<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yiv9308546700"><div id="yui_3_16_0_ym18_1_1458858775764_38266"><div style="background-color: rgb(255, 255, 255);" id="yui_3_16_0_ym18_1_1458858775764_38265"><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr"><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">I've got some sporadic behavior on my IPA instance and I'm hoping someone can help me resolve the issue. The problem is that many times my clients cannot authenticate to the respective hosts. First, my environment. Some details:</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_39966" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">ipa2 - centos 6.3 - ipa server 3.0.0</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">ipa3 - centos 7.1 - ipa server 4.1.0</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_39971" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">We had a FreeIPA server host ipa1 that died some time ago. I do not have any details on that host.</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_39975" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">Again, the problem is that clients cannot authenticate very frequently. </div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_39979" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">Here are some examples of the problems I am having:</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""> I client can login to the console of a CentOS 6.7 host, but cannot SSH into it.</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""> One user can login to a host, but another user cannot.</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_39985" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">Some diagnostics information:</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_39989" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">Services running on IPA servers:</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_39993" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">[root@ipa2 ~]# ps -ef | grep krb</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">root 6007 5936 0 19:21 pts/5 00:00:00 grep krb</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">root 22339 1 0 Feb06 ? 00:00:00 /usr/sbin/krb5kdc -r AAA -P /var/run/krb5kdc.pid -w 2</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">root 22344 22339 0 Feb06 ? 00:42:56 /usr/sbin/krb5kdc -r AAA -P /var/run/krb5kdc.pid -w 2</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">root 22345 22339 0 Feb06 ? 00:42:50 /usr/sbin/krb5kdc -r AAA -P /var/run/krb5kdc.pid -w 2</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_40001" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">[root@ipa3 ~]# ps -ef | grep krb</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">root 2513 1 0 2015 ? 00:00:00 /usr/sbin/krb5kdc -P /var/run/krb5kdc.pid -w 2</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">root 2514 2513 0 2015 ? 00:01:20 /usr/sbin/krb5kdc -P /var/run/krb5kdc.pid -w 2</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">root 2515 2513 0 2015 ? 00:01:18 /usr/sbin/krb5kdc -P /var/run/krb5kdc.pid -w 2</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">root 5702 5609 0 19:20 pts/1 00:00:00 grep --color=auto krb</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_40009" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">slapd is running on both servers:</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_40013" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">[root@ipa3 ~]# ps -ef | grep slapd</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">dirsrv 2464 1 0 2015 ? 09:39:37 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-IDEF -i /var/run/dirsrv/slapd-IDEF.pid -w /var/run/dirsrv/slapd-IDEF.startpid</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">root 5707 5609 0 19:25 pts/1 00:00:00 grep --color=auto slapd</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">[root@ipa3 ~]# </div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_40020" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_40023" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">[root@ipa2 ~]# ps -ef | grep slapd</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">root 6024 5936 0 19:26 pts/5 00:00:00 grep slapd</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">dirsrv 22137 1 3 Feb06 ? 1-20:48:55 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-AAA -i /var/run/dirsrv/slapd-AAA .pid -w /var/run/dirsrv/slapd-AAA .startpid</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">pkisrv 22209 1 0 Feb06 ? 00:44:54 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-PKI-IPA -i /var/run/dirsrv/slapd-PKI-IPA.pid -w /var/run/dirsrv/slapd-PKI-IPA.startpid</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">[root@ipa2 ~]# </div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_40031" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">System time is synchronized across all hosts.</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_40035" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">For DNS, I have the following entries:</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_40039" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">[root@sharedone ~]# dig ipa.BBB.AAA +short</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">192.168.120.253</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">[root@sharedone ~]# dig ipa2.BBB.AAA +short</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">192.168.120.253</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">[root@sharedone ~]# dig ipa3.BBB.AAA +short</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">192.168.120.139</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">[root@sharedone ~]# </div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_40049" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">Now the ipa.AAA.AAA server does not exist anymore because it died. But if I remove that DNS entrey everything stops working and no one can authenticate, versus the sporadic issues we are having.</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_40053" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">If you need more detials or specific information, please let me know. I'm at a loss as to what causes this behavior.</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_40057" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">Thanks,</div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class=""><br id="yui_3_16_0_ym18_1_1458858775764_40061" class=""></div><div id="yiv9308546700yui_3_16_0_ym18_1_1458859909172_3693" dir="ltr" class="">JT</div></div></div></div></div></div></body></html>