<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-CA" link="blue" vlink="purple"> <div class="WordSection1"> Hello,<o:p></o:p> <o:p> </o:p> Need some help installing replica – FREEIPA on Centos 7. My networking is run, DNS is up on the master IPA all ports are opened. But I can’t isolate the problem. Any help?<o:p></o:p> <o:p> </o:p> ------ Error:<o:p></o:p> The ipa-replica-install command failed, exception: SystemExit: Connection check failed!<o:p></o:p> Please fix your network settings according to error messages above.<o:p></o:p> If the check results are not valid it can be skipped with --skip-conncheck parameter.<o:p></o:p> <o:p> </o:p> ------ Command<o:p></o:p> <o:p> </o:p> # ipa-replica-install --setup-dns --setup-ca --no-forwarder --ip-address=172.20.10.100 /var/lib/ipa/replica-info-sys-sec-repl.ipa.domain.com.gpg<o:p></o:p> Directory Manager (existing master) password:<o:p></o:p> <o:p> </o:p> Run connection check to master<o:p></o:p> admin@IPA.DOMAIN.COM password:<o:p></o:p> ipa.ipapython.install.cli.install_tool(Replica): ERROR Connection check failed!<o:p></o:p> Please fix your network settings according to error messages above.<o:p></o:p> If the check results are not valid it can be skipped with --skip-conncheck parameter.<o:p></o:p> ipa.ipapython.install.cli.install_tool(Replica): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information<o:p></o:p> <o:p> </o:p> <o:p> </o:p> ----- LOG at /var/log/ipareplica-install.log<o:p></o:p> <o:p> </o:p> 2016-12-20T19:14:50Z DEBUG stdout=Check connection from replica to remote master ' sys-pri-repl.ipa.domain.com':<o:p></o:p> Directory Service: Unsecure port (389): OK<o:p></o:p> Directory Service: Secure port (636): OK<o:p></o:p> Kerberos KDC: TCP (88): OK<o:p></o:p> Kerberos Kpasswd: TCP (464): OK<o:p></o:p> HTTP Server: Unsecure port (80): OK<o:p></o:p> HTTP Server: Secure port (443): OK<o:p></o:p> <o:p> </o:p> The following list of ports use UDP protocol and would need to be<o:p></o:p> checked manually:<o:p></o:p> Kerberos KDC: UDP (88): SKIPPED<o:p></o:p> Kerberos Kpasswd: UDP (464): SKIPPED<o:p></o:p> <o:p> </o:p> Connection from replica to master is OK.<o:p></o:p> Start listening on required ports for remote master check<o:p></o:p> Get credentials to log in to remote master<o:p></o:p> <o:p> </o:p> Check RPC connection to remote master<o:p></o:p> Retrying using SSH...<o:p></o:p> Check SSH connection to remote master<o:p></o:p> Could not SSH into remote host. Error output:<o:p></o:p> OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013<o:p></o:p> debug1: Reading configuration data /etc/ssh/ssh_config<o:p></o:p> debug1: /etc/ssh/ssh_config line 56: Applying options for *<o:p></o:p> debug1: Connecting to sys-pri-repl.ipa.domain.com [172.20.10.99] port 22.<o:p></o:p> debug1: Connection established.<o:p></o:p> debug1: permanently_set_uid: 0/0<o:p></o:p> debug1: identity file /root/.ssh/id_rsa type -1<o:p></o:p> debug1: identity file /root/.ssh/id_rsa-cert type -1<o:p></o:p> debug1: identity file /root/.ssh/id_dsa type -1<o:p></o:p> debug1: identity file /root/.ssh/id_dsa-cert type -1<o:p></o:p> debug1: identity file /root/.ssh/id_ecdsa type -1<o:p></o:p> debug1: identity file /root/.ssh/id_ecdsa-cert type -1<o:p></o:p> debug1: identity file /root/.ssh/id_ed25519 type -1<o:p></o:p> debug1: identity file /root/.ssh/id_ed25519-cert type -1<o:p></o:p> debug1: Enabling compatibility mode for protocol 2.0<o:p></o:p> debug1: Local version string SSH-2.0-OpenSSH_6.6.1<o:p></o:p> debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1<o:p></o:p> debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000<o:p></o:p> debug1: SSH2_MSG_KEXINIT sent<o:p></o:p> debug1: SSH2_MSG_KEXINIT received<o:p></o:p> debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none<o:p></o:p> debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none<o:p></o:p> debug1: kex: curve25519-sha256@libssh.org need=16 dh_need=16<o:p></o:p> debug1: kex: curve25519-sha256@libssh.org need=16 dh_need=16<o:p></o:p> debug1: sending SSH2_MSG_KEX_ECDH_INIT<o:p></o:p> debug1: expecting SSH2_MSG_KEX_ECDH_REPLY<o:p></o:p> debug1: Server host key: ECDSA 6r:0e:15:55:dk:17:86:27:53:02:02:89:c7:98:20:11<o:p></o:p> Warning: Permanently added 'sys-pri-repl.ipa.domain.com,172.20.10.99' (ECDSA) to the list of known hosts.<o:p></o:p> debug1: ssh_ecdsa_verify: signature correct<o:p></o:p> debug1: SSH2_MSG_NEWKEYS sent<o:p></o:p> debug1: expecting SSH2_MSG_NEWKEYS<o:p></o:p> debug1: SSH2_MSG_NEWKEYS received<o:p></o:p> debug1: SSH2_MSG_SERVICE_REQUEST sent<o:p></o:p> debug1: SSH2_MSG_SERVICE_ACCEPT received<o:p></o:p> debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password<o:p></o:p> debug1: Next authentication method: gssapi-keyex<o:p></o:p> debug1: No valid Key exchange context<o:p></o:p> debug1: Next authentication method: gssapi-with-mic<o:p></o:p> Connection closed by 172.20.10.99<o:p></o:p> <o:p> </o:p> 2016-12-20T19:14:50Z DEBUG stderr=Could not SSH to remote host.<o:p></o:p> <o:p> </o:p> 2016-12-20T19:14:50Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute<o:p></o:p> return_value = self.run()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 318, in run<o:p></o:p> cfgr.run()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 308, in run<o:p></o:p> self.validate()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 317, in validate<o:p></o:p> for nothing in self._validator():<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 372, in __runner<o:p></o:p> self._handle_exception(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 394, in _handle_exception<o:p></o:p> six.reraise(*exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 362, in __runner<o:p></o:p> step()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 359, in <lambda><o:p></o:p> step = lambda: next(self.__gen)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from<o:p></o:p> six.reraise(*exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from<o:p></o:p> value = gen.send(prev_value)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 564, in _configure<o:p></o:p> next(validator)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 372, in __runner<o:p></o:p> self._handle_exception(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 449, in _handle_exception<o:p></o:p> self.__parent._handle_exception(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 394, in _handle_exception<o:p></o:p> six.reraise(*exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 446, in _handle_exception<o:p></o:p> super(ComponentBase, self)._handle_exception(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 394, in _handle_exception<o:p></o:p> six.reraise(*exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 362, in __runner<o:p></o:p> step()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 359, in <lambda><o:p></o:p> step = lambda: next(self.__gen)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from<o:p></o:p> six.reraise(*exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from<o:p></o:p> value = gen.send(prev_value)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install<o:p></o:p> for nothing in self._installer(self.parent):<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1716, in main<o:p></o:p> install_check(self)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 364, in decorated<o:p></o:p> func(installer)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 761, in install_check<o:p></o:p> ca_cert_file=cafile)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/replication.py", line 106, in replica_conn_check<o:p></o:p> "\nIf the check results are not valid it can be skipped with --skip-conncheck parameter.")<o:p></o:p> <o:p> </o:p> 2016-12-20T19:14:50Z DEBUG The ipa-replica-install command failed, exception: SystemExit: Connection check failed!<o:p></o:p> Please fix your network settings according to error messages above.<o:p></o:p> If the check results are not valid it can be skipped with --skip-conncheck parameter.<o:p></o:p> 2016-12-20T19:14:50Z ERROR Connection check failed!<o:p></o:p> Please fix your network settings according to error messages above.<o:p></o:p> If the check results are not valid it can be skipped with --skip-conncheck parameter.<o:p></o:p> 2016-12-20T19:14:50Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> </div> </body> </html>