<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> From: Dmitri Pal [mailto:dpal@redhat.com] Sent: Tuesday, October 28, 2014 5:10 PM To: Craig White; freeipa-users@redhat.com Subject: Re: [Freeipa-users] getent passwd / group [SOLVED]<o:p></o:p> <o:p> </o:p> <div> On 10/28/2014 04:41 PM, Craig White wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> From: <a href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> [<a href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] On Behalf Of Craig White Sent: Tuesday, October 28, 2014 1:28 PM To: <a href="mailto:dpal@redhat.com">dpal@redhat.com</a>; <a href="mailto:freeipa-users@redhat.com"> freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] getent passwd / group [SOLVED]<o:p></o:p> <o:p></o:p> From: Dmitri Pal [<a href="mailto:dpal@redhat.com">mailto:dpal@redhat.com</a>] Sent: Tuesday, October 28, 2014 10:04 AM To: Craig White; <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] getent passwd / group<o:p></o:p> <o:p></o:p> <div> On 10/28/2014 12:11 PM, Craig White wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> From: <a href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> [<a href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] On Behalf Of Dmitri Pal Sent: Monday, October 27, 2014 5:32 PM To: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] getent passwd / group<o:p></o:p> <o:p></o:p> <div> On 10/27/2014 07:38 PM, Craig White wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> RHEL 6.5 – new install<o:p></o:p> ipa-server-3.0.0-42.el6.x86_64<o:p></o:p> 389-ds-base-1.2.11.15-47.el6.x86_64<o:p></o:p> <o:p></o:p> On the master, I get nothing<o:p></o:p> <o:p></o:p> [root@ipa001 log]# getent passwd admin<o:p></o:p> [root@ipa001 log]#<o:p></o:p> <o:p></o:p> But it works on the replica as expected<o:p></o:p> <o:p></o:p> [root@ipa002nadev01 ~]# getent passwd admin<o:p></o:p> admin:*:1140000000:1110000000:Administrator:/home/admin:/bin/bash<o:p></o:p> <o:p></o:p> I am used to using PADL / NSSWITCH with OpenLDAP and I am rather surprised that on both, ‘getent passwd’ and ‘getent group’ return only entries from local files but then again, I’ve never used sssd before.<o:p></o:p> <o:p></o:p> </blockquote> REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited<o:p></o:p> </blockquote> Then we need SSSD logs with the debug_level in the right sections as Jakub mentioned in his mail. ----<o:p></o:p> <div style="border:none;border-bottom:solid windowtext 1.0pt;padding:0in 0in 1.0pt 0in"> Sorry – I had a long meeting and should have noted that after restarting SSSD, it all started working again as expected. Clearly something I have to watch for and indeed, I moved the debug to the domain section for future.<o:p></o:p> </div> <pre>I should add – came to the realization that restarting sssd and went to long meeting, then came back and couldn’t log into ipa console or Kerberos and had to restart IPA service to restart Kerberos.<o:p></o:p></pre> <pre> <o:p></o:p></pre> <pre>IPA is logging nothing.<o:p></o:p></pre> <pre> <o:p></o:p></pre> <pre>This is not the first time I have had to go through this cycle – it seems that somehow, the IPA server is sensitive to the SSSD daemon and if the SSSD goes haywire, when I restart SSSD, IPA is not functioning and must be restarted too.<o:p></o:p></pre> <pre> <o:p></o:p></pre> <pre>Thanks<o:p></o:p></pre> <pre> <o:p></o:p></pre> <pre>Craig<o:p></o:p></pre> </blockquote> Is this on the same server? ----<o:p></o:p> Yes, same server… the one I call the master. The first one I set up. I’m getting tuned in to the checking the status of dirsrv and ipa but now I know to check the status of the sssd too.<o:p></o:p> <pre><o:p> </o:p></pre> <pre>Seems like it crashes a little too easily – I doubt I did much to harm it… I am fairly experienced with OpenLDAP and in fact used 389-server back when it was called FedoraDS. <o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>But it is running now, and seemingly will stay running for some time and I am upping the logging and watching for a crash like Richard said to provide some debug logs if possible. Sort of wish I could have just started with RHEL 7 and the updated IPA.<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Thanks<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Craig<o:p></o:p></pre> </div> </body> </html>