<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt"><div id="yiv4702327435"><div><div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"><div id="yiv4702327435"><div id="yiv4702327435yui_3_13_0_ym1_1_1392057776779_3213"><div class="yiv4702327435yui_3_13_0_ym1_1_1392057776779_3110" id="yiv4702327435yui_3_13_0_ym1_1_1392057776779_3212" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"><div id="yiv4702327435yui_3_13_0_ym1_10_1391806566984_8"><div style="margin-top: 0.1em; margin-bottom: 0.1em;"><br></div><div style="margin-top: 0.1em; margin-bottom: 0.1em; color: rgb(0, 0, 0); font-size: 16px;
font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;">Lucas (sorry my previous email may have got sent improperly edited.</div><div style="margin-top: 0.1em; margin-bottom: 0.1em; color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><br></div><div><br></div><div>My typical command looks like this (domain name changed due to disclosure reasons)</div><div><br></div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;"></div><div># ipa-client-install --domain=<span style="font-size: 12pt;">mydomain.com</span><span style="font-size: 12pt;"> --server=ldap2.</span><span style="font-size: 12pt;">mydomain.com</span><span style="font-size: 12pt;"> --hostname=test500.</span><span style="font-size:
12pt;">mydomain.com</span><span style="font-size: 12pt;"> -d</span></div><div><span style="font-size: 12pt;"><br></span></div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;">master = ldap.mydomain.com</div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;"></div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;">replica = ldap2.mydomain.com</div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;"><br></div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;"><span>I ran lsof while running a ipa-client-install and found the following "kinit" instances trying to access my "master"</span></div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;"><span>=====================</span></div><div style="margin-top: 0.1em; margin-bottom: 0.1em;
background-color: transparent;"><br></div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;">ipa-clien 10443 root mem REG 253,0 334040 1704353 /lib64/libldap_r-2.4.so.2.5.6</div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;">ipa-clien 10443 root mem REG 253,0 61896 1444372 /usr/lib64/python2.6/site-packages/_ldap.so</div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;">kinit 10545 root 3u IPv4 143621 0t0 UDP
test500.mydomain.com:57166->ldap.mydomain.com:kerberos</div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;"></div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;">kinit 10545 root 4u IPv4 143636 0t0 TCP test500.mydomain.com:35574->ldap.mydomain.com:kerberos (SYN_SENT)</div><div style="margin-top: 0.1em; margin-bottom: 0.1em; background-color: transparent;"><span>=====================</span></div><div></div><div><br></div><div>the client install also finds issue with syncing time during client install, but only gives warning. The time difference between master and client is within seconds.</div><div><span style="font-size: 12pt;"><br></span></div><div> </div></div><div id="yiv4702327435yui_3_13_0_ym1_10_1391806566984_12">the
client install also finds issue with </div><div id="yiv4702327435yui_3_13_0_ym1_10_1391806566984_12"> </div><div id="yiv4702327435yui_3_13_0_ym1_10_1391806566984_14">Shreeraj<br clear="none">----------------------------------------------------------------------------------------</div><div id="yiv4702327435yui_3_13_0_ym1_1_1391806566984_60578"><br clear="none" id="yiv4702327435yui_3_13_0_ym1_10_1391806566984_16"><br clear="none" id="yiv4702327435yui_3_13_0_ym1_10_1391806566984_18"></div><div id="yiv4702327435yui_3_13_0_ym1_10_1391806566984_20">Change is the only Constant !</div><div class="yiv4702327435yqt4435142453" id="yiv4702327435yqt09102"><div class="yiv4702327435yqt7462368708" id="yiv4702327435yqt53068"><div class="yiv4702327435yahoo_quoted" style="display: block;"> <br clear="none"> <br clear="none"> <div class="yiv4702327435yui_3_13_0_ym1_1_1391806566984_60547 yiv4702327435yui_3_13_0_ym1_1_1392057776779_3126" style="font-family:
HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"> <div class="yiv4702327435yui_3_13_0_ym1_1_1391806566984_60548 yiv4702327435yui_3_13_0_ym1_1_1392057776779_3127" style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"> <div dir="ltr"> <font size="2" face="Arial"> On Sunday, February 9, 2014 4:44 AM, Rob Crittenden <rcritten@redhat.com> wrote:<br clear="none"> </font> </div>
<div class="yiv4702327435y_msg_container">Shree wrote:<br clear="none">> Lukas<br clear="none">> Perhaps I should explain the design a bit and see if FreeIPA even<br clear="none">> supports this.Our replica is in a separate network and all the<br clear="none">> appropriate ports are opened between the master and the replica. The<br clear="none">> "replica" got created successfully and is in sync with the master<br clear="none">> (except the CA services which I mentioned earlier)<br clear="none">> Now,when I try to run ipa-client-install on hosts in the new network<br clear="none">> using the replica, it complains that about "Cannot contact any KDC for<br clear="none">> realm".<br clear="none">> I am wondering it my hosts in the new network are trying to access the<br clear="none">> "master" for certificates since the replica does not have any CA<br clear="none">> services running? I couldn't find any obvious proof of
this even running<br clear="none">> the install in a debug mode. Do I need to open ports between the new<br clear="none">> hosts and the master for CA services?<br clear="none">> At this point I
cannot disable or move the master, it needs to function<br clear="none">> in its location but I need<br clear="none"><br clear="none">No, the clients don't directly talk to the CA.<br clear="none"><br clear="none">You'd need to look in /var/log/ipaclient-install.log to see what KDC was <br clear="none">found and we were trying to use. If you have SRV records for both but we <br clear="none">try to contact the hidden master this will happen. You can try <br clear="none">specifying the server on the command-line with --server but this will be <br clear="none">hardcoding things and make it less flexible later.<br clear="none"><br clear="none">rob<br clear="none"><br clear="none">> Shreeraj<br clear="none">> ----------------------------------------------------------------------------------------<br clear="none">><br clear="none">><br clear="none">> Change is the only Constant !<br clear="none">><br clear="none">><br
clear="none">> On Saturday, February 8, 2014 1:29 AM, Lukas Slebodnik<br clear="none">> <<a rel="nofollow" shape="rect" ymailto="mailto:lslebodn@redhat.com" target="_blank" href="mailto:lslebodn@redhat.com">lslebodn@redhat.com</a>> wrote:<br clear="none">> On (06/02/14 18:33), Shree wrote:<br clear="none">><br clear="none">> >First of
all, the ipa-replica-install did not allow me to use<br clear="none">> the --setup-ca<br clear="none">> > option complaining that a cert already exists, replicate creation was<br clear="none">> > successful after I skipped the option.<br clear="none">> >Seems like the replica is one except<br clear="none">> >1) There is no CA Service running on the replica (which I guess is<br clear="none">> expected)<br clear="none">> >and<br clear="none">> >2) I am unable to run ipa-client-install successfully on any clients using<br clear="none">> > the replica. (I don't have the option of using the primary master as<br clear="none">> it is<br clear="none">> > configured in a segregated environment. Only the master and replica are<br clear="none">> > allowed to sync.<br clear="none">> >Debug shows it fails at<br clear="none">>
><br clear="none">> >ipa : DEBUG stderr=kinit: Cannot contact any KDC for realm<br clear="none">> 'mydomainname.com' while getting initial
credentials<br clear="none">><br clear="none">> ><br clear="none">> ><br clear="none">><br clear="none">> I was not able to install replica witch CA on fedora 20,<br clear="none">> Bug is already reported <a rel="nofollow" shape="rect" target="_blank" href="https://fedorahosted.org/pki/ticket/816">https://fedorahosted.org/pki/ticket/816</a><br clear="none">><br clear="none">> Guys from dogtag found a workaround<br clear="none">> <a rel="nofollow" shape="rect" target="_blank" href="https://fedorahosted.org/pki/ticket/816#comment:12">https://fedorahosted.org/pki/ticket/816#comment:12</a><br clear="none">><br clear="none">> Does it work for you?<br clear="none">><br clear="none">> LS<br clear="none">><br clear="none">><br clear="none">><br clear="none">><br clear="none">><br clear="none">> _______________________________________________<br clear="none">> Freeipa-users mailing
list<br clear="none">> <a rel="nofollow" shape="rect" ymailto="mailto:Freeipa-users@redhat.com" target="_blank" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br clear="none">> <a rel="nofollow" shape="rect" target="_blank" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br clear="none">><br clear="none"><br clear="none"><br clear="none"><br clear="none"></div> </div> </div>
</div></div></div> </div></div></div></div></div></div></div></body></html>