<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 08/12/2016 04:10 PM, Louis Francoeur
wrote:<br>
</div>
<blockquote cite="mid:1471011018717.92378@esignlive.com" type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} p {margin-top:0; margin-bottom:0}--></style>
<p>Since the rpm update to
ipa-server-dns-4.2.0-15.0.1.el7.centos.18.x86_64 (running on
Centos 7),<br>
</p>
<p><br>
</p>
<p>most of my replication started to failed with:</p>
</blockquote>
what do you mean by "most of", if some servers still work and others
don't is there something different ?<br>
<blockquote cite="mid:1471011018717.92378@esignlive.com" type="cite">
<p><br>
</p>
<p>last update status: -1 Incremental update has failed and
requires administrator actionLDAP error: Can't contact LDAP
server <br>
</p>
</blockquote>
what is in the error log of directory server ? Identify one broken
replication connection and check both supplier and consumer side<br>
<blockquote cite="mid:1471011018717.92378@esignlive.com" type="cite">
<p><br>
</p>
<p>Then setup contains about 10 ipa servers in 5 different
locations.<br>
</p>
<p><br>
</p>
<p>But i went and ran an ipa-replica-conncheck i get this:</p>
<p><br>
</p>
<p># ipa-replica-conncheck --replica server.domain.local<br>
Check connection from master to remote replica
'server.domain.local':<br>
Directory Service: Unsecure port (389): OK<br>
Directory Service: Secure port (636): OK<br>
Kerberos KDC: TCP (88): OK<br>
Kerberos KDC: UDP (88): WARNING<br>
Kerberos Kpasswd: TCP (464): OK<br>
Kerberos Kpasswd: UDP (464): WARNING<br>
HTTP Server: Unsecure port (80): OK<br>
HTTP Server: Secure port (443): OK<br>
The following UDP ports could not be verified as open: 88, 464<br>
This can happen if they are already bound to an application<br>
and ipa-replica-conncheck cannot attach own UDP responder.<br>
<br>
Connection from master to replica is OK.</p>
<p><br>
</p>
<p><br>
</p>
<p>I even ran the following without issue:</p>
<dl>
<dd><tt># kinit -kt /etc/dirsrv/ds.keytab ldap/`hostname`</tt></dd>
<dd><tt># klist</tt></dd>
<dd><tt># ldapsearch -Y GSSAPI -h `hostname` -b "" -s base</tt></dd>
<dd><tt># ldapsearch -Y GSSAPI -h the.other.master.fqdn -b "" -s
base</tt></dd>
</dl>
<p>Not really sure what to check for next?</p>
<p>Any hint?</p>
<p><br>
</p>
<p>Thanks</p>
<p>Louis Francoeur<br>
</p>
<div id="Signature">
<div name="divtagdefaultwrapper"
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:; margin:0">
<div name="divtagdefaultwrapper"
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:; margin:0">
<style type="text/css" style="display:none"> <!-- p {margin-top:0; margin-bottom:0} --> </style></div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Red Hat GmbH, <a class="moz-txt-link-freetext" href="http://www.de.redhat.com/">http://www.de.redhat.com/</a>, Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Michael Cunningham, Michael O'Neill, Eric Shander</pre>
</body>
</html>