<div dir="ltr">HI,<div><br></div><div>on master server and replica server, i have enabled ipv6</div><div><br></div><div>below on master server</div><div><br></div><div><div>[root@zkwipamstr01 ~]# ip addr | grep inet6 </div><div><br></div><div> inet6 fe80::250:56ff:fea0:3857/64 scope link</div><div><br></div><div>[root@zkwipamstr01 ~]# systemctl restart pki-tomcatd@pki-tomcat</div><div>[root@zkwipamstr01 ~]# netstat -tunap | grep 8009</div><div>tcp6 0 0 ::1:8009 :::* LISTEN 12692/java</div></div><div><br></div><div><br></div><div>after that 8009 is listening on master server.</div><div><br></div><div>on replica side uninstalled ipa and tried to enrolled again. Do i need to enable any service replica side?</div><div><br></div><div><div>[28/44]: restarting directory server</div><div>ipa : CRITICAL Failed to restart the directory server (Command '/bin/systemctl restart dirsrv@KW-EXAMPLE-COM.service' returned non-zero exit status 1). See the installation log for details.</div><div> [29/44]: setting up initial replication</div><div> [error] error: [Errno 111] Connection refused</div><div>Your system may be partly configured.</div><div>Run /usr/sbin/ipa-server-install --uninstall to clean up.</div><div><br></div><div>ipa.ipapython.install.cli.install_tool(Replica): ERROR [Errno 111] Connection refused</div><div>ipa.ipapython.install.cli.install_tool(Replica): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information</div><div>[root@zkwiparepa01 ~]# systemctl restart pki-tomcatd@pki-tomcat</div><div>Job for pki-tomcatd@pki-tomcat.service failed because the control process exited with error code. See "systemctl status pki-tomcatd@pki-tomcat.service" and "journalctl -xe" for details.</div></div><div><br></div><div>Still same error.</div><div><br></div><div>is this service restart pki-tomcatd@pki-tomcat only applicable on master server?</div><div><br></div><div>Regards,</div><div>Ben</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 5, 2017 at 11:12 AM, Petr Vobornik <span dir="ltr"><<a href="mailto:pvoborni@redhat.com" target="_blank">pvoborni@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 01/05/2017 07:10 AM, Ben .T.George wrote:<br> > HI<br> ><br> </span><span class="">> yes i did the same and still port is not listening.<br> ><br> > [root@zkwipamstr01 ~]# cat /etc/hosts<br> > 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4<br> > ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6<br> </span>> 10.151.4.64 <a href="http://zkwipamstr01.kw.example.com" rel="noreferrer" target="_blank">zkwipamstr01.kw.example.com</a> <<a href="http://zkwipamstr01.kw.example.com" rel="noreferrer" target="_blank">http://zkwipamstr01.kw.<wbr>example.com</a>><br> > zkwipamstr01<br> > 10.151.4.65 <a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">zkwiparepa01.kw.example.com</a> <<a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">http://zkwiparepa01.kw.<wbr>example.com</a>><br> <span class="">> zkwiparepa01<br> > [root@zkwipamstr01 ~]# systemctl restart pki-tomcatd@pki-tomcat<br> > [root@zkwipamstr01 ~]# netstat -tunap | grep 8009<br> ><br> ><br> > Regards<br> > Ben<br> <br> </span>Also IPv6 stack needs to be enabled.<br> <span class=""><br> ><br> > On Thu, Jan 5, 2017 at 9:03 AM, Fraser Tweedale <<a href="mailto:ftweedal@redhat.com">ftweedal@redhat.com</a><br> </span><div><div class="h5">> <mailto:<a href="mailto:ftweedal@redhat.com">ftweedal@redhat.com</a>>> wrote:<br> ><br> > On Wed, Jan 04, 2017 at 03:12:12PM +0300, Ben .T.George wrote:<br> > > HI<br> > ><br> > > port 8009 is not listening in master server<br> > ><br> > > and i added ::1 localhost localhost.localdomain localhost6<br> > > localhost6.localdomain6 in hosts file.<br> > ><br> ><br> > Did you add this to the host file on the master (then `systemctl<br> > restart pki-tomcatd@pki-tomcat` and confirm it is listening on port<br> > 8009)? Or just the client you are trying to promote?<br> ><br> > It is needed on the master. Won't hurt to make this change to<br> > /etc/hosts on both machines, though.<br> ><br> > HTH,<br> > Fraser<br> ><br> > > still getting same error<br> > ><br> > > [28/44]: restarting directory server<br> > > ipa : CRITICAL Failed to restart the directory server (Command<br> > > '/bin/systemctl restart dirsrv@KW-EXAMPLE-COM.service' returned non-zero<br> > > exit status 1). See the installation log for details.<br> > > [29/44]: setting up initial replication<br> > > [error] error: [Errno 111] Connection refused<br> > > Your system may be partly configured.<br> > > Run /usr/sbin/ipa-server-install --uninstall to clean up.<br> > ><br> > > ipa.ipapython.install.cli.<wbr>install_tool(Replica): ERROR [Errno 111]<br> > > Connection refused<br> > > ipa.ipapython.install.cli.<wbr>install_tool(Replica): ERROR The<br> > > ipa-replica-install command failed. See /var/log/ipareplica-install.<wbr>log for<br> > > more information<br> > ><br> > ><br> > > Also ipv6 is disabled on both nodes<br> > ><br> > > Regards,<br> > > Ben<br> > ><br> > > On Wed, Jan 4, 2017 at 2:05 PM, Petr Vobornik <<a href="mailto:pvoborni@redhat.com">pvoborni@redhat.com</a><br> </div></div><span class="">> <mailto:<a href="mailto:pvoborni@redhat.com">pvoborni@redhat.com</a>>> wrote:<br> > ><br> > > > On 01/04/2017 10:59 AM, Ben .T.George wrote:<br> > > > > HI<br> > > > ><br> > > > > i tried the method mentioned on that document and it end up with below<br> > > > error. My<br> > > > > DNS is managed by external box and i dont want to create any DNS record<br> > > > on these<br> > > > > servers.<br> > > > ><br> > > > > and the command which i tried is(non client server)<br> > > > ><br> > > > > ipa-replica-install --principal admin --admin-password P@ssw0rd --domain<br> </span>> > > > <a href="http://kw.example.com" rel="noreferrer" target="_blank">kw.example.com</a> <<a href="http://kw.example.com" rel="noreferrer" target="_blank">http://kw.example.com</a>> <<a href="http://kw.example.com" rel="noreferrer" target="_blank">http://kw.example.com</a>> --server<br> > > > <a href="http://zkwipamstr01.kw.example.com" rel="noreferrer" target="_blank">zkwipamstr01.kw.example.com</a> <<a href="http://zkwipamstr01.kw.example.com" rel="noreferrer" target="_blank">http://zkwipamstr01.kw.<wbr>example.com</a>><br> > > > > <<a href="http://zkwipamstr01.kw.example.com" rel="noreferrer" target="_blank">http://zkwipamstr01.kw.<wbr>example.com</a> <<a href="http://zkwipamstr01.kw.example.com" rel="noreferrer" target="_blank">http://zkwipamstr01.kw.<wbr>example.com</a>>><br> <div><div class="h5">> > > ><br> > > > ><br> > > > ><br> > > > > ipa : CRITICAL Failed to restart the directory server (Command<br> > > > > '/bin/systemctl restart dirsrv@KW-EXAMPLE-COM.service' returned<br> > > > non-zero exit<br> > > > > status 1). See the installation log for details.<br> > > > > [29/44]: setting up initial replication<br> > > > > [error] error: [Errno 111] Connection refused<br> > > > > Your system may be partly configured.<br> > > > > Run /usr/sbin/ipa-server-install --uninstall to clean up.<br> > > > ><br> > > > > ipa.ipapython.install.cli.<wbr>install_tool(Replica): ERROR [Errno 111]<br> > > > Connection<br> > > > > refused<br> > > > > ipa.ipapython.install.cli.<wbr>install_tool(Replica): ERROR The<br> > > > > ipa-replica-install command failed. See /var/log/ipareplica-install.<wbr>log<br> > > > for more<br> > > > > information<br> > > ><br> > > > This looks like bug <a href="https://fedorahosted.org/freeipa/ticket/6575" rel="noreferrer" target="_blank">https://fedorahosted.org/<wbr>freeipa/ticket/6575</a><br> > <<a href="https://fedorahosted.org/freeipa/ticket/6575" rel="noreferrer" target="_blank">https://fedorahosted.org/<wbr>freeipa/ticket/6575</a>><br> > > ><br> > > > To verify that, could you check if master server internally listens on<br> > > > port 8009 or if ipareplica-install.log contains CA_UNREACHABLE string<br> > > > near step 27.<br> > > ><br> > > > Usual fix is to add following line to /etc/hosts<br> > > > ::1 localhost localhost.localdomain localhost6<br> > > > localhost6.localdomain6<br> > > ><br> > > ><br> > > > > [root@zkwiparepa01 ~]# /bin/systemctl restart<br> > > > dirsrv@KW-EXAMPLE-COM.service<br> > > > > Job for dirsrv@KW-EXAMPLE-COM.service failed because the control<br> > > > process exited<br> > > > > with error code. See "systemctl status dirsrv@KW-EXAMPLE-COM.service"<br> > > > and<br> > > > > "journalctl -xe" for details.<br> > > > ><br> > > > > [root@zkwiparepa01 ~]# systemctl status dirsrv@KW-EXAMPLE-COM.service<br> > > > > ● dirsrv@KW-EXAMPLE-COM.service - 389 Directory Server KW-EXAMPLE-COM.<br> > > > > Loaded: loaded (/usr/lib/systemd/system/<wbr>dirsrv@.service; enabled;<br> > > > vendor<br> > > > > preset: disabled)<br> > > > > Active: failed (Result: exit-code) since Wed 2017-01-04 12:54:46<br> > > > AST; 13s ago<br> > > > > Process: 14893 ExecStart=/usr/sbin/ns-slapd -D /etc/dirsrv/slapd-%i -i<br> > > > > /var/run/dirsrv/slapd-%i.pid (code=exited, status=1/FAILURE)<br> > > > > Process: 14887 ExecStartPre=/usr/sbin/ds_<wbr>systemd_ask_password_acl<br> > > > > /etc/dirsrv/slapd-%i/dse.ldif (code=exited, status=0/SUCCESS)<br> > > > > Main PID: 14893 (code=exited, status=1/FAILURE)<br> > > > ><br> > > > > Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">zkwiparepa01.kw.example.com</a><br> </div></div>> <<a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">http://zkwiparepa01.kw.<wbr>example.com</a>> <<a href="http://zkwiparepa01.kw" rel="noreferrer" target="_blank">http://zkwiparepa01.kw</a>.<br> > > > <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> <<a href="http://example.com" rel="noreferrer" target="_blank">http://example.com</a>>><br> <span class="">> > > > ns-slapd[14893]: [04/Jan/2017:12:54:46.<wbr>177617891 +0300] Error:<br> > > > > betxnpostoperation plu...arted<br> > > > > Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">zkwiparepa01.kw.example.com</a><br> </span>> <<a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">http://zkwiparepa01.kw.<wbr>example.com</a>> <<a href="http://zkwiparepa01.kw" rel="noreferrer" target="_blank">http://zkwiparepa01.kw</a>.<br> > > > <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> <<a href="http://example.com" rel="noreferrer" target="_blank">http://example.com</a>>><br> <span class="">> > > > ns-slapd[14893]: [04/Jan/2017:12:54:46.<wbr>178379752 +0300] Error: object<br> > > > plugin<br> > > > > Roles Pl...arted<br> > > > > Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">zkwiparepa01.kw.example.com</a><br> </span>> <<a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">http://zkwiparepa01.kw.<wbr>example.com</a>> <<a href="http://zkwiparepa01.kw" rel="noreferrer" target="_blank">http://zkwiparepa01.kw</a>.<br> > > > <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> <<a href="http://example.com" rel="noreferrer" target="_blank">http://example.com</a>>><br> <span class="">> > > > ns-slapd[14893]: [04/Jan/2017:12:54:46.<wbr>179162340 +0300] Error:<br> > > > preoperation<br> > > > > plugin su...arted<br> > > > > Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">zkwiparepa01.kw.example.com</a><br> </span>> <<a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">http://zkwiparepa01.kw.<wbr>example.com</a>> <<a href="http://zkwiparepa01.kw" rel="noreferrer" target="_blank">http://zkwiparepa01.kw</a>.<br> > > > <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> <<a href="http://example.com" rel="noreferrer" target="_blank">http://example.com</a>>><br> <span class="">> > > > ns-slapd[14893]: [04/Jan/2017:12:54:46.<wbr>179993432 +0300] Error: object<br> > > > plugin USN<br> > > > > is n...arted<br> > > > > Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">zkwiparepa01.kw.example.com</a><br> </span>> <<a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">http://zkwiparepa01.kw.<wbr>example.com</a>> <<a href="http://zkwiparepa01.kw" rel="noreferrer" target="_blank">http://zkwiparepa01.kw</a>.<br> > > > <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> <<a href="http://example.com" rel="noreferrer" target="_blank">http://example.com</a>>><br> <span class="">> > > > ns-slapd[14893]: [04/Jan/2017:12:54:46.<wbr>181305209 +0300] Error: object<br> > > > plugin<br> > > > > Views is...arted<br> > > > > Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">zkwiparepa01.kw.example.com</a><br> </span>> <<a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">http://zkwiparepa01.kw.<wbr>example.com</a>> <<a href="http://zkwiparepa01.kw" rel="noreferrer" target="_blank">http://zkwiparepa01.kw</a>.<br> > > > <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> <<a href="http://example.com" rel="noreferrer" target="_blank">http://example.com</a>>><br> <span class="">> > > > ns-slapd[14893]: [04/Jan/2017:12:54:46.<wbr>182094981 +0300] Error:<br> > > > extendedop plugin<br> > > > > whoa...arted<br> > > > > Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">zkwiparepa01.kw.example.com</a><br> </span>> <<a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">http://zkwiparepa01.kw.<wbr>example.com</a>> <<a href="http://zkwiparepa01.kw" rel="noreferrer" target="_blank">http://zkwiparepa01.kw</a>.<br> > > > <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> <<a href="http://example.com" rel="noreferrer" target="_blank">http://example.com</a>>><br> <span class="">> > > > systemd[1]: dirsrv@KW-EXAMPLE-COM.service: main process exited,<br> > > > code=exited,<br> > > > > status=1/FAILURE<br> > > > > Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">zkwiparepa01.kw.example.com</a><br> </span>> <<a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">http://zkwiparepa01.kw.<wbr>example.com</a>> <<a href="http://zkwiparepa01.kw" rel="noreferrer" target="_blank">http://zkwiparepa01.kw</a>.<br> > > > <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> <<a href="http://example.com" rel="noreferrer" target="_blank">http://example.com</a>>><br> <span class="">> > > > systemd[1]: Failed to start 389 Directory Server KW-EXAMPLE-COM..<br> > > > > Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">zkwiparepa01.kw.example.com</a><br> </span>> <<a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">http://zkwiparepa01.kw.<wbr>example.com</a>> <<a href="http://zkwiparepa01.kw" rel="noreferrer" target="_blank">http://zkwiparepa01.kw</a>.<br> > > > <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> <<a href="http://example.com" rel="noreferrer" target="_blank">http://example.com</a>>><br> <span class="">> > > > systemd[1]: Unit dirsrv@KW-EXAMPLE-COM.service entered failed state.<br> > > > > Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">zkwiparepa01.kw.example.com</a><br> </span>> <<a href="http://zkwiparepa01.kw.example.com" rel="noreferrer" target="_blank">http://zkwiparepa01.kw.<wbr>example.com</a>> <<a href="http://zkwiparepa01.kw" rel="noreferrer" target="_blank">http://zkwiparepa01.kw</a>.<br> > > > <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> <<a href="http://example.com" rel="noreferrer" target="_blank">http://example.com</a>>><br> <span class="im HOEnZb">> > > > systemd[1]: dirsrv@KW-EXAMPLE-COM.service failed.<br> > > > > Hint: Some lines were ellipsized, use -l to show in full.<br> > > > ><br> > > > ><br> > > > ><br> > > > > Regards,<br> > > > > Ben<br> > > > ><br> > > > ><br> > > > > On Wed, Jan 4, 2017 at 11:19 AM, Martin Babinsky <<a href="mailto:mbabinsk@redhat.com">mbabinsk@redhat.com</a><br> > <mailto:<a href="mailto:mbabinsk@redhat.com">mbabinsk@redhat.com</a>><br> </span><div class="HOEnZb"><div class="h5">> > > > <mailto:<a href="mailto:mbabinsk@redhat.com">mbabinsk@redhat.com</a> <mailto:<a href="mailto:mbabinsk@redhat.com">mbabinsk@redhat.com</a>>>> wrote:<br> > > > ><br> > > > > On 01/04/2017 07:21 AM, Ben .T.George wrote:<br> > > > ><br> > > > > HI<br> > > > ><br> > > > > while trying to create ipa replica, i am getting below error,<br> > > > ><br> > > > > Replica creation using 'ipa-replica-prepare' to generate replica<br> > > > file<br> > > > > is supported only in 0-level IPA domain.<br> > > > ><br> > > > > The current IPA domain level is 1 and thus the replica must<br> > > > > be created by promoting an existing IPA client.<br> > > > ><br> > > > > To set up a replica use the following procedure:<br> > > > > 1.) set up a client on the host using 'ipa-client-install'<br> > > > > 2.) promote the client to replica running<br> > > > 'ipa-replica-install'<br> > > > > *without* replica file specified<br> > > > ><br> > > > > 'ipa-replica-prepare' is allowed only in domain level 0<br> > > > > The ipa-replica-prepare command failed.<br> > > > ><br> > > > ><br> > > > > i have IPA master server without AD integration and DNS is<br> > > > managed by<br> > > > > 3rd party appliances.<br> > > > ><br> > > > ><br> > > > ><br> > > > > Regards,<br> > > > > Ben<br> > > > ><br> > > > ><br> > > > ><br> > > > > Hi Ben,<br> > > > ><br> > > > > If you installed IPA 4.4 server then domain level 1 is the default.<br> > > > This<br> > > > > domain level uses different mechanism to stand up replicas. See the<br> > > > latest<br> > > > > IdM documentation[1] for more details.<br> > > > ><br> > > > > [1]<br> > > > > <a href="https://access.redhat.com/documentation/en-US/Red_Hat_" rel="noreferrer" target="_blank">https://access.redhat.com/<wbr>documentation/en-US/Red_Hat_</a><br> > <<a href="https://access.redhat.com/documentation/en-US/Red_Hat_" rel="noreferrer" target="_blank">https://access.redhat.com/<wbr>documentation/en-US/Red_Hat_</a>><br> > > > Enterprise_Linux/7/html/Linux_<wbr>Domain_Identity_<wbr>Authentication_and_Policy_<br> > > > Guide/creating-the-replica.<wbr>html<br> > > > > <<a href="https://access.redhat.com/documentation/en-US/Red_Hat_" rel="noreferrer" target="_blank">https://access.redhat.com/<wbr>documentation/en-US/Red_Hat_</a><br> > <<a href="https://access.redhat.com/documentation/en-US/Red_Hat_" rel="noreferrer" target="_blank">https://access.redhat.com/<wbr>documentation/en-US/Red_Hat_</a>><br> > > > Enterprise_Linux/7/html/Linux_<wbr>Domain_Identity_<wbr>Authentication_and_Policy_<br> > > > Guide/creating-the-replica.<wbr>html><br> > > > ><br> > > > > --<br> > > > > Martin^3 Babinsky<br> > > > ><br> > > > > --<br> > > > > Manage your subscription for the Freeipa-users mailing list:<br> > > > > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a><br> > <<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a><wbr>><br> > > > > <<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a><br> > <<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a><wbr>>><br> > > > > Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> > > > ><br> > > > ><br> > > > ><br> > > > ><br> > > ><br> > > ><br> > > > --<br> > > > Petr Vobornik<br> > > ><br> ><br> > > --<br> > > Manage your subscription for the Freeipa-users mailing list:<br> > > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a><br> > <<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a><wbr>><br> > > Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> ><br> ><br> <br> <br> --<br> Petr Vobornik<br> </div></div></blockquote></div><br></div>