<div dir="ltr">HI<div><br></div><div>i tried the method mentioned on that document and it end up with below error. My DNS is managed by external box and i dont want to create any DNS record on these servers.</div><div><br></div><div>and the command which i tried is(non client server)</div><div><br></div><div>ipa-replica-install --principal admin --admin-password P@ssw0rd --domain <a href="http://kw.example.com">kw.example.com</a> --server <a href="http://zkwipamstr01.kw.example.com">zkwipamstr01.kw.example.com</a><br></div><div><br></div><div><br></div><div><br></div><div><div>ipa : CRITICAL Failed to restart the directory server (Command '/bin/systemctl restart dirsrv@KW-EXAMPLE-COM.service' returned non-zero exit status 1). See the installation log for details.</div><div> [29/44]: setting up initial replication</div><div> [error] error: [Errno 111] Connection refused</div><div>Your system may be partly configured.</div><div>Run /usr/sbin/ipa-server-install --uninstall to clean up.</div><div><br></div><div>ipa.ipapython.install.cli.install_tool(Replica): ERROR [Errno 111] Connection refused</div><div>ipa.ipapython.install.cli.install_tool(Replica): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information</div><div>[root@zkwiparepa01 ~]# /bin/systemctl restart dirsrv@KW-EXAMPLE-COM.service</div><div>Job for dirsrv@KW-EXAMPLE-COM.service failed because the control process exited with error code. See "systemctl status dirsrv@KW-EXAMPLE-COM.service" and "journalctl -xe" for details.</div><div><br></div><div>[root@zkwiparepa01 ~]# systemctl status dirsrv@KW-EXAMPLE-COM.service</div><div>● dirsrv@KW-EXAMPLE-COM.service - 389 Directory Server KW-EXAMPLE-COM.</div><div> Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled)</div><div> Active: failed (Result: exit-code) since Wed 2017-01-04 12:54:46 AST; 13s ago</div><div> Process: 14893 ExecStart=/usr/sbin/ns-slapd -D /etc/dirsrv/slapd-%i -i /var/run/dirsrv/slapd-%i.pid (code=exited, status=1/FAILURE)</div><div> Process: 14887 ExecStartPre=/usr/sbin/ds_systemd_ask_password_acl /etc/dirsrv/slapd-%i/dse.ldif (code=exited, status=0/SUCCESS)</div><div> Main PID: 14893 (code=exited, status=1/FAILURE)</div><div><br></div><div>Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com">zkwiparepa01.kw.example.com</a> ns-slapd[14893]: [04/Jan/2017:12:54:46.177617891 +0300] Error: betxnpostoperation plu...arted</div><div>Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com">zkwiparepa01.kw.example.com</a> ns-slapd[14893]: [04/Jan/2017:12:54:46.178379752 +0300] Error: object plugin Roles Pl...arted</div><div>Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com">zkwiparepa01.kw.example.com</a> ns-slapd[14893]: [04/Jan/2017:12:54:46.179162340 +0300] Error: preoperation plugin su...arted</div><div>Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com">zkwiparepa01.kw.example.com</a> ns-slapd[14893]: [04/Jan/2017:12:54:46.179993432 +0300] Error: object plugin USN is n...arted</div><div>Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com">zkwiparepa01.kw.example.com</a> ns-slapd[14893]: [04/Jan/2017:12:54:46.181305209 +0300] Error: object plugin Views is...arted</div><div>Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com">zkwiparepa01.kw.example.com</a> ns-slapd[14893]: [04/Jan/2017:12:54:46.182094981 +0300] Error: extendedop plugin whoa...arted</div><div>Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com">zkwiparepa01.kw.example.com</a> systemd[1]: dirsrv@KW-EXAMPLE-COM.service: main process exited, code=exited, status=1/FAILURE</div><div>Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com">zkwiparepa01.kw.example.com</a> systemd[1]: Failed to start 389 Directory Server KW-EXAMPLE-COM..</div><div>Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com">zkwiparepa01.kw.example.com</a> systemd[1]: Unit dirsrv@KW-EXAMPLE-COM.service entered failed state.</div><div>Jan 04 12:54:46 <a href="http://zkwiparepa01.kw.example.com">zkwiparepa01.kw.example.com</a> systemd[1]: dirsrv@KW-EXAMPLE-COM.service failed.</div><div>Hint: Some lines were ellipsized, use -l to show in full.</div></div><div><br></div><div><br></div><div><br></div><div>Regards,</div><div>Ben</div><div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 4, 2017 at 11:19 AM, Martin Babinsky <span dir="ltr"><<a href="mailto:mbabinsk@redhat.com" target="_blank">mbabinsk@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="gmail-HOEnZb"><div class="gmail-h5">On 01/04/2017 07:21 AM, Ben .T.George wrote:<br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> HI<br> <br> while trying to create ipa replica, i am getting below error,<br> <br> Replica creation using 'ipa-replica-prepare' to generate replica file<br> is supported only in 0-level IPA domain.<br> <br> The current IPA domain level is 1 and thus the replica must<br> be created by promoting an existing IPA client.<br> <br> To set up a replica use the following procedure:<br> 1.) set up a client on the host using 'ipa-client-install'<br> 2.) promote the client to replica running 'ipa-replica-install'<br> *without* replica file specified<br> <br> 'ipa-replica-prepare' is allowed only in domain level 0<br> The ipa-replica-prepare command failed.<br> <br> <br> i have IPA master server without AD integration and DNS is managed by<br> 3rd party appliances.<br> <br> <br> <br> Regards,<br> Ben<br> <br> <br> </blockquote> <br></div></div> Hi Ben,<br> <br> If you installed IPA 4.4 server then domain level 1 is the default. This domain level uses different mechanism to stand up replicas. See the latest IdM documentation[1] for more details.<br> <br> [1] <a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/creating-the-replica.html" rel="noreferrer" target="_blank">https://access.redhat.com/docu<wbr>mentation/en-US/Red_Hat_Enterp<wbr>rise_Linux/7/html/Linux_Domain<wbr>_Identity_Authentication_and_<wbr>Policy_Guide/creating-the-<wbr>replica.html</a><span class="gmail-HOEnZb"><font color="#888888"><br> <br> -- <br> Martin^3 Babinsky<br> <br> -- <br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman<wbr>/listinfo/freeipa-users</a><br> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> </font></span></blockquote></div><br></div></div>