FreeIPA-users January 2019

freeipa-users@lists.fedorahosted.org

62 participants
84 discussions

FreeIPA not working (Segfault in Kerberos) after upgrading to Fedora 29
by Patrick Dung 03 Jan '19

03 Jan '19

Hello, After upgrading to Fedora 29, Kerberos on the primary Free IPA is not working. Another FreeIPA replica failed to start. It is because Kerberos (GSSAPI) is not working and ns-slapd cannot start. Replication agreement cannot be established via Kerberos (GSSAPI) I got this messages in for the kernel log. Dec 27 02:00:05 server1 kernel: [ 2551.272984] krb5_child[25058]: segfault at 6e ip 00007f58ae29464e sp 00007fffb5047bf0 error 4 in libkrb5.so.3.3[7f58ae26b000+71000] Dec 27 02:00:05 server1 kernel: [ 2551.273449] Code: fc bf 28 00 00 00 55 53 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 e8 2b 9b fd ff 48 85 c0 0f 84 02 01 00 00 <f3> 41 0f 6f 07 f3 41 0f 6f 4f 10 48 89 c3 49 63 7f 20 0f 11 00 0f Dec 27 02:00:05 server1 kernel: [ 2551.272984] krb5_child[25058]: segfault at 6e ip 00007f58ae29464e sp 00007fffb5047bf0 error 4 in libkrb5.so.3.3[7f58ae26b000+71000] Dec 27 02:00:05 server1 kernel: [ 2551.273449] Code: fc bf 28 00 00 00 55 53 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 e8 2b 9b fd ff 48 85 c0 0f 84 02 01 00 00 <f3> 41 0f 6f 07 f3 41 0f 6f 4f 10 48 89 c3 49 63 7f 20 0f 11 00 0f Any ideas? FYI I had already opened a ticket in bugzilla: 1662175 – Segfault in freeipa/krb5_child after upgrading to Fedora 29 | | | | 1662175 – Segfault in freeipa/krb5_child after upgrading to Fedora 29 | | | Thanks,Patrick

3 2

yum upgrade doesn't do IPA upgrade
by Charles Hedrick 03 Jan '19

03 Jan '19

For some reason on one of our 3 servers, yum update didn’t run the IPA upgrade. /var/log/ipaupgrade.log was zero length. “ipactl start” noted that an upgraded was needed, and did it. So it wasn’t a big deal. But it would be nice for yum update to show some sign if there’s an issue. And perhaps output a message saying that the upgrade was done successfully.

2 1

Adding Linux client in WebUI reports error: The host was added but the DNS update failed with: DNS reverse zone 168.192.in-addr.arpa. for IP address 192.168.1.47 is not managed by this server
by 74cmonty 02 Jan '19

02 Jan '19

Hi, I have completed setup of FreeIPA on 2 nodes: master + replica Both servers are configured in network 192.168.100.0/24. For both nodes I have defined a DNS forwarder to 192.168.1.101; this is my main DNS server running Pi-hole (Linux network-level advertisement and internet tracker blocking application). Now I try to add a Linux client with this IP 192.168.1.47 in the WebUI and I get this error message: The host was added but the DNS update failed with: DNS reverse zone 168.192.in-addr.arpa. for IP address 192.168.1.47 is not managed by this server How can I solve this issue w/o shutting down Pi-hole? Is the concept of using Pi-hole as a DNS forwarder suboptimal? Please advise. THX

3 4

Service named-pkcs11.service on master fails: Process 3946 (named-pkcs11) of user 25 dumped core
by 74cmonty 02 Jan '19

02 Jan '19

Hi, starting service `named-pkcs11.service` fails with a core dump: ``` Dez 29 17:32:25 ipa-master.example.com systemd-coredump[2901]: Process 2895 (named-pkcs11) of user 25 dumped core. Stack trace of thread 2897: #0 0x00007f2b386c753f raise (libc.so.6) #1 0x00007f2b386b1895 abort (libc.so.6) #2 0x00007f2b386b1769 __assert_fail_base.cold.0 (libc.so.6) #3 0x00007f2b386bf9f6 __assert_fail (libc.so.6) #4 0x00007f2b38fb8c95 n/a (libkrb5.so.3) #5 0x00007f2b38fb96ef n/a (libkrb5.so.3) #6 0x00007f2b38fc2d0c n/a (libkrb5.so.3) #7 0x00007f2b38fbc8b3 n/a (libkrb5.so.3) #8 0x00007f2b38fbb9dd krb5_cc_select (libkrb5.so.3) #9 0x00007f2b3909b959 n/a (libgssapi_krb5.so.2) #10 0x00007f2b390a4a82 n/a (libgssapi_krb5.so.2) #11 0x00007f2b390a5b06 n/a (libgssapi_krb5.so.2) #12 0x00007f2b3908f0bb gss_init_sec_context (libgssapi_krb5.so.2) #13 0x00007f2b34824667 gssapi_client_mech_step (libgssapiv2.so) #14 0x00007f2b34907471 sasl_client_step (libsasl2.so.3) #15 0x00007f2b349075fa sasl_client_start (libsasl2.so.3) #16 0x00007f2b3494624b ldap_int_sasl_bind (libldap-2.4.so.2) #17 0x00007f2b349498ec ldap_sasl_interactive_bind (libldap-2.4.so.2) #18 0x00007f2b34949b0a ldap_sasl_interactive_bind_s (libldap-2.4.so.2) #19 0x00007f2b34992c6f ldap_connect (ldap.so) #20 0x00007f2b3499fa90 new_ldap_instance (ldap.so) #21 0x00007f2b34990292 dyndb_init (ldap.so) #22 0x00007f2b3943f75a dns_dyndb_load (libdns-pkcs11.so.1102) #23 0x00005612e6a46718 n/a (named-pkcs11) #24 0x00005612e6a53ed3 n/a (named-pkcs11) #25 0x00005612e6a54f47 n/a (named-pkcs11) #26 0x00007f2b3938d899 n/a (libisc-pkcs11.so.169) #27 0x00007f2b38bd458e start_thread (libpthread.so.0) #28 0x00007f2b3878c6a3 __clone (libc.so.6) Stack trace of thread 2898: #0 0x00007f2b38bdaa8a pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f2b393ad2b0 isc_condition_waituntil (libisc-pkcs11.so.169) #2 0x00007f2b39394683 n/a (libisc-pkcs11.so.169) #3 0x00007f2b38bd458e start_thread (libpthread.so.0) #4 0x00007f2b3878c6a3 __clone (libc.so.6) Stack trace of thread 2899: #0 0x00007f2b3878c9d7 epoll_wait (libc.so.6) #1 0x00007f2b393a501c n/a (libisc-pkcs11.so.169) #2 0x00007f2b38bd458e start_thread (libpthread.so.0) #3 0x00007f2b3878c6a3 __clone (libc.so.6) Stack trace of thread 2896: #0 0x00007f2b38bda73c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f2b3938d695 n/a (libisc-pkcs11.so.169) #2 0x00007f2b38bd458e start_thread (libpthread.so.0) #3 0x00007f2b3878c6a3 __clone (libc.so.6) Stack trace of thread 2895: #0 0x00007f2b386c78ee __sigsuspend (libc.so.6) #1 0x00007f2b3939713e isc__app_ctxrun (libisc-pkcs11.so.169) #2 0x00007f2b39397d73 isc_app_run (libisc-pkcs11.so.169) #3 0x00005612e6a07d05 n/a (named-pkcs11) #4 0x00007f2b386b3413 __libc_start_main (libc.so.6) #5 0x00005612e6a0865e n/a (named-pkcs11) Dez 29 17:32:25 ipa-master.example.com audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@10-2900-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' ``` Full log is available here: http://freetexthost.com/nx1e4xhmyi Assuming this issue is related to file /usr/lib64/bind/ldap.so I tried to scp from replica server. However this fails with this weird error: ```[root@ipa-master ~]# ssh -p 22202 ipa-replica.example.com ssh_exchange_identification: Connection closed by remote host [root@ipa-master ~]# scp -P 22201 ipa-replica.example.com:/usr/lib64/bind/ldap.so /home/ Password: \033[0m\033[1;34m /:-------------:\ \033[0m\033[1;34m root\033[0m\033[1m(a)\033[0m\033[0m\033[1;34mipa-replica.example.com\033[0m ````

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2019