<div dir="ltr">Digging a bit deeper, I found this in /var/log/pki-ca/catalina.out:<div><br></div><div style>:</div><div style><font face="courier new, monospace">Could not connect to LDAP server host <a href="http://oldmaster.my.com">oldmaster.my.com</a> port 7389 Error netscape.ldap.LDAPException: failed to connect to server ldap://<a href="http://oldmaster.my.com:7389">oldmaster.my.com:7389</a> (91)</font></div>
<div style><font face="courier new, monospace">Feb 19, 2013 11:46:50 AM org.apache.catalina.startup.Catalina stopServer</font></div><div style><font face="courier new, monospace">SEVERE: Catalina.stop:</font></div><div style>
<font face="courier new, monospace">java.net.ConnectException: Connection refused</font></div><div style><font face="courier new, monospace"> at java.net.PlainSocketImpl.socketConnect(Native Method)</font></div><div style>
:</div><div style>:</div><div style><br></div><div style>This certainly appears to be a problem, but everyone's authenticating against oldmaster just fine. Thoughts, anyone?</div></div><div class="gmail_extra"><br clear="all">
<div><div dir="ltr"><div><br></div><div><u><br></u></div><div><b>Bret Wortman</b></div><div><a href="http://damascusgrp.com/" target="_blank"><img src="http://damascusgrp.com/uploads/3/2/2/6/3226794/6425940.png" width="200" height="52"></a><br>
</div><div><a href="http://bretwortman.com/" target="_blank">http://damascusgrp.com/</a><br></div><div><a href="http://twitter.com/BretWortman" target="_blank">http://twitter.com/BretWortman</a></div></div></div>
<br><br><div class="gmail_quote">On Tue, Feb 19, 2013 at 11:07 AM, Bret Wortman <span dir="ltr"><<a href="mailto:bret.wortman@damascusgrp.com" target="_blank">bret.wortman@damascusgrp.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Does anyone have an idea why I can't connect, or why this service isn't running on my freeipa instance? It used to be, because I've created a replica in the past....</div><div class="gmail_extra">
<div class="im">
<br clear="all"><div><div dir="ltr"><div><br></div><div><u><br></u></div><div><b>Bret Wortman</b></div><div><a href="http://damascusgrp.com/" target="_blank"><img src="http://damascusgrp.com/uploads/3/2/2/6/3226794/6425940.png" width="200" height="52"></a><br>
</div><div><a href="http://bretwortman.com/" target="_blank">http://damascusgrp.com/</a><br></div><div><a href="http://twitter.com/BretWortman" target="_blank">http://twitter.com/BretWortman</a></div></div></div>
<br><br></div><div><div class="h5"><div class="gmail_quote">On Tue, Feb 19, 2013 at 9:08 AM, John Dennis <span dir="ltr"><<a href="mailto:jdennis@redhat.com" target="_blank">jdennis@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>On 02/19/2013 06:58 AM, Bret Wortman wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>
I have a server running freeipa and I want to migrate it to a new host.<br>
I had thought that the easiest way might be to create a replica and load<br>
that onto the new host, but this is proving problematic:<br>
<br></div>
# ipa-replica-prepare <a href="http://ipamaster.my.com" target="_blank">ipamaster.my.com</a> <<a href="http://ipamaster.my.com" target="_blank">http://ipamaster.my.com</a>><div><br>
--ip-address 10.0.0.46<br>
Directory Manager (existing master) password:<br>
<br></div>
Preparing replica for <a href="http://ipamaster.my.com" target="_blank">ipamaster.my.com</a> <<a href="http://ipamaster.my.com" target="_blank">http://ipamaster.my.com</a>> from<br>
<a href="http://oldmaster.my.com" target="_blank">oldmaster.my.com</a> <<a href="http://oldmaster.my.com" target="_blank">http://oldmaster.my.com</a>><div><br>
Creating SSL certificate for the Directory Server<br>
preparation of replica failed: cannot connect to<br>
'<a href="https://oldmaster.my.com:9444/ca/ee/ca/profileSubmitSSLClient" target="_blank">https://oldmaster.my.com:<u></u>9444/ca/ee/ca/<u></u>profileSubmitSSLClient</a>': [Errno<br></div>
-5985] Cannot resolve <a href="http://oldmaster.my.com" target="_blank">oldmaster.my.com</a> <<a href="http://oldmaster.my.com" target="_blank">http://oldmaster.my.com</a>> using<div><br>
family PR_AF_INET6<br>
<br>
And then a stack trace follows.<br>
<br>
# netstat -rn | grep 9444<br>
# lsof -i:9444<br>
#<br>
_<br>
_<br>
I've also tried connecting to that URL via Firefox without success. It's<br>
just not listening there. What do I need to check? Someone else is<br>
running some apps (redmine and others) using Passenger on that server as<br>
well; could it be obscuring the port somehow?<br>
<br>
We're not running IPV6, so I'm not sure why it's being referenced....<br>
</div></blockquote>
<br>
I can't comment on why you can't connect but I can explain the error message. It's an internal mistake, if we can't connect we try another address family, that logic is incorrect and I thought we had fixed in this ticket <a href="https://fedorahosted.org/freeipa/ticket/2695" target="_blank">https://fedorahosted.org/<u></u>freeipa/ticket/2695</a>, but apparently we didn't. Anyway the error message is a red herring, your connection problems lie elsewhere.<span><font color="#888888"><br>
<br>
-- <br>
John Dennis <<a href="mailto:jdennis@redhat.com" target="_blank">jdennis@redhat.com</a>><br>
<br>
Looking to carve out IT costs?<br>
<a href="http://www.redhat.com/carveoutcosts/" target="_blank">www.redhat.com/carveoutcosts/</a><br>
</font></span></blockquote></div><br></div></div></div>
</blockquote></div><br></div>