<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:8pt">Rob<br>I am giving it a fresh start and I notice similar issues.<br><br>1) I wasn't able to use the "--setup-ca" while running the ipa-replica-install on the replica. It stopped the install after the ntpd step see below.<br><br>Done configuring NTP daemon (ntpd).<br>A CA is already configured on this system.<br><div><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 10.6667px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;"><span>2) So I tried my install command again without the --setup-ca option. It went furthur although it completed it show one error see below.</span></div><div style="color: rgb(0, 0, 0); font-size: 10.6667px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;"><br> MY COMMAND: --> ipa-replica-install /var/tmp/replica-info-ldap2.mydomain.com.gpg --skip-conncheck</div><div style="color: rgb(0, 0, 0); font-size: 10.6667px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;">the skip-conncheck was needed to complete the install. Connections checks were manually done.<br><span></span></div><div style="color: rgb(0, 0, 0); font-size: 10.6667px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;"><span>14/31]: configuring lockout plugin<br> [15/31]: creating indices<br> [16/31]: enabling referential integrity plugin<br> [17/31]: configuring ssl for ds instance<br>ipa : ERROR certmonger failed starting to track certificate: Command '/usr/bin/ipa-getcert start-tracking -d /etc/dirsrv/slapd-</span><span><span>MYDOMAIN.COM</span> -n Server-Cert -p /etc/dirsrv/slapd-</span><span><span>MYDOMAIN.COM</span>/pwdfile.txt -C /usr/lib64/ipa/certmonger/restart_dirsrv MYDOMAIN.COM' returned non-zero exit status 1<br> [18/31]: configuring certmap.conf<br> [19/31]: configure autobind for root</span></div><div style="color: rgb(0, 0, 0); font-size: 10.6667px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;"><span>.........................................<br></span></div><div>3) The replica installed fine I can access the same database from the replica's website.<br><br>4) I cannot add new clients.<br>MY COMMAND: --> ipa-client-install --domain=mydomain.com --server=ldap2.mydomain.com --hostname=test500.mydomain.com -d <br><br>ldap.mydomain.com = master<br>ldap2.mydomain.com = replica<br><br></div><div>Shreeraj <br>---------------------------------------------------------------------------------------- <br> <br>Change is the only Constant !</div><div style="display: block;" class="yahoo_quoted"> <br> <br> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 8pt;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> On Friday, February 14, 2014 11:40 AM, Rob Crittenden <rcritten@redhat.com> wrote:<br> </font> </div> <div class="y_msg_container">Shree wrote:<br>> 1) 7839 TCP is open between the master and replica, do I need 7389 udp<br>> also? What about clients and replica?<br>> I have the following ports opened and tested between master and replica.<br>> --> 389 (TCP), 636 (TCP), 88 (TCP), 464 (TCP), 80 (TCP), 443 (TCP), 7389<br>> (TCP)<br>> and 88 (UDP) 464 (UDP)<br>> Do I need any more ports opened, I have to work with another team to get<br>> this done, so it will help having all the information.<br><br>No, this list is enough. Still, it can't connect to it. Seeing the <br>failure output from the connection check might be useful, or at least <br>confirm the same.<br><br>> 2)I see you skip the connection check, what was failing? :-- Yes my<br>> replica install fails unless I user --skip connection check. I have<br>> tested the connection with the ports mentioned during the install.<br><br>I don't know what to say, the logs pretty clearly indicate that it can't <br>connect on port 7389.<br><br>> 3) In the ipareplica-install log this is reported:<br>><br>> Failed to setup the replication for cloning. :--- Yes but what is the<br>> solution?<br><br>Fix the firewall.<br><br>><br>> 4) And in the debug log:<br>><br>> :- Also what is the solution for the Java.io error?<br><br>Same thing. One failure cascades to another.<br><br>rob<br><br><br></div> </div> </div> </div> </div></body></html>