ipa-replica-install failed with CA_UNREACHABLE -
by Ilie Soltanici
Hi All,
Trying to install a replica for an already running ipa-server but it fails.
IPA Main server is already running and properly configured. I'm trying to setup the second server and replicate with the main server.
This is the command what i'm using:
ipa-replica-install --principal admin --admin-password 'password' --setup-ca --setup-dns --auto-forwarders --server ipa-server.domain.local --domain domain.local
Everything is going well until this:
Done configuring kadmin.
Configuring directory server (dirsrv)
[1/3]: configuring TLS for DS instance
[error] RuntimeError: Certificate issuance failed (CA_UNREACHABLE)
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR Certificate issuance failed (CA_UNREACHABLE)
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
The getcert list command is getting this;
Number of certificates and requests being tracked: 1.
Request ID '20180905101554':
status: CA_UNREACHABLE
ca-error: Server at https://ipa-server2.domain.local/ipa/xml failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Failed connect to ipa-server2.domain.local:443; Connection refused).
[ipa-server2] # netstat -lnp | grep 443 - is not getting anything back.
httpd server is running by listening 80 port only.
[root@host user]# ipa --version
VERSION: 4.5.4, API_VERSION: 2.228
cat /etc/os-release
NAME="CentOS Linux"
VERSION="7 (Core)"
How can i make the replica working?
5 years, 7 months
Fwd: Fedora 30 System-Wide Change Proposal: FreeIPA Python 2 Removal
by Christian Heimes
For your information
-------- Forwarded Message --------
Subject: Fedora 30 System-Wide Change Proposal: FreeIPA Python 2 Removal
Date: Wed, 5 Sep 2018 13:05:31 -0400
From: Ben Cotton <bcotton(a)redhat.com>
Reply-To: devel(a)lists.fedoraproject.org
To: devel-announce(a)lists.fedoraproject.org, devel(a)lists.fedoraproject.org
https://fedoraproject.org/wiki/Changes/FreeIPA_Python_2_Removal
== Summary ==
FreeIPA 4.8 will require Python 3.6+ and therefore no longer provide
Python 2 packages on Fedora 30.
== Owner ==
* Name: Christian Heimes (cheimes)
* Email: cheimes(a)redhat.com
== Detailed Description ==
On Fedora 27 to 29, FreeIPA client and server packages use Python 3
default. Additionally FreeIPA provides Python 2 packages. The Python 2
packages are not used by FreeIPA, but are merely provided for
backwards compatibility, e.g. Python 2 applications that utilize
python2-ipaclient to communicate with a FreeIPA server.
The FreeIPA upstream project is going to drop support for Python 2.7
in the upcoming FreeIPA release 4.8.0. Python 2 support is not only
causing development and testing overhead. It's also blocking
improvements like using new python-based 389-DS installer, use of new
Python features, and more. The removal of Python 2 support was
[https://lists.fedoraproject.org/archives/list/freeipa-devel@lists.fedorah...
announced] on the FreeIPA development on 2018-09-03.
=== Removed packages ===
* python2-ipalib
* python2-ipaclient
* python2-ipaserver
* python2-ipatests
* python2-ipa-desktop-profile-client (dependency)
== Benefit to Fedora ==
The removal of Python 2 support is in alignment with Mass Python 2
Package Removal proposal. FreeIPA depends has a large list of
dependencies. The change makes it possible to drop more Python 2
packages.
== Scope ==
* Proposal owners:
** Release FreeIPA 4.8.0 until mid January 2019
** Build and deliver FreeIPA 4.8.0 packages before 2019-01-29
** Add removed packages to ''fedora-obsolete-packages''.
* Other developers:
** Port Fleet Commander's fc-admin to Python 3 and no longer depend on
FreeIPA's Python 2 packages.
** Drop Fleet Command's Python 2 desktop profile package
** Port Ipsilion Project to Python 3 and no longer depend on FreeIPA's
Python 2 packages.
FreeIPA team is willing to help to aforementioned projects with their
port to use Python 3 FreeIPA libraries.
* Release engineering: [https://pagure.io/releng/issue/7760 #7760]
There is no releng work needed for this change.
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
== Upgrade/compatibility impact ==
The removal of Python 2 support will not affect FreeIPA server or
client systems. However 3rd party applications and scripts may be
affected. These applications and scripts must be ported to Python 3.
On upgrade from Fedora 29, previously installed ''python2-ipa*''
packages cannot be retained. All ''python[23]-ipa*'' packages have a
hard version dependency on common files with a requires line like
''Requires: freeipa-common = %{version}-%{release}''. This requires
cannot be satisfied for existing ''python2-ipa*''. Therefore
''python2-ipa*'' packages have to added to
''fedora-obsolete-packages'' package. This will ensure that the Python
2 packages are uninstalled on system upgrade.
== How To Test ==
* A fresh Fedora 30 installation will no longer have python2-ipa*
packages available.
* On upgrade from Fedora 29, all python2-ipa* packages are uninstalled.
== User Experience ==
N/A
== Dependencies ==
* fedora-obsolete-packages
* ipsilon-tools-ipa
* python2-ipa-desktop-profile-client
* fleet-commander-admin
== Contingency Plan ==
* Contingency mechanism: Keep shipping FreeIPA 4.7
* Contingency deadline: 2019-01-31
* Blocks release? No
* Blocks product? N/A
== Documentation ==
This page is the main documentation.
Also see https://pythonclock.org/ and
https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal .
== Release Notes ==
FreeIPA no longer supports Python 2. All ''python2-ipa*'' packages and
''python-ipa*'' aliases are discontinued.
--
Ben Cotton
Fedora Program Manager
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce(a)lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedora...
5 years, 7 months
Drop Python 2 support
by Christian Heimes
Hello,
I like to drop Python 2 support from current master. For over two years,
the FreeIPA development team has worked hard on porting FreeIPA to
Python 3. Since release 4.6, FreeIPA has been using Python 3 by default
on Fedora. Now it's time to make the final step and remove Python 2
compatibility completely.
Benefits & Reasons
==================
Python 2.7 will reach its extended support lifetime by 2020-01-01. After
2020, the upstream developers will no longer provide any fixes or
security patches.
Python 2 support has become a burden for the FreeIPA team. With removal
of Python 2 support, FreeIPA can finally start to use new Python 3
language features like f-strings and type annotations, or improved
standard library modules like configparser. Removal of Python 2 support
would speed up development and testing as well as allow us to clean the
code base. The code is littered with special casing for Python 2 / 3
differences.
Dependency on Python 2 is also blocking improvement like new Python
installer for 389-DS, see https://github.com/freeipa/freeipa/pull/1563.
The lib389 Python package is only available for Python 3.
The Fedora Python maintenance team is working on mass removal of Python
2 packages, see
https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal .
FreeIPA depends on lots of Python packages. Dropping Python 2 support
will allow us to remove additional Python 2 dependencies, too.
Time line
=========
FreeIPA 4.8 will be the first release that requires at least Python 3.6.
The version is going to be released either end of 2018 or early 2019.
4.8 is scheduled to land in Fedora 30 (GA 2019-05-07).
Scope
=====
The server, client and all Python libraries of FreeIPA 4.8 will require
Python 3.6 or newer.
FreeIPA 4.7 and 4.6 will continue to support Python 2.
Affected packages / distributions
=================================
Fedora 30 will no longer contain the following packages:
* python2-ipalib
* python2-ipaclient
* python2-ipaserver
* python2-ipatests
This change affects Ipsilon Project and Fleet Commander packages:
* python2-ipa-desktop-profile-client
* fleet-commander-admin
* ipsilon-tools-ipa
Further more, Debian and Ubuntu need to use Python 3.6 or newer instead
of Python 2.7. As far as I know, Samba is holding back FreeIPA on these
distributions.
Patrick (Ipsilon), Oliver (Fleet Commander), and Timo (Debian/Ubuntu)
have been working on Python 3.
Pull request
============
https://github.com/freeipa/freeipa/pull/2020/files
Regards,
Christian
--
Christian Heimes
Senior Software Engineer, Identity Management and Platform Security
Red Hat GmbH, http://www.de.redhat.com/, Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Michael Cunningham, Michael
O'Neill, Eric Shander
5 years, 7 months
Compile freeipa 4.7 on CentOS 7 Error
by Sven Vogel
Hi,
we compile freeipa 4.7 from git. We use 7.5.1804.
when we run ./configure we get the following error.
checking for a sed that does not truncate output... (cached) /bin/sed
checking for msgattrib... /bin/msgattrib
checking supported IPA platform... configure: error: IPA platform centos is not supported
is there anything what we have to do?
Thanks
Sven
__
Sven Vogel
Cloud Solution Architect
EWERK RZ GmbH
Brühl 24, D-04109 Leipzig
P +49 341 42649 - 11
F +49 341 42649 - 18
S.Vogel(a)ewerk.com
www.ewerk.com
Geschäftsführer:
Dr. Erik Wende, Hendrik Schubert, Frank Richter, Gerhard Hoyer
Registergericht: Leipzig HRB 17023
Zertifiziert nach:
ISO/IEC 27001:2013
DIN EN ISO 9001:2015
DIN ISO/IEC 20000-1:2011
EWERK-Blog<https://blog.ewerk.com/> | LinkedIn<https://www.linkedin.com/company/ewerk-group> | Xing<https://www.xing.com/company/ewerk> | Twitter<https://twitter.com/EWERK_Group> | Facebook<https://de-de.facebook.com/EWERK.IT/>
Auskünfte und Angebote per Mail sind freibleibend und unverbindlich.
Disclaimer Privacy:
Der Inhalt dieser E-Mail (einschließlich etwaiger beigefügter Dateien) ist vertraulich und nur für den Empfänger bestimmt. Sollten Sie nicht der bestimmungsgemäße Empfänger sein, ist Ihnen jegliche Offenlegung, Vervielfältigung, Weitergabe oder Nutzung des Inhalts untersagt. Bitte informieren Sie in diesem Fall unverzüglich den Absender und löschen Sie die E-Mail (einschließlich etwaiger beigefügter Dateien) von Ihrem System. Vielen Dank.
The contents of this e-mail (including any attachments) are confidential and may be legally privileged. If you are not the intended recipient of this e-mail, any disclosure, copying, distribution or use of its contents is strictly prohibited, and you should please notify the sender immediately and then delete it (including any attachments) from your system. Thank you.
5 years, 7 months
