.
May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.464658571 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES
May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.468260771 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.644832465 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES
May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.647838123 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.650519798 +0000] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption.
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.015851937 +0000] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup!
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.054457416 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.056902182 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.059621578 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.061834684 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.063891013 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.066217133 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.068870945 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.071006284 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.073207989 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.076186848 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.078837082 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.081064756 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.083418248 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.085693933 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.088486548 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.090954337 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.105391221 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ad,cn=etc,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.109923564 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.111808229 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=net does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.199628452 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.207869328 +0000] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=example,dc=net--no CoS Templates found, which should be added before the CoS Definition.
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.251700304 +0000] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.254651872 +0000] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.256778704 +0000] - INFO - slapd_daemon - Listening on /var/run/slapd-EXAMPLE-NET.socket for LDAPI requests
May 20 16:11:43 systemd[1]: Started 389 Directory Server EXAMPLE-NET..
May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.310441141 +0000] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds!
May 20 16:11:48 ns-slapd[5273]: [20/May/2021:16:11:48.503046676 +0000] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=example,dc=net
May 20 16:11:48 ns-slapd[5273]: [20/May/2021:16:11:48.514741500 +0000] - ERR - schema-compat-plugin - Finished plugin initialization.
May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.319674451 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found
May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.325071163 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found
May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.329293579 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found
May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.333178665 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found
May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.336932011 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found
May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.341244859 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found
May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.345131920 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found
May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.349357371 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found
May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.353178446 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found
May 20 16:12:51 ns-slapd[5273]: [20/May/2021:16:12:51.527767324 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=77 op=5 replica="unknown": Unable to acquire replica: error: no such replica
May 20 16:12:52 ns-slapd[5273]: [20/May/2021:16:12:52.283753249 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=78 op=5 replica="unknown": Unable to acquire replica: error: no such replica
May 20 16:12:52 ns-slapd[5273]: [20/May/2021:16:12:52.390379930 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=79 op=5 replica="unknown": Unable to acquire replica: error: no such replica
May 20 16:12:52 ns-slapd[5273]: [20/May/2021:16:12:52.957417497 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=80 op=5 replica="unknown": Unable to acquire replica: error: no such replica
May 20 16:12:53 ns-slapd[5273]: [20/May/2021:16:12:53.283781064 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=81 op=5 replica="unknown": Unable to acquire replica: error: no such replica
May 20 16:12:55 ns-slapd[5273]: [20/May/2021:16:12:55.479234600 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=82 op=5 replica="unknown": Unable to acquire replica: error: no such replica
May 20 16:15:51 ns-slapd[5273]: [20/May/2021:16:15:51.868329611 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=212 op=5 replica="unknown": Unable to acquire replica: error: no such replica
May 20 16:16:24 ns-slapd[5273]: [20/May/2021:16:16:24.216095880 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=233 op=5 replica="unknown": Unable to acquire replica: error: no such replica
May 20 16:16:27 ns-slapd[5273]: [20/May/2021:16:16:27.408505127 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=240 op=5 replica="unknown": Unable to acquire replica: error: no such replica
May 25 20:45:37 ns-slapd[5273]: [25/May/2021:20:45:37.356300061 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=111801 op=5 replica="unknown": Unable to acquire replica: error: no such replica
May 26 04:20:37 ns-slapd[5273]: [26/May/2021:04:20:37.246445897 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found
May 26 04:20:37 ns-slapd[5273]: [26/May/2021:04:20:37.249257028 +0000] - ERR - ipa-topology-plugin - ipa_topo_agmt_del: cn=master.example.net-to-replica001.example.net
May 26 04:20:39 ns-slapd[5273]: [26/May/2021:04:20:39.266434467 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32)
May 26 04:20:41 ns-slapd[5273]: [26/May/2021:04:20:41.272692883 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32)
May 26 04:20:43 ns-slapd[5273]: [26/May/2021:04:20:43.333985925 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32)
May 26 04:20:43 ns-slapd[5273]: [26/May/2021:04:20:43.337030838 +0000] - ERR - NSMMReplicationPlugin - CleanAllRUV Task (rid 5): Could not find replica from dn(dc=example,dc=net)
May 26 04:20:45 ns-slapd[5273]: [26/May/2021:04:20:45.342517080 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32)
May 26 04:20:47 ns-slapd[5273]: [26/May/2021:04:20:47.348898719 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32)
May 26 04:20:49 ns-slapd[5273]: [26/May/2021:04:20:49.355780507 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32)
May 26 04:20:49 ns-slapd[5273]: [26/May/2021:04:20:49.358756218 +0000] - ERR - NSMMReplicationPlugin - CleanAllRUV Task (rid 5): Task failed...(-1)
May 26 04:20:51 ns-slapd[5273]: [26/May/2021:04:20:51.364127080 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32)
May 26 04:20:51 ns-slapd[5273]: [26/May/2021:04:20:51.406580664 +0000] - WARN - get_internal_entry - Can't find task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'
May 26 04:20:51 ns-slapd[5273]: [26/May/2021:04:20:51.412684547 +0000] - ERR - ipa-topology-plugin - ipa_topo_util_cleanruv: failed to create cleanalltuv task
May 28 00:08:17 ns-slapd[5273]: [28/May/2021:00:08:17.669467056 +0000] - ERR - log_ber_too_big_error - conn=173723 fd=156 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings.
May 28 01:06:22 ns-slapd[5273]: [28/May/2021:01:06:22.406718855 +0000] - ERR - log_ber_too_big_error - conn=175016 fd=158 Incoming BER Element was 24019198018235050 bytes, max allowable is 209715200 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase.
May 28 15:50:43 ns-slapd[5273]: [28/May/2021:15:50:43.082273849 +0000] - ERR - log_ber_too_big_error - conn=195035 fd=289 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings.
May 28 15:50:43 ns-slapd[5273]: [28/May/2021:15:50:43.097752625 +0000] - ERR - log_ber_too_big_error - conn=195036 fd=289 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings.
May 29 12:43:13 ns-slapd[5273]: [29/May/2021:12:43:13.872403558 +0000] - ERR - log_ber_too_big_error - conn=222810 fd=357 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings.
May 29 17:26:04 ns-slapd[5273]: [29/May/2021:17:26:04.858100977 +0000] - ERR - log_ber_too_big_error - conn=229005 fd=322 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings.
May 31 11:05:27 ns-slapd[5273]: [31/May/2021:11:05:27.982685756 +0000] - ERR - connection_read_operation - conn=283764 received a non-LDAP message (tag 0x47, expected 0x30)
May 31 11:05:31 ns-slapd[5273]: [31/May/2021:11:05:31.522716719 +0000] - ERR - connection_read_operation - conn=283766 received a non-LDAP message (tag 0x47, expected 0x30)
May 31 11:31:27 ns-slapd[5273]: [31/May/2021:11:31:27.029834838 +0000] - ERR - connection_read_operation - conn=284343 received a non-LDAP message (tag 0x47, expected 0x30)
May 31 11:31:27 ns-slapd[5273]: [31/May/2021:11:31:27.520938917 +0000] - ERR - connection_read_operation - conn=284344 received a non-LDAP message (tag 0x47, expected 0x30)
I changed up the host info in the log output but otherwise log is still the same.
Right now, as it is, the master works, the existing replicas are working but no new changes are getting pushed out. I would like to NOT rebuild the entire IPA infrastructure if I can avoid it to get replication back up and running so any help would be greatly appreciated.
Thank you.
Sinh Lam
3 years
