<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style></style></head><body bgcolor=white lang=EN-US link=blue vlink=purple><div class=WordSection1>Hey,<o:p></o:p><o:p> </o:p>I’m still trying to figure out this error but I am getting nothing.<o:p></o:p>Anyone have any suggestions or ideas on why this is failing?<o:p></o:p><o:p> </o:p>Matt<o:p></o:p><o:p> </o:p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>From: freeipa-users-bounces@redhat.com [mailto:freeipa-users-bounces@redhat.com] On Behalf Of Joseph, Matthew (EXP) Sent: Monday, April 08, 2013 12:30 PM To: Nathan Kinder Cc: freeipa-users@redhat.com Subject: Re: [Freeipa-users] EXTERNAL: Re: ipa-replica-install errors<o:p></o:p></div></div><o:p> </o:p>Hey,<o:p></o:p> Yup, the client side says the following;<o:p></o:p><o:p> </o:p>Op=-1 fd=64 closed – Peer does not recognize and trust the CA that issued your certificate.<o:p></o:p><o:p> </o:p>Matt<o:p></o:p><o:p> </o:p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>From: Nathan Kinder [mailto:nkinder@redhat.com] Sent: Monday, April 08, 2013 12:28 PM To: Joseph, Matthew (EXP) Cc: freeipa-users@redhat.com Subject: Re: EXTERNAL: Re: [Freeipa-users] ipa-replica-install errors<o:p></o:p></div></div><o:p> </o:p><div>On 04/08/2013 07:16 AM, Joseph, Matthew (EXP) wrote:<o:p></o:p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'>Hey,<o:p></o:p> <o:p></o:p>So on the IPA server under the access logs I am getting the following error.<o:p></o:p> <o:p></o:p>Error: could not send startTLS request: Error -11 (connect error) errno 0 (success)<o:p></o:p> <o:p></o:p>Any ideas?<o:p></o:p></blockquote>Does the access log on the receiving side show a connection attempt from the master at the same time? The access log will be located at /var/log/dirsrv/slapd-<DOMAIN>/access. -NGK<o:p></o:p> <o:p></o:p>Matt<o:p></o:p> <o:p></o:p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>From: Nathan Kinder [<a href="mailto:nkinder@redhat.com">mailto:nkinder@redhat.com</a>] Sent: Thursday, April 04, 2013 6:00 PM To: Joseph, Matthew (EXP) Cc: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: EXTERNAL: Re: [Freeipa-users] ipa-replica-install errors<o:p></o:p></div></div> <o:p></o:p><div>On 04/04/2013 07:14 AM, Joseph, Matthew (EXP) wrote:<o:p></o:p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'>Hello,<o:p></o:p> <o:p></o:p>I’m trying to setup a replica server with ipa-2.2.0-16 on both the Server and the Replica Server.<o:p></o:p> <o:p></o:p>Here are the steps I ran (From the Red Hat 6.3 IdM Administration Guide);<o:p></o:p>------------------------<o:p></o:p>IPA_Server:<o:p></o:p>ipa-replica-prepare ipareplica.example.com --ip-address 192.168.1.2<o:p></o:p>scp /var/lib/ipa/replica-info-ipareplica.example.com.gpg root@ ipareplica:/var/lib/ipa/<o:p></o:p> <o:p></o:p>IPA_Replica:<o:p></o:p>ipa-replica-install --setup-ca --setup-dns /var/lib/ipa/replica-info-ipareplica.exam ple.com.gpg<o:p></o:p>------------------------------<o:p></o:p> <o:p></o:p><div style='border:none;border-bottom:solid windowtext 1.0pt;padding:0in 0in 1.0pt 0in'>Below is the error I am getting when running ipa-replica-install;<o:p></o:p> <o:p></o:p></div> <o:p></o:p>Directory Manager (existing master) password: <o:p></o:p> <o:p></o:p>Run connection check to master<o:p></o:p>Check connection from replica to remote master 'IPA_Server.domain.ca':<o:p></o:p> Directory Service: Unsecure port (389): OK<o:p></o:p> Directory Service: Secure port (636): OK<o:p></o:p> Kerberos KDC: TCP (88): OK<o:p></o:p> Kerberos Kpasswd: TCP (464): OK<o:p></o:p> HTTP Server: Unsecure port (80): OK<o:p></o:p> HTTP Server: Secure port (443): OK<o:p></o:p> PKI-CA: Directory Service port (7389): OK<o:p></o:p> <o:p></o:p>The following list of ports use UDP protocol and would need to be<o:p></o:p>checked manually:<o:p></o:p> Kerberos KDC: UDP (88): SKIPPED<o:p></o:p> Kerberos Kpasswd: UDP (464): SKIPPED<o:p></o:p> <o:p></o:p>Connection from replica to master is OK.<o:p></o:p>Start listening on required ports for remote master check<o:p></o:p>Get credentials to log in to remote master<o:p></o:p><a href="mailto:admin@domain.ca">admin@domain.ca</a> password: <o:p></o:p> <o:p></o:p>Execute check on remote master<o:p></o:p>Check connection from master to remote replica 'IPA_Replica.domain.ca':<o:p></o:p> Directory Service: Unsecure port (389): OK<o:p></o:p> Directory Service: Secure port (636): OK<o:p></o:p> Kerberos KDC: TCP (88): OK<o:p></o:p> Kerberos KDC: UDP (88): OK<o:p></o:p> Kerberos Kpasswd: TCP (464): OK<o:p></o:p> Kerberos Kpasswd: UDP (464): OK<o:p></o:p> HTTP Server: Unsecure port (80): OK<o:p></o:p> HTTP Server: Secure port (443): OK<o:p></o:p> PKI-CA: Directory Service port (7389): OK<o:p></o:p> <o:p></o:p>Connection from master to replica is OK.<o:p></o:p> <o:p></o:p>Connection check OK<o:p></o:p>Configuring ntpd<o:p></o:p> [1/4]: stopping ntpd<o:p></o:p> [2/4]: writing configuration<o:p></o:p> [3/4]: configuring ntpd to start on boot<o:p></o:p> [4/4]: starting ntpd<o:p></o:p>done configuring ntpd.<o:p></o:p>Configuring directory server for the CA: Estimated time 30 seconds<o:p></o:p> [1/3]: creating directory server user<o:p></o:p> [2/3]: creating directory server instance<o:p></o:p> [3/3]: restarting directory server<o:p></o:p>done configuring pkids.<o:p></o:p>Configuring certificate server: Estimated time 3 minutes 30 seconds<o:p></o:p> [1/13]: creating certificate server user<o:p></o:p> [2/13]: creating pki-ca instance<o:p></o:p> [3/13]: configuring certificate server instance<o:p></o:p> [4/13]: disabling nonces<o:p></o:p> [5/13]: creating RA agent certificate database<o:p></o:p> [6/13]: importing CA chain to RA certificate database<o:p></o:p> [7/13]: fixing RA database permissions<o:p></o:p> [8/13]: setting up signing cert profile<o:p></o:p> [9/13]: set up CRL publishing<o:p></o:p> [10/13]: set certificate subject base<o:p></o:p> [11/13]: enabling Subject Key Identifier<o:p></o:p> [12/13]: configuring certificate server to start on boot<o:p></o:p> [13/13]: Configure HTTP to proxy connections<o:p></o:p>done configuring pki-cad.<o:p></o:p>Restarting the directory and certificate servers<o:p></o:p>Configuring directory server: Estimated time 1 minute<o:p></o:p> [1/30]: creating directory server user<o:p></o:p> [2/30]: creating directory server instance<o:p></o:p> [3/30]: adding default schema<o:p></o:p> [4/30]: enabling memberof plugin<o:p></o:p> [5/30]: enabling referential integrity plugin<o:p></o:p> [6/30]: enabling winsync plugin<o:p></o:p> [7/30]: configuring replication version plugin<o:p></o:p> [8/30]: enabling IPA enrollment plugin<o:p></o:p> [9/30]: enabling ldapi<o:p></o:p> [10/30]: configuring uniqueness plugin<o:p></o:p> [11/30]: configuring uuid plugin<o:p></o:p> [12/30]: configuring modrdn plugin<o:p></o:p> [13/30]: enabling entryUSN plugin<o:p></o:p> [14/30]: configuring lockout plugin<o:p></o:p> [15/30]: creating indices<o:p></o:p> [16/30]: configuring ssl for ds instance<o:p></o:p> [17/30]: configuring certmap.conf<o:p></o:p> [18/30]: configure autobind for root<o:p></o:p> [19/30]: configure new location for managed entries<o:p></o:p> [20/30]: restarting directory server<o:p></o:p> [21/30]: setting up initial replication<o:p></o:p>Starting replication, please wait until this has completed.<o:p></o:p>[IPA_Server.domain.ca] reports: Update failed! Status: [-11 - System error]<o:p></o:p><div style='border:none;border-bottom:solid windowtext 1.0pt;padding:0in 0in 1.0pt 0in'>creation of replica failed: Failed to start replication<o:p></o:p></div> <o:p></o:p>Also in the error log(/var/log/dirsrv/slapd-DOMAIN-CA/errors) is the following error;<o:p></o:p> <o:p></o:p>NSMMReplicationPlugin – agmt=”cn=metoIPA_Server.domain.ca” (ipa_server:389): Replica has a different generation ID than the local data.<o:p></o:p></blockquote>This is probably just fallout from the replica initialization failure. If a replica is never initialized, it will get a generation ID mismatch error when the master contacts it. <o:p></o:p> <o:p></o:p> <o:p></o:p>Any thoughts or ideas on this issue? Searching google I don’t see anyone getting the Status:-11 – System Error.<o:p></o:p>There was a bug in 389-ds-base that was fixed a while back where negative LDAP error codes were all printed as "System Error". The -11 is a connection error. Here is how it is defined in /usr/include/ldap.h: #define LDAP_CONNECT_ERROR (-11) It sounds like this connection error is occurring when it tries to initialize the replica. It might help to enable replication level logging on the master, then trying to run ipa-replica-install again. The errors in the 389 DS errors log might point to the problem. To enable replication level logging, you can perform the following operation with ldapmodify as "cn=Directory Manager": ------------------------------------------ dn: cn=config changetype: modify replace: nsslapd-errorlog-level nsslapd-errorlog-level: 8192 ------------------------------------------ When you are finished debugging the issue, don't forget to change the log level back to "0". -NGK <o:p></o:p> <o:p></o:p>Thanks,<o:p></o:p> <o:p></o:p>Matt<o:p></o:p> <o:p></o:p><pre>_______________________________________________<o:p></o:p></pre><pre>Freeipa-users mailing list<o:p></o:p></pre><pre><a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><o:p></o:p></pre><pre><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p></pre> <o:p></o:p><o:p> </o:p></div></body></html>