<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1460001886615_25326"><span></span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1460001886615_25325"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1460001886615_25214" style="display: block;"> <div id="yui_3_16_0_ym19_1_1460001886615_25213"> <div id="yui_3_16_0_ym19_1_1460001886615_25212"> <div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25211" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"> <font size="2" face="Arial" id="yui_3_16_0_ym19_1_1460001886615_25210"> <hr size="1" id="yui_3_16_0_ym19_1_1460001886615_25375"> <b><span style="font-weight:bold;">From:</span></b> Petr Vobornik <pvoborni@redhat.com><br> <b id="yui_3_16_0_ym19_1_1460001886615_25373"><span style="font-weight: bold;" id="yui_3_16_0_ym19_1_1460001886615_25372">To:</span></b> John Williams <john.1209@yahoo.com>; "Freeipa-users@redhat.com" <Freeipa-users@redhat.com> <br> <b id="yui_3_16_0_ym19_1_1460001886615_25371"><span style="font-weight: bold;" id="yui_3_16_0_ym19_1_1460001886615_25370">Sent:</span></b> Thursday, April 7, 2016 7:11 AM<br> <b id="yui_3_16_0_ym19_1_1460001886615_25369"><span style="font-weight: bold;" id="yui_3_16_0_ym19_1_1460001886615_25368">Subject:</span></b> Re: [Freeipa-users] CentOS 7 replica installation failing<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1460001886615_25221"><br>On 04/07/2016 06:12 AM, John Williams wrote:<br clear="none">> I've setup an initial FreeIPA instance on a CentOS 7 host. The install went <br clear="none">> without a hitch. I can login to the GUI with no problems. However, I am not <br clear="none">> able to install the replica on another CentOS 7 host. I get the following errors:<br clear="none">> <br clear="none">> [<a shape="rect" ymailto="mailto:root@ipa2" href="mailto:root@ipa2" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;">root@ipa2</a> ~]# ipa-replica-install --setup-ca --setup-dns --no-forwarders <br clear="none">> /var/lib/ipa/replica-info-ipa2.nrln.us.gpg --skip-conncheck<br clear="none"><br clear="none">It was run with '--skip-conncheck'. Is there a reason? If you remove it,<br clear="none">what does it complain about?<br clear="none"><br clear="none">In general, using --skip-conncheck should be avoided because it may hide<br clear="none">errors.<br clear="none"><br clear="none">You could also check master server<br clear="none">/var/log/dirsrv/slapd-your-instance/access and errors logs if there is<br clear="none">some connection attempt from the replica visible.<br clear="none"><br clear="none">And maybe /var/log/ipareplica-install.log contains more info.<div class="yqt7419896539" id="yqtfd29580" dir="ltr" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><br clear="none">I ran the skip connections, because when I ran it initially without the skip connections, I got the following messages:</div><div class="yqt7419896539" id="yqtfd29580" dir="ltr" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><br></div><div class="yqt7419896539" id="yqtfd29580" dir="ltr"><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25476">The following UDP ports could not be verified as open: 88, 464</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25477">This can happen if they are already bound to an application</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25478">and ipa-replica-conncheck cannot attach own UDP responder.</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25479"><br id="yui_3_16_0_ym19_1_1460001886615_25480"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25481">Remote master check failed with following error message(s):</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25482">Warning: Permanently added 'ipa1.nrln.us,192.168.1.38' (ECDSA) to the list of known hosts.</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25483">Could not chdir to home directory /home/admin: No such file or directory</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25484">Port check failed! Inaccessible port(s): 389 (TCP), 636 (TCP), 88 (TCP), 464 (TCP), 80 (TCP), 443 (TCP)</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25485"><br id="yui_3_16_0_ym19_1_1460001886615_25486"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25487">ipa.ipapython.install.cli.install_tool(Replica): ERROR Connection check failed!</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25488">Please fix your network settings according to error messages above.</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25489">If the check results are not valid it can be skipped with --skip-conncheck parameter.</div><div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;" dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25490"><br id="yui_3_16_0_ym19_1_1460001886615_25491"></div><div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;" dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25490">There is nothing blocking the connections, and the initial IPA server seems to be working fine.</div><div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;" dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25490"><br></div><div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;" dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25490">Here are some snippets from the log:</div></div><div class="yqt7419896539" id="yqtfd29580" dir="ltr"><br clear="none"><br><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25613"> File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 525, in install_check</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25614"> options.setup_ca, config.ca_ds_port, options.admin_password)</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25615"> File "/usr/lib/python2.7/site-packages/ipaserver/install/replication.py", line 91, in replica_conn_check</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25616"> "\nIf the check results are not valid it can be skipped with --skip-conncheck parameter.")</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25617"><br id="yui_3_16_0_ym19_1_1460001886615_25618"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25619">2016-04-07T11:30:06Z DEBUG The ipa-replica-install command failed, exception: SystemExit: Connection check failed!</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25620">Please fix your network settings according to error messages above.</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25621">If the check results are not valid it can be skipped with --skip-conncheck parameter.</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25622">2016-04-07T11:30:06Z ERROR Connection check failed!</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25623">Please fix your network settings according to error messages above.</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25624">If the check results are not valid it can be skipped with --skip-conncheck parameter.</div><div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;" dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25625"><br id="yui_3_16_0_ym19_1_1460001886615_25626"></div><div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;" dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25625">Here are some more logs:</div><div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;" dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25625"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25625"><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25719">[root@ipa2 ~]# tail -30 /var/log/ipareplica-conncheck.log</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25720">Could not chdir to home directory /home/admin: No such file or directory</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25721">debug1: client_input_channel_req: channel 0 rtype exit-status reply 0</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25722">debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25723">debug1: channel 0: free: client-session, nchannels 1</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25724">debug1: fd 1 clearing O_NONBLOCK</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25725">debug1: fd 2 clearing O_NONBLOCK</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25726">Transferred: sent 3032, received 2584 bytes, in 0.0 seconds</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25727">Bytes per second: sent 131062.5, received 111697.1</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25728">debug1: Exit status 0</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25729"><br id="yui_3_16_0_ym19_1_1460001886615_25730"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25731">2016-04-07T11:30:02Z DEBUG Starting external process</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25732">2016-04-07T11:30:02Z DEBUG args='/bin/ssh' '-o StrictHostKeychecking=no' '-o UserKnownHostsFile=/tmp/tmpCbCb50' 'admin@ipa1.nrln.us' '/usr/sbin/ipa-replica-conncheck --replica ipa2.nrln.us'</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25733">2016-04-07T11:30:05Z DEBUG Process finished, return code=1</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25734">2016-04-07T11:30:05Z DEBUG stdout=Check connection from master to remote replica 'ipa2.nrln.us':</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25735"> Directory Service: Unsecure port (389): FAILED</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25736"> Directory Service: Secure port (636): FAILED</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25737"> Kerberos KDC: TCP (88): FAILED</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25738"> Kerberos KDC: UDP (88): WARNING</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25739"> Kerberos Kpasswd: TCP (464): FAILED</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25740"> Kerberos Kpasswd: UDP (464): WARNING</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25741"> HTTP Server: Unsecure port (80): FAILED</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25742"> HTTP Server: Secure port (443): FAILED</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25743">The following UDP ports could not be verified as open: 88, 464</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25744">This can happen if they are already bound to an application</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25745">and ipa-replica-conncheck cannot attach own UDP responder.</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25746"><br id="yui_3_16_0_ym19_1_1460001886615_25747"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25748">2016-04-07T11:30:05Z DEBUG stderr=Warning: Permanently added 'ipa1.nrln.us,192.168.1.38' (ECDSA) to the list of known hosts.</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25749">Could not chdir to home directory /home/admin: No such file or directory</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460001886615_25750">Port check failed! Inaccessible port(s): 389 (TCP), 636 (TCP), 88 (TCP), 464 (TCP), 80 (TCP), 443 (TCP)</div><div dir="ltr" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1460001886615_25751"><br id="yui_3_16_0_ym19_1_1460001886615_25752"></div><div dir="ltr" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1460001886615_25751">These two hosts are on the same subnet, nor firewall, or IPTables running. That's why the error message confusing.</div><div dir="ltr" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1460001886615_25751"><br></div><div dir="ltr" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1460001886615_25751">Any suggestions?</div></div><br clear="none">> WARNING: conflicting time&date synchronization service 'chronyd' will<br clear="none">> be disabled in favor of ntpd<br clear="none">> <br clear="none">> Directory Manager (existing master) password:<br clear="none">> <br clear="none">> Existing BIND configuration detected, overwrite? [no]: yes<br clear="none">> Using reverse zone(s) 1.168.192.in-addr.arpa.<br clear="none">> Configuring NTP daemon (ntpd)<br clear="none">> [1/4]: stopping ntpd<br clear="none">> [2/4]: writing configuration<br clear="none">> [3/4]: configuring ntpd to start on boot<br clear="none">> [4/4]: starting ntpd<br clear="none">> Done configuring NTP daemon (ntpd).<br clear="none">> Configuring directory server (dirsrv). Estimated time: 1 minute<br clear="none">> [1/38]: creating directory server user<br clear="none">> [2/38]: creating directory server instance<br clear="none">> [3/38]: adding default schema<br clear="none">> [4/38]: enabling memberof plugin<br clear="none">> [5/38]: enabling winsync plugin<br clear="none">> [6/38]: configuring replication version plugin<br clear="none">> [7/38]: enabling IPA enrollment plugin<br clear="none">> [8/38]: enabling ldapi<br clear="none">> [9/38]: configuring uniqueness plugin<br clear="none">> [10/38]: configuring uuid plugin<br clear="none">> [11/38]: configuring modrdn plugin<br clear="none">> [12/38]: configuring DNS plugin<br clear="none">> [13/38]: enabling entryUSN plugin<br clear="none">> [14/38]: configuring lockout plugin<br clear="none">> [15/38]: creating indices<br clear="none">> [16/38]: enabling referential integrity plugin<br clear="none">> [17/38]: configuring ssl for ds instance<br clear="none">> [18/38]: configuring certmap.conf<br clear="none">> [19/38]: configure autobind for root<br clear="none">> [20/38]: configure new location for managed entries<br clear="none">> [21/38]: configure dirsrv ccache<br clear="none">> [22/38]: enable SASL mapping fallback<br clear="none">> [23/38]: restarting directory server<br clear="none">> [24/38]: setting up initial replication<br clear="none">> Starting replication, please wait until this has completed.<br clear="none">> <br clear="none">> [ipa1.nrln.us] reports: Update failed! Status: [-1 - LDAP error: Can't contact <br clear="none">> LDAP server]<br clear="none">> <br clear="none">> [error] RuntimeError: Failed to start replication<br clear="none">> Your system may be partly configured.<br clear="none">> Run /usr/sbin/ipa-server-install --uninstall to clean up.<br clear="none">> <br clear="none">> ipa.ipapython.install.cli.install_tool(Replica): ERROR Failed to start <br clear="none">> replication<br clear="none">> <br clear="none">> <br clear="none">> The error message is misleading. The two hosts sit on the same subnet. All <br clear="none">> firewalls are off. Selinux is disabled. Here is an nmap port scan from the <br clear="none">> replica to the master:<br clear="none">> <br clear="none">> <br clear="none">> [<a shape="rect" ymailto="mailto:root@ipa2" href="mailto:root@ipa2" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;">root@ipa2</a> ~]# nmap ipa1<br clear="none">> <br clear="none">> Starting Nmap 6.40 ( <a shape="rect" href="http://nmap.org/" target="_blank" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;">http://nmap.org </a>) at 2016-04-07 00:12 EDT<br clear="none">> Nmap scan report for ipa1 (192.168.1.38)<br clear="none">> Host is up (0.000086s latency).<br clear="none">> rDNS record for 192.168.1.38: ipa1.nrln.us<br clear="none">> Not shown: 990 closed ports<br clear="none">> PORT STATE SERVICE<br clear="none">> 22/tcp open ssh<br clear="none">> 80/tcp open http<br clear="none">> 88/tcp open kerberos-sec<br clear="none">> 389/tcp open ldap<br clear="none">> 443/tcp open https<br clear="none">> 464/tcp open kpasswd5<br clear="none">> 636/tcp open ldapssl<br clear="none">> 749/tcp open kerberos-adm<br clear="none">> 8080/tcp open http-proxy<br clear="none">> 8443/tcp open https-alt<br clear="none">> MAC Address: 52:54:00:33:34:F0 (QEMU Virtual NIC)<br clear="none">> <br clear="none">> Nmap done: 1 IP address (1 host up) scanned in 0.14 seconds<br clear="none">> [<a shape="rect" ymailto="mailto:root@ipa2" href="mailto:root@ipa2" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;">root@ipa2</a> ~]#<br clear="none">> <br clear="none">> <br clear="none">> Why do I get this message?<br clear="none">> <br clear="none">> TIA!!</div><br clear="none">> <br clear="none">> <br clear="none">> <br clear="none"><br clear="none"><br clear="none">-- <br clear="none">Petr Vobornik<div class="yqt7419896539" id="yqtfd36794" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>