setting up a new replica: failed in "retrieving schema for SchemaCache"
by Karl Forner
Cross-posted from https://github.com/freeipa/freeipa-container/issues/151
Context: I have one master running in a docker container, with freeIPA
4.2.3.
I'm trying to setup a new replica. I could not using the same docker
container version that runs the master. I've been told to use the latest
version for the replica, that's what I tried here.
The latest docker container should contain a freeIPa 4.4.4.
When I launch the docker container, it launches the ipareplica-install
process, it seems to go well but then fails with:
2017-08-02T11:54:20Z DEBUG retrieving schema for SchemaCache
url=ldapi://%2fvar%2frun%2fslapd-QUARTZBIO-COM.socket
conn=<ldap.ldapobject.SimpleLDAPObject inst
ance at 0x7fdb699aed88>
What is the problem ? Is it because the master version is too old ?
What should I do in order to setup a new replica ?
Thanks.
P.S
The relevant part of the logs is :
2017-08-02T11:54:20Z DEBUG Successfully updated nsDS5ReplicaId.
2017-08-02T11:54:20Z DEBUG flushing
ldapi://%2fvar%2frun%2fslapd-QUARTZBIO-COM.socket from SchemaCache
2017-08-02T11:54:20Z DEBUG retrieving schema for SchemaCache
url=ldapi://%2fvar%2frun%2fslapd-QUARTZBIO-COM.socket
conn=<ldap.ldapobject.SimpleLDAPObject inst
ance at 0x7fdb699aed88>
2017-08-02T11:54:37Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
line 449, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
line 439, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py",
line 431, in __setup_replica
r_bindpw=self.dm_password)
File "/usr/lib/python2.7/site-packages/ipaserver/install/replication.py",
line 1068, in setup_replication
raise RuntimeError("Failed to start replication")
RuntimeError: Failed to start replication
2017-08-02T11:54:37Z DEBUG [error] RuntimeError: Failed to start replication
2017-08-02T11:54:37Z DEBUG Destroyed connection context.ldap2_140580366919440
2017-08-02T11:54:37Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172,
in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py",
line 318, in run
cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 310, in run
self.execute()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 334, in execute
for nothing in self._executor():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 376, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 405, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 395, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 366, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 363, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 597, in _configure
next(executor)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 376, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 405, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 460, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 395, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 457, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 395, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 366, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 363, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py",
line 63, in _install
for nothing in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py",
line 1741, in main
install(self)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py",
line 375, in decorated
func(installer)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py",
line 818, in install
ds = install_replica_ds(config, options, ca_enabled, remote_api)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py",
line 139, in install_replica_ds
api=remote_api,
File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py",
line 412, in create_replica
self.start_creation(runtime=60)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
line 449, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
line 439, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py",
line 431, in __setup_replica
r_bindpw=self.dm_password)
File "/usr/lib/python2.7/site-packages/ipaserver/install/replication.py",
line 1068, in setup_replication
raise RuntimeError("Failed to start replication")
2017-08-02T11:54:37Z DEBUG The ipa-replica-install command failed,
exception: RuntimeError: Failed to start replication
2017-08-02T11:54:37Z ERROR Failed to start replication
2017-08-02T11:54:37Z ERROR The ipa-replica-install command failed. See
/var/log/ipareplica-install.log for more information
6 years, 8 months
IPA replica with CA role problems
by Mark Haney
Prior to my employment, one of our engineers setup an IPA server to
replace the horrific OpenLDAP server. One of my first tasks was to build
a second IPA server and setup replication. Initially, the replication
setup was smooth and simple. (I used this:
https://www.howtoforge.com/installing-freeipa-with-replication for
getting replica up.)
However, as we were starting to consider how best to deploy it to our
remote servers, and digging through the GUI I got this pop-up when
looking at the Topology page:
It is strongly recommended to keep the CA services installed on more
than one server.
As this replica needs to be a full 'replica' of the primary, I went
about trying to install the CA role on the second server, which I'll
call IPA1 and the master IPA0. The RH documentation says to 'Run
ipa-replica-install with the --setup-ca option.' Of course, the
documentation doesn't explicitly say whether that needs to be done on
the initial creation of the replica, or if it can be done after the
replica was created. (IOW, it just adds the CA services role and pulls
from IPA0 the CA stuff it needs.)
Unfortunately, that failed and I ended up uninstalling the replica with
'ipa-server-install --uninstall' after removing the replica from IPA0.
After a reboot (just in case), I built a new replica GPG file on IPA0,
copied it over to IPA1 and ran this:
ipa-replica-install replica-info-ipa1.neonova.net.gpg --setup-ca
That also failed with the exact same error as the failure from trying to
install just the CA role on the existing replica. This is the error I get:
[2/27]: configuring certificate server instance
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to
configure CA instance: Command '/usr/sbin/pkispawn -s CA -f
/tmp/tmpYC8gIz' returned non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the
installation logs and the following files/directories for more information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL
/var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipa.ipapython.install.cli.install_tool(Replica): ERROR CA
configuration failed.
ipa.ipapython.install.cli.install_tool(Replica): ERROR The
ipa-replica-install command failed. See /var/log/ipareplica-install.log
for more information
Also, in the pki-tomcat/ca/debug log I get this:
Failed to contact master using admin
portjavax.ws.rs.InternalServerErrorException: HTTP 500 Internal Server Error
issuer: CN=Go Daddy Secure Certificate Authority -
G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com,
Inc.",L=Scottsdale,ST=Arizona,C=US
javax.ws.rs.NotFoundException: HTTP 404 Not Found
We have a signed Wildcard Cert from GoDaddy on IPA0, but I can't tell
why this even needs to contact the Cert CA for any reason.
BTW, I had this wildcard cert setup for the IPA web interface only prior
to blowing this thing to pieces over partial documentation and God knows
what else isn't spelled out that I missed.
Any ideas?
--
Mark Haney
Network Engineer at NeoNova
919-460-3330 option 1
mark.haney(a)neonova.net
www.neonova.net
6 years, 8 months
PKI debug files are not rotated
by Harald Dunkel
Hi folks,
I found some very large log files in
/var/log/pki/pki-tomcat/ca
On the major CA host the "debug" file is >1GByte and was never
rotated. It seems that there is a responsible config file /etc/\
pki/pki-tomcat/ca/CS.cfg, setting
debug.append=true
debug.enabled=true
debug.filename=/var/lib/pki/pki-tomcat/logs/ca/debug
debug.hashkeytypes=
debug.level=0
debug.showcaller=false
Maybe I am too blind to see, but I haven't found an appropriate
menu in the web interface to alter these settings. Is it safe to
edit this file on the command line, bypassing the ipa web or
command line interfaces? How can I enable log file rotation?
This is Freeipa 4.4.0 on Centos 7.3.
Every helpful comment is highly appreciated
Harri
--
aixigo AG, Karl-Friedrich-Strasse 68, 52072 Aachen, Germany
phone: +49 241 559709-79, fax: +49 241 559709-99
eMail: harald.dunkel(a)aixigo.de, web: http://www.aixigo.de
Amtsgericht Aachen - HRB 8057, Vorstand: Erich Borsch, Christian Friedrich, Tobias Haustein, Vors. des Aufsichtsrates: Prof. Dr. Ruediger von Nitzsch
6 years, 8 months
Edit named-pkcs11
by Tejas Desai
BIND uses the directives “type forward” and “forward first” in its
named.conf file. How can I make use of BIND directives when using ipa
dns? Because it is based on BIND, can I edit named-pkcs11 directly? Tejas
6 years, 8 months
web interface: show all instead of just 20 entries?
by Harald Dunkel
Hi folks,
a small suggestion for the web interface: An option "show all"
would be nice, e.g. for the list of active users, user groups or
hosts. Currently it just shows 20 entries, which is *way* too
little.
Please excuse if I was too blind to find a config option.
freeipa is version 4.4.0-14 on Centos 7.3
Regards
Harri
--
aixigo AG, Karl-Friedrich-Strasse 68, 52072 Aachen, Germany
phone: +49 241 559709-79, fax: +49 241 559709-99
eMail: harald.dunkel(a)aixigo.de, web: http://www.aixigo.de
Amtsgericht Aachen - HRB 8057, Vorstand: Erich Borsch, Christian Friedrich, Tobias Haustein, Vors. des Aufsichtsrates: Prof. Dr. Ruediger von Nitzsch
6 years, 8 months
Mapping AD users to a simple short name? (odd mixed IPA w/ non-IPA environment for strange HPC use case)
by Chris Dagdigian
Have a strange use case - this may be a mostly sssd.conf config question
I think ...
I've got a high performance computing grid running in AWS. The front-end
and user login nodes are managed IPA clients and things are working well
even for the complex AD topology we have with lots of child-domains and
transitive trusts to cross. I can login as "user(a)NAFTA.COMPANY.COM" just
fine ...
What I'm trying to do is avoid having to make the HPC compute nodes into
IPA clients because I expect them to auto-scale up and down in reaction
to job load and I don't want to hammer my IPA server into submission,
nor do I want to swamp the poor replication threads as they try to
replicate all that info across the IPA server fleet.
I thought I could be clever ands scrape the IPA-provided UID and GID
values and use those numbers to create local account entries on the
remote compute node fleet. The login/master nodes would be "IPA
integrated" while the compute nodes would have skeletal /etc/passwd and
/etc/group files populated with data I stole from IPA...
However it turns out Linux really hates usernames with "@" in them and
refuses to let me make accounts. So I can't recreate
"user(a)NAFTA.COMPANY.COM" on my remote compute fleet. The presence of
the "@" symbol in my user ID simply breaks on any host that is not an
IPA client.
And it turns out even Grid Engine commands won't run with "@" in the
active user name so core HPC binaries like "qrsh" and "qlogin" are busted.
So I'm in a bit of a catch-22 situation:
- I want to avoid using IPA on my elastic compute fleet if possible to
avoid thrashing the IPA masters and replication
- However I can't fake local user accounts with matching UID/GID values
on the fleet because Linux hates the "@" character in usernames
This may be a dumb sssd.conf question but is there a way that I can
configure sssd.conf on my IPA clients to utterly and totally strip out
the long domain name from the user?
I want to map:
userA(a)NAFTA.COMPANY.COM
userB(a)EAME.COMPANY.COM
userC(a)APAC.COMAPNY.COM
To:
userA
userB
userC
.. just on my IPA enrolled HPC edge nodes I don't care if they have to
*login* using the fully qualified AD domain (that may be best anyway)
but I want the local OS to just use the short username if at all possible.
If I can get the IPA_enrolled login node to use pure short names than I
can fake those short names across the HPC cluster and I think things
will be sorted ...
Hope this makes sense! Any tips or hints appreciated. If I can't sort
this out quickly I'm probably just going to bite the bullet and script
in IPA-enroll, re-enroll and un-enroll actions into my auto-scaling
stuff. I really want to avoid that if at all possible.
Regards,
Chris
6 years, 8 months
Replication intermittently breaks---DNS process fail?
by pgb205
We have observed the following situationreplication agreement between server1 and server2 exists
ipa-replica-manage list server2>server1
However some of the users, hosts etc that are added on server1 are not making it to server2.
In sssd/error logs I can see the following which looks relevant:
[27/Jul/2017:04:53:22.624847790 +0000] NSMMReplicationPlugin - agmt="cn=meToserver1" (server1:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later.[27/Jul/2017:05:01:34.472586960 +0000] NSMMReplicationPlugin - agmt="cn=meToserver1" (server1:389): Unable to receive the response for a startReplication extended operation to consumer (Can't contact LDAP server). Will retry later.[29/Jul/2017:01:33:20.466840208 +0000] NSMMReplicationPlugin - agmt="cn=meToserver1" (server1:389): Replication bind with GSSAPI auth resumed
[29/Jul/2017:11:16:51.566360207 +0000] NSMMReplicationPlugin - agmt="cn=meToserver1" (server1:389): Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) ()[29/Jul/2017:11:17:00.664020018 +0000] NSMMReplicationPlugin - agmt="cn=meToserver1" (server1:389): Replication bind with GSSAPI auth resumed[29/Jul/2017:11:17:01.106831731 +0000] NSMMReplicationPlugin - agmt="cn=meToserver1" (server1:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica.
there are no known network issues between the two servers, and all ports are opened as confirmed by nmap.
I am also able to
ipa-replica-manage re-initialize --from server1
which has the desired effect of updating server2's information.
in /var/log/messages I do see
Jul 31 03:18:08 server2 named-pkcs11[30962]: zone domain.com/IN: NS 'server1' has no address records (A or AAAA)Jul 31 11:41:52 server2 ns-slapd: [31/Jul/2017:11:41:52.408672378 +0000] NSMMReplicationPlugin - agmt="cn=meToserver1" (ipa-x1:389): Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) ()
in var/log/messages I see
Jul 31 03:18:08 server2 named-pkcs11[30962]: zone domain.com/IN: NS 'server1.domain.com' has no address records (A or AAAA)Jul 31 03:18:08 server2 named-pkcs11[30962]: zone domain.com/IN: not loaded due to errors.
Jul 31 03:18:08 server2 named-pkcs11[30962]: update_zone (syncrepl) failed for master zone DN 'idnsname=domain.com.,cn=dns,dc=company,dc=com'. Zones can be outdated, run `rndc reload`: bad zone
Jul 31 04:05:03 server2 named-pkcs11[30962]: error (network unreachable) resolving 'srv.external_dns.net/A/IN': 2a02:e180:8::1#53
Jul 31 11:40:05 server2 named-pkcs11[30962]: received control channel command 'stop'
Jul 31 11:40:05 server2 named-pkcs11[30962]: shutting down: flushing changesJul 31 11:40:05 server2 named-pkcs11[30962]: stopping command channel on ::1#953
Jul 31 11:40:05 server2 named-pkcs11[30962]: zone 23.34.34.-addr.arpa/IN: shutting down
so looks like some problem with IPA's dns server. Since server2 is it's own auth DNS server for freeipa domains it would make sense that it wouldn't be able to resolve the server1 ip address and replication would fail.
If you agree then what would be the steps to troubleshoot the DNS functionality problems above.
PS:Another thing to note is that when I re-initialized the database from server1 DNS still wasn't working properly and I had to ipactl restartto get it working.
thank you
6 years, 8 months
External Application Authentication Against FreeIPA LDAP Not Working
by bdlamprecht@gmail.com
I've been trying to get this to work for a few days now all to no avail...
I'm been running "FreeIPA, version: 4.3.1" for a few months now to authenticate a number of VMs that I grew tired of managing permissions on a individual basis and so far have been very pleased.
Now, I'm attempt to use the LDAP functionality to authenticate an external application against it.
I've been able to get the basic auth to work well, however, I can't seem to get the group permissions to work at all.
From my FreeIPA server's "/var/log/dirsrv/slapd/access.log":
Without group permissions (working):
[31/Jul/2017:16:21:07 -0600] conn=6138 fd=121 slot=121 SSL connection from 9.0.49.10 to 9.0.49.11
[31/Jul/2017:16:21:07 -0600] conn=6138 TLS1.2 128-bit AES-GCM
[31/Jul/2017:16:21:07 -0600] conn=6138 op=0 BIND dn="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" method=128 version=3
[31/Jul/2017:16:21:07 -0600] conn=6138 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com"
[31/Jul/2017:16:21:07 -0600] conn=6138 op=1 BIND dn="" method=128 version=3
[31/Jul/2017:16:21:07 -0600] conn=6138 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn=""
[31/Jul/2017:16:21:07 -0600] conn=6138 op=2 SRCH base="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL
[31/Jul/2017:16:21:07 -0600] conn=6138 op=2 RESULT err=0 tag=101 nentries=1 etime=0
[31/Jul/2017:16:21:07 -0600] conn=6138 op=3 UNBIND
[31/Jul/2017:16:21:07 -0600] conn=6138 op=3 fd=121 closed - U1
Using group permissions (NOT working):
[31/Jul/2017:16:32:54 -0600] conn=6162 fd=126 slot=126 SSL connection from 9.0.49.10 to 9.0.49.11
[31/Jul/2017:16:32:54 -0600] conn=6162 TLS1.2 128-bit AES-GCM
[31/Jul/2017:16:32:54 -0600] conn=6162 op=0 BIND dn="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" method=128 version=3
[31/Jul/2017:16:32:54 -0600] conn=6162 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com"
[31/Jul/2017:16:32:54 -0600] conn=6162 op=1 BIND dn="" method=128 version=3
[31/Jul/2017:16:32:54 -0600] conn=6162 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn=""
[31/Jul/2017:16:32:54 -0600] conn=6162 op=2 CMP dn="cn=netbox-users,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com" attr="member"
[31/Jul/2017:16:32:54 -0600] conn=6162 op=2 RESULT err=50 tag=111 nentries=0 etime=0
[31/Jul/2017:16:32:54 -0600] conn=6162 op=3 UNBIND
[31/Jul/2017:16:32:54 -0600] conn=6162 op=3 fd=126 closed - U1
In the 2nd example above the "op=2 RESULT err=50" indicates that "LDAP_INSUFFICIENT_ACCESS" is what is being returned, but when I do the following "ldapsearch" command:
ldapsearch -D "uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" -W uid=bl839s
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <dc=coc,dc=ibm,dc=com> (default) with scope subtree
# filter: uid=bl839s
# requesting: ALL
#
# bl839s, users, accounts, coc.ibm.com
dn: uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com
krbLastSuccessfulAuth: 20170731223600Z
memberOf: cn=admins,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com
---SNIP---
memberOf: cn=netbox-users,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com
---SNIP---
I can see that I AM a "member" of the the dn="cn=netbox-users,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com" group.
That being said, when I try to search for members of the group directly, I get a similar error:
root@ipa1:~# ldapsearch -D "cn=netbox-users,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com" -W uid=bl839s
Enter LDAP Password:
ldap_bind: Inappropriate authentication (48)
I would appreciate any help I can get in understanding what I don't have configured properly.
Thanks in advance,
Brady
6 years, 8 months
Renewing /etc/httpd/alias certs
by Jason B. Nance
Hello everyone,
I'm running FreeIPA 4.4 (as shipped with current CentOS 7). I had a series of unfortunate events which resulted in the entire cluster being offline for a matter of a couple weeks during which the certificate in /etc/httpd/alias expired. I rolled back the clocks on all of the servers in the cluster and started them successfully, however, the certificates in /etc/httpd/alias did not get renewed. Is there a process that automatically handles this or was I supposed to be maintaining that?
Additionally, based on:
https://www.freeipa.org/page/Howto/CA_Certificate_Renewal
...I ran "ipa-cacert-manage renew" on my CA in a hope that that would trigger renewals across the boards, but now it appears that only the CA was updated as none of the server certificates were re-issued and are now all untrusted (I can't do "kinit admin" any longer as my realm is now down). Is there any chance of rolling that back or issuing new certs to get things going again?
If I have to start over, that is certainly an option. I'm just trying to get a better understanding of what I should have been doing to avoid this situation in the first place.
Thanks,
j
6 years, 8 months
Time Skew on Amazon nodes?
by pgb205
I have noticed that we had a broken replication agreement between replica in amazon and on another physical node. I have attempted to re-initialize but receivedUpdate failed! Status: [2 Replication error acquiring replica: excessive clock skew]
I had triple verified that time on both is correct and at most within seconds of each other.
in dirsrv logs I get
Excessive clock skew from supplier RUVUnable to acquire replica: error: excessive clock skew
After doing a bit of searching I found this beauty:https://www.redhat.com/archives/freeipa-users/2014-February/msg000...
The article mentions that the time skew might occur due to server being virtualied, and I'm wondering if this is applicable to Amazon.
The steps mentioned in the article look intrusive (and intimidating) . I'm curious what other avenues are available to me to fix this?If I blow away the replica and re-set up the new one from scratch would that fix the problem.
6 years, 8 months