<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"> </div> No, not resolved yet I did test with GSSAPI (-Y) and like you it worked. :(<div> </div><div><div id="bloop_sign_1416336143796808960" class="bloop_sign"><div style="font-family:helvetica,arial;font-size:13px"> Will Sheldon </div><div style="font-family:helvetica,arial;font-size:13px"> </div></div>On November 18, 2014 at 8:37:10 AM, dbischof@hrz.uni-kassel.de (<a href="mailto:dbischof@hrz.uni-kassel.de">dbischof@hrz.uni-kassel.de</a>) wrote: <blockquote type="cite" class="clean_bq"><div><div></div><div>Hi, On Fri, 7 Nov 2014, Dmitri Pal wrote: > On 11/07/2014 01:24 AM, Will Sheldon wrote: >> On November 6, 2014 at 10:07:54 PM, Dmitri Pal (dpal@redhat.com >> <mailto:dpal@redhat.com>) wrote: >>> On 11/07/2014 12:18 AM, Will Sheldon wrote: >>>> >>>> On the whole we are loving FreeIPA, Many thanks and much respect to >>>> all involved, we’ve had a great 12-18 months hassle free use out of >>>> it - it is a fantastically stable trouble free solution… however now >>>> we’ve run into a small issue we (as mere mortals) are finding it hard >>>> to resolve :-/ >>>> >>>> We upgraded our ipa servers (3.0.0-42) to Centos 6.6. everything >>>> seems to go well, but one server is behaving oddly. It’s likely not >>>> an IPA issue, it also reset it’s hostname somehow after the upgrade >>>> (it’s an image in an openstack environment) >>>> >>>> If anyone has any pointers as to how to debug I’d be hugely >>>> appreciative :) >>>> >>>> Two servers, server1.domain.com and server2.domain.com >>>> >>>> Server1 can’t push data to server2, there are updates and new records >>>> on server1 that do not exist on server2. >>>> >>>> >>>> from the logs on server1: >>>> >>>> [07/Nov/2014:01:33:42 +0000] NSMMReplicationPlugin - >>>> agmt="cn=meToserver2.domain.com" (server2:389): Warning: unable to send >>>> endReplication extended operation (Can't contact LDAP server) >>>> [07/Nov/2014:01:33:47 +0000] NSMMReplicationPlugin - >>>> agmt="cn=meToserver2.domain.com" (server2:389): Replication bind with >>>> GSSAPI auth resumed >>>> [07/Nov/2014:01:33:48 +0000] NSMMReplicationPlugin - >>>> agmt="cn=meToserver2.domain.com" (server2:389): Warning: unable to >>>> replicate schema: rc=2 >>>> [07/Nov/2014:01:33:48 +0000] NSMMReplicationPlugin - >>>> agmt="cn=meToserver2.domain.com" (server2:389): Consumer failed to replay >>>> change (uniqueid (null), CSN (null)): Can't contact LDAP server(-1). Will >>>> retry later. >>> >>> Try to see >>> a) Server 1 properly resolves server 2 >>> b) You can connect from server 1 to server 2 using ldapsearch >>> c) your firewall has proper ports open >>> d) dirserver on server 2 is actually running >> >> All seems working: >> >> [root@server1 ~]# ldapsearch -x -H ldap://server2.domain.com -s base -b '' >> namingContexts > > Can you try kinit admin and then use kerberos GSSAPI to connect, i.e. -Y > switch? is this resolved? I observe it on my systems, too. Exact same symptoms. ldapsearch with "-Y GSSAPI" works. > Did you find anything in the server2 logs? On my "server2", I see "sasl_io_recv failed to decode packet for connection #". Could there be something wrong with default buffer sizes as described in https://bugzilla.redhat.com/show_bug.cgi?id=953653 I have nsslapd-sasl-max-buffer-size: 65536 on both machines, but my database is rather small: ~30 users, <10 hosts and services. >> # extended LDIF >> # >> # LDAPv3 >> # base <> with scope baseObject >> # filter: (objectclass=*) >> # requesting: namingContexts >> # >> >> # >> dn: >> namingContexts: dc=domain,dc=com >> >> # search result >> search: 2 >> result: 0 Success >> >> # numResponses: 2 >> # numEntries: 1 >> [root@server1 ~]# >> >> And: >> >> [root@server2 ~]# /etc/init.d/dirsrv status >> dirsrv DOMAIN-COM (pid 1009) is running... >> dirsrv PKI-IPA (pid 1083) is running... >> [root@server2 ~]# >> >>> >>> Check logs on server 2 to see whether it actually sees an attempt to >>> connect, I suspect not, so it is most likely a DNS/FW issue or dir server >>> is not running on 2. >>>> >>>> >>>> and the servers: >>>> >>>> [root@server1 ~]# ipa-replica-manage list -v `hostname` >>>> Directory Manager password: >>>> >>>> server2.domain.com: replica >>>> last init status: None >>>> last init ended: None >>>> last update status: 0 Replica acquired successfully: Incremental update >>>> started >>>> last update ended: 2014-11-07 01:35:58+00:00 >>>> [root@server1 ~]# >>>> >>>> >>>> >>>> [root@server2 ~]# ipa-replica-manage list -v `hostname` >>>> Directory Manager password: >>>> >>>> server1.domain.com: replica >>>> last init status: None >>>> last init ended: None >>>> last update status: 0 Replica acquired successfully: Incremental update >>>> succeeded >>>> last update ended: 2014-11-07 01:35:43+00:00 >>>> [root@server2 ~]# Mit freundlichen Gruessen/With best regards, --Daniel. -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go To http://freeipa.org for more info on the project</div></div></blockquote></div></body></html>