Hi guys,<div>I'm still working with the beta version.<br><div>I tried the setup of another replica and this is what I'm getting:</div><div><br></div><div><div><font face="'courier new', monospace">[root@freeipa04 ~]# ipa-replica-install --setup-dns --no-forwarders /var/lib/ipa/replica-info-freeipa04.unix.mydomain.it.gpg</font></div>
<div><font face="'courier new', monospace">Directory Manager (existing master) password:</font></div><div><font face="'courier new', monospace"><br></font></div><div><font face="'courier new', monospace">Warning: Hostname (<a href="http://freeipa04.unix.mydomain.it">freeipa04.unix.mydomain.it</a>) not found in DNS</font></div>
<div><font face="'courier new', monospace">Run connection check to master</font></div><div><font face="'courier new', monospace">Check connection from replica to remote master '<a href="http://freeipa01.unix.mydomain.it">freeipa01.unix.mydomain.it</a>':</font></div>
<div><font face="'courier new', monospace"> Directory Service: Unsecure port (389): OK</font></div><div><font face="'courier new', monospace"> Directory Service: Secure port (636): OK</font></div><div>
<font face="'courier new', monospace"> Kerberos KDC: TCP (88): OK</font></div><div><font face="'courier new', monospace"> Kerberos Kpasswd: TCP (464): OK</font></div><div><font face="'courier new', monospace"> HTTP Server: Unsecure port (80): OK</font></div>
<div><font face="'courier new', monospace"> HTTP Server: Secure port (443): OK</font></div><div><font face="'courier new', monospace"><br></font></div><div><font face="'courier new', monospace">The following list of ports use UDP protocol and would need to be</font></div>
<div><font face="'courier new', monospace">checked manually:</font></div><div><font face="'courier new', monospace"> Kerberos KDC: UDP (88): SKIPPED</font></div><div><font face="'courier new', monospace"> Kerberos Kpasswd: UDP (464): SKIPPED</font></div>
<div><font face="'courier new', monospace"><br></font></div><div><font face="'courier new', monospace">Connection from replica to master is OK.</font></div><div><font face="'courier new', monospace">Start listening on required ports for remote master check</font></div>
<div><font face="'courier new', monospace">Get credentials to log in to remote master</font></div><div><font face="'courier new', monospace"><a href="mailto:admin@UNIX.MYDOMAIN.IT">admin@UNIX.MYDOMAIN.IT</a> password:</font></div>
<div><font face="'courier new', monospace"><br></font></div><div><font face="'courier new', monospace">Execute check on remote master</font></div><div><font face="'courier new', monospace"><a href="mailto:admin@freeipa01.unix.mydomain.it">admin@freeipa01.unix.mydomain.it</a>'s password:</font></div>
<div><font face="'courier new', monospace">Check connection from master to remote replica '<a href="http://freeipa04.unix.mydomain.it">freeipa04.unix.mydomain.it</a>':</font></div><div><font face="'courier new', monospace"> Directory Service: Unsecure port (389): OK</font></div>
<div><font face="'courier new', monospace"> Directory Service: Secure port (636): OK</font></div><div><font face="'courier new', monospace"> Kerberos KDC: TCP (88): OK</font></div><div><font face="'courier new', monospace"> Kerberos KDC: UDP (88): OK</font></div>
<div><font face="'courier new', monospace"> Kerberos Kpasswd: TCP (464): OK</font></div><div><font face="'courier new', monospace"> Kerberos Kpasswd: UDP (464): OK</font></div><div><font face="'courier new', monospace"> HTTP Server: Unsecure port (80): OK</font></div>
<div><font face="'courier new', monospace"> HTTP Server: Secure port (443): OK</font></div><div><font face="'courier new', monospace"><br></font></div><div><font face="'courier new', monospace">Connection from master to replica is OK.</font></div>
<div><font face="'courier new', monospace"><br></font></div><div><font face="'courier new', monospace">Connection check OK</font></div><div><font face="'courier new', monospace">Configuring ntpd</font></div>
<div><font face="'courier new', monospace"> [1/4]: stopping ntpd</font></div><div><font face="'courier new', monospace"> [2/4]: writing configuration</font></div><div><font face="'courier new', monospace"> [3/4]: configuring ntpd to start on boot</font></div>
<div><font face="'courier new', monospace"> [4/4]: starting ntpd</font></div><div><font face="'courier new', monospace">done configuring ntpd.</font></div><div><font face="'courier new', monospace">Configuring directory server: Estimated time 1 minute</font></div>
<div><font face="'courier new', monospace"> [1/30]: creating directory server user</font></div><div><font face="'courier new', monospace"> [2/30]: creating directory server instance</font></div><div><font face="'courier new', monospace"> [3/30]: adding default schema</font></div>
<div><font face="'courier new', monospace"> [4/30]: enabling memberof plugin</font></div><div><font face="'courier new', monospace"> [5/30]: enabling referential integrity plugin</font></div><div><font face="'courier new', monospace"> [6/30]: enabling winsync plugin</font></div>
<div><font face="'courier new', monospace"> [7/30]: configuring replication version plugin</font></div><div><font face="'courier new', monospace"> [8/30]: enabling IPA enrollment plugin</font></div><div>
<font face="'courier new', monospace"> [9/30]: enabling ldapi</font></div><div><font face="'courier new', monospace"> [10/30]: configuring uniqueness plugin</font></div><div><font face="'courier new', monospace"> [11/30]: configuring uuid plugin</font></div>
<div><font face="'courier new', monospace"> [12/30]: configuring modrdn plugin</font></div><div><font face="'courier new', monospace"> [13/30]: enabling entryUSN plugin</font></div><div><font face="'courier new', monospace"> [14/30]: configuring lockout plugin</font></div>
<div><font face="'courier new', monospace"> [15/30]: creating indices</font></div><div><font face="'courier new', monospace"> [16/30]: configuring ssl for ds instance</font></div><div><font face="'courier new', monospace"> [17/30]: configuring certmap.conf</font></div>
<div><font face="'courier new', monospace"> [18/30]: configure autobind for root</font></div><div><font face="'courier new', monospace"> [19/30]: configure new location for managed entries</font></div><div>
<font face="'courier new', monospace"> [20/30]: restarting directory server</font></div><div><font face="'courier new', monospace"> [21/30]: setting up initial replication</font></div><div><font face="'courier new', monospace">Starting replication, please wait until this has completed.</font></div>
<div><font face="'courier new', monospace">Update in progress</font></div><div><font face="'courier new', monospace">Update in progress</font></div><div><font face="'courier new', monospace">Update in progress</font></div>
<div><font face="'courier new', monospace">Update in progress</font></div><div><font face="'courier new', monospace">Update in progress</font></div><div><font face="'courier new', monospace">Update succeeded</font></div>
<div><font face="'courier new', monospace"> [22/30]: adding replication acis</font></div><div><font face="'courier new', monospace"> [23/30]: setting Auto Member configuration</font></div><div><font face="'courier new', monospace"> [24/30]: enabling S4U2Proxy delegation</font></div>
<div><font face="'courier new', monospace"> [25/30]: initializing group membership</font></div><div><font face="'courier new', monospace"> [26/30]: adding master entry</font></div><div><font face="'courier new', monospace"> [27/30]: configuring Posix uid/gid generation</font></div>
<div><font face="'courier new', monospace"> [28/30]: enabling compatibility plugin</font></div><div><font face="'courier new', monospace"> [29/30]: tuning directory server</font></div><div><font face="'courier new', monospace"> [30/30]: configuring directory to start on boot</font></div>
<div><font face="'courier new', monospace">done configuring dirsrv.</font></div><div><font face="'courier new', monospace">Configuring Kerberos KDC: Estimated time 30 seconds</font></div><div><font face="'courier new', monospace"> [1/9]: adding sasl mappings to the directory</font></div>
<div><font face="'courier new', monospace"> [2/9]: writing stash file from DS</font></div><div><font face="'courier new', monospace"> [3/9]: configuring KDC</font></div><div><font face="'courier new', monospace"> [4/9]: creating a keytab for the directory</font></div>
<div><font face="'courier new', monospace"> [5/9]: creating a keytab for the machine</font></div><div><font face="'courier new', monospace"> [6/9]: adding the password extension to the directory</font></div>
<div><font face="'courier new', monospace"> [7/9]: enable GSSAPI for replication</font></div><div><font face="'courier new', monospace"> [8/9]: starting the KDC</font></div><div><font face="'courier new', monospace"> [9/9]: configuring KDC to start on boot</font></div>
<div><font face="'courier new', monospace">done configuring krb5kdc.</font></div><div><font face="'courier new', monospace">Configuring kadmin</font></div><div><font face="'courier new', monospace"> [1/2]: starting kadmin</font></div>
<div><font face="'courier new', monospace"> [2/2]: configuring kadmin to start on boot</font></div><div><font face="'courier new', monospace">done configuring kadmin.</font></div><div><font face="'courier new', monospace">Configuring ipa_memcached</font></div>
<div><font face="'courier new', monospace"> [1/2]: starting ipa_memcached</font></div><div><font face="'courier new', monospace"> [2/2]: configuring ipa_memcached to start on boot</font></div><div><font face="'courier new', monospace">done configuring ipa_memcached.</font></div>
<div><font face="'courier new', monospace">Configuring the web interface: Estimated time 1 minute</font></div><div><font face="'courier new', monospace"> [1/13]: disabling mod_ssl in httpd</font></div><div>
<font face="'courier new', monospace"> [2/13]: setting mod_nss port to 443</font></div><div><font face="'courier new', monospace"> [3/13]: setting mod_nss password file</font></div><div><font face="'courier new', monospace"> [4/13]: enabling mod_nss renegotiate</font></div>
<div><font face="'courier new', monospace"> [5/13]: adding URL rewriting rules</font></div><div><font face="'courier new', monospace"> [6/13]: configuring httpd</font></div><div><font face="'courier new', monospace"> [7/13]: setting up ssl</font></div>
<div><font face="'courier new', monospace"> [8/13]: publish CA cert</font></div><div><font face="'courier new', monospace"> [9/13]: creating a keytab for httpd</font></div><div><font face="'courier new', monospace"> [10/13]: clean up any existing httpd ccache</font></div>
<div><font face="'courier new', monospace"> [11/13]: configuring SELinux for httpd</font></div><div><font face="'courier new', monospace"> [12/13]: restarting httpd</font></div><div><font face="'courier new', monospace"> [13/13]: configuring httpd to start on boot</font></div>
<div><font face="'courier new', monospace">done configuring httpd.</font></div><div><font face="'courier new', monospace">Applying LDAP updates</font></div><div><font face="'courier new', monospace">Restarting the directory server</font></div>
<div><font face="'courier new', monospace">Restarting the KDC</font></div><div><font face="'courier new', monospace">Restarting the web server</font></div><div><font face="'courier new', monospace">Using reverse zone 146.168.192.in-addr.arpa.</font></div>
<div><font face="'courier new', monospace">Configuring named:</font></div><div><font face="'courier new', monospace"> [1/8]: adding NS record to the zone</font></div><div><font face="'courier new', monospace"> [2/8]: setting up reverse zone</font></div>
<div><font face="'courier new', monospace"> [3/8]: setting up our own record</font></div><div><font face="'courier new', monospace"> [4/8]: setting up kerberos principal</font></div><div><font face="'courier new', monospace"> [5/8]: setting up named.conf</font></div>
<div><font face="'courier new', monospace"> [6/8]: restarting named</font></div><div><font face="'courier new', monospace"> [7/8]: configuring named to start on boot</font></div><div><font face="'courier new', monospace"> [8/8]: changing resolv.conf to point to ourselves</font></div>
<div><font face="'courier new', monospace">done configuring named.</font></div><div><font face="'courier new', monospace">Configuration of client side components failed!</font></div><div><font face="'courier new', monospace">ipa-client-install returned: Command '/usr/sbin/ipa-client-install --on-master --unattended --domain <a href="http://unix.mydomain.it">unix.mydomain.it</a> --server <a href="http://freeipa04.unix.mydomain.it">freeipa04.unix.mydomain.it</a> --realm <a href="http://UNIX.MYDOMAIN.IT">UNIX.MYDOMAIN.IT</a>' returned non-zero exit status 1</font></div>
<div><font face="'courier new', monospace">creation of replica failed: Failed to configure the client</font></div><div><font face="'courier new', monospace"><br></font></div><div><font face="'courier new', monospace">Your system may be partly configured.</font></div>
<div><font face="'courier new', monospace">Run /usr/sbin/ipa-server-install --uninstall to clean up.</font></div><div><font face="'courier new', monospace">[root@freeipa04 ~]# </font></div></div><div><br>
</div>
<div>And these are my last lines of the file /var/log/ipaclient-install.log</div><div><br></div><div><font face="'courier new', monospace">[cut]</font></div><div><div><font face="'courier new', monospace">2012-03-25T15:13:40Z DEBUG stdout=Kerberos 5 version 1.9.3</font></div>
<div><font face="'courier new', monospace"><br></font></div><div><font face="'courier new', monospace">2012-03-25T15:13:40Z DEBUG stderr=</font></div><div><font face="'courier new', monospace">2012-03-25T15:13:40Z DEBUG importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/role.py'</font></div>
<div><font face="'courier new', monospace">2012-03-25T15:13:40Z DEBUG importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/selfservice.py'</font></div><div><font face="'courier new', monospace">2012-03-25T15:13:40Z DEBUG importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/selinuxusermap.py'</font></div>
<div><font face="'courier new', monospace">2012-03-25T15:13:40Z DEBUG importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/service.py'</font></div><div><font face="'courier new', monospace">2012-03-25T15:13:40Z DEBUG importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/sudocmd.py'</font></div>
<div><font face="'courier new', monospace">2012-03-25T15:13:40Z DEBUG importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/sudocmdgroup.py'</font></div><div><font face="'courier new', monospace">2012-03-25T15:13:40Z DEBUG importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/sudorule.py'</font></div>
<div><font face="'courier new', monospace">2012-03-25T15:13:40Z DEBUG importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/user.py'</font></div><div><font face="'courier new', monospace">2012-03-25T15:13:40Z DEBUG importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/virtual.py'</font></div>
<div><font face="'courier new', monospace">2012-03-25T15:13:40Z DEBUG importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/xmlclient.py'</font></div><div><font face="'courier new', monospace">2012-03-25T15:13:42Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf'</font></div>
<div><font face="'courier new', monospace">2012-03-25T15:13:42Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index'</font></div><div><font face="'courier new', monospace">2012-03-25T15:13:42Z DEBUG Unable to activate the SSH service in SSSD config.</font></div>
<div><font face="'courier new', monospace">2012-03-25T15:13:42Z DEBUG args=/usr/bin/certutil -A -d /etc/pki/nssdb -n IPA CA -t CT,C,C -a -i /etc/ipa/ca.crt</font></div><div><font face="'courier new', monospace">2012-03-25T15:13:42Z DEBUG stdout=</font></div>
<div><font face="'courier new', monospace">2012-03-25T15:13:42Z DEBUG stderr=certutil: could not add certificate to token or database: Error adding certificate to database.</font></div></div><div><br></div><div>I tried to manually execute the command "/usr/bin/certutil -A -d /etc/pki/nssdb -n IPA CA -t CT,C,C -a -i /etc/ipa/ca.crt"</div>
</div><div><div><font face="'courier new', monospace">[root@freeipa04 ~]# /usr/bin/certutil -A -d /etc/pki/nssdb -n IPA CA -t CT,C,C -a -i /etc/ipa/ca.crt</font></div><div><font face="'courier new', monospace">[root@freeipa04 ~]# echo $?</font></div>
<div><font face="'courier new', monospace">0</font></div></div><div><br></div><div>Any help?</div><div>Thanks in advance as usual</div><div><br></div><div>Marco</div>