replication issues
by Lance Murray
We have 4 IPA servers setup in a circular replication (each server can
replicate to 2 other servers), which created a replication that looks like
an 'O' .. but we have some replication issues:
note: we are using freeIPA as DNS and Users authentication and
authorization.
1. some records do not seem to get replicated when they get updated to all
other nodes
2. almost weekly replication stops with many open files, ldapwhoami
processes, etc.
- replication-status.html usually will show Update Status = 'Error (1)
Can't acquire busy server'
- A restart of directory services sometimes fixes this, and sometimes a
server reboot is required
- no indication of failure in log files, other than 'can not contact
ldap server'
- sometimes restart of named-pkcs11 clears replication
- The Max CSN number on all nodes has a timestamp that is consistently
in the future. Which is very odd, and might be related. Easy to
check by making a change on one of them, and then checking the CSN from the
config.
Our architecture is 2 data centers, with a pair of servers in each. For
reliability we want to make all servers available to each data center. We
are running on Centos 7.3.
It seems were are missing something somewhere to help make this reliable.
Errors 2-3 times a week is becoming a support nightmare.
Questions are:
1. should we have a different architecture (eg, 1 master, multiple slaves,
multi-master)?
2. should we replicate less frequently? (what is best practice)
3. currently known issues with replication on Centos 7.3?
Thanks,
-lance
--
*Lance Murray* | Senior Systems Admin | *SBI BITS*
Roppongi T-Cube 20F, 3-1-1 Roppongi, Minato-ku, Tokyo 106-0032 Japan
*T* +81-3-4510-7000 | *M* +81-070-1529-1960 | *E*
<firstname.lastname(a)sbibits.com>lance.murray(a)sbibits.com
<firstname.lastname(a)sbibits.com>
--
*This correspondence (including any attachments) is for the intended
recipient(s) only. It may contain confidential or privileged information or
both. No confidentiality or privilege is waived or lost by any
mis-transmission. If you receive this correspondence by mistake, please
contact the sender immediately, delete this correspondence (and all
attachments) and destroy any hard copies. You must not use, disclose, copy,
distribute or rely on any part of this correspondence (including any
attachments) if you are not the intended
recipient(s).本メッセージに記載および添付されている情報(以下、総称して「本情報」といいます。)は、本来の受信者による使用のみを意図しています。誤送信等により本情報を取得された場合でも、本情報に係る秘密、または法律上の秘匿特権が失われるものではありません。本電子メールを受取られた方が、本来の受信者ではない場合には、本情報及びそのコピーすべてを削除・破棄し、本電子メールが誤って届いた旨を発信者宛てにご通知下さいますようお願いします。本情報の閲覧、発信または本情報に基づくいかなる行為も明確に禁止されていることをご了承ください。*
6 years, 8 months
Re: IPA Master won't start and replicas are not taking over
by Rob Crittenden
Randy Morgan wrote:
> After some serious arm twisting, I was finally able to get the server to
> run a yum update. It would appear that some of the files for ipa had
> become corrupted and this was the reason it would not start. After the
> yum update, it started just fine and I was able to run an IPA-upgrade
> command. That seemed to correct the problem with the server being
> down. No I will have to work through the multiple master configs and
> make sure everything is working like it is supposed to so this does not
> happen again.
Ok, glad it's working again.
Still the lack of failover wasn't good. It may be the way your clients
are configured.
rob
>
> Randy
>
> Randy Morgan
> CSR
> Department of Chemistry and Biochemistry
> Brigham Young University
> 801-422-4100
>
> On 08/14/2017 12:58, Rob Crittenden wrote:
>> Randy Morgan via FreeIPA-users wrote:
>>> Over the weekend our IPA Master failed and I can not get ipactl to
>>> start, the Directory Service fails. We have two replicas and I was
>>> under the impression that if one of the servers failed the others would
>>> pickup the load, that is not happening however, and we have been down
>>> for two days now. Is there something that I need to do to the replicas
>>> to make one of them the new master, and if so could you walk me through
>>> the conversion?
>> Failover depends on your configuration and what isn't failing over. Can
>> you provide more details on what isn't working? Be sure to include
>> detrails on how your clients are configured, whether your IPA servers
>> have DNS srv records, etc.
>>
>> Once we get that working we can tackle what is going on with the failed
>> master.
>>
>> rob
>
6 years, 8 months
IPA Master won't start and replicas are not taking over
by Randy Morgan
Over the weekend our IPA Master failed and I can not get ipactl to
start, the Directory Service fails. We have two replicas and I was
under the impression that if one of the servers failed the others would
pickup the load, that is not happening however, and we have been down
for two days now. Is there something that I need to do to the replicas
to make one of them the new master, and if so could you walk me through
the conversion?
Thanks,
Randy
--
Randy Morgan
CSR
Department of Chemistry and Biochemistry
Brigham Young University
801-422-4100
6 years, 8 months
Can Load balanced HTTP service use kerberos authentication?
by William Muriithi
Afternoon,
I am attempting to add redundancy to a system that we are currently
using and that use apache as web server. The apache is using IPA for
user authentication
To do this, I will have to use a load balancer in front of the two
servers and the original setup don't seem to work fine with the load
balancer in front. For one, the load balancer is not an IPA client,
so can't setup Service Principal Name there.
Is this kind of setup supported currently by IPA? Have anyone
deployed it and wouldn't mind sharing the experience? I am just a bit
cautions taking the steps as the system is already in production. I
have researched this morning and the only link I see is this.
https://www.freeipa.org/page/V4/Keytab_Retrieval
Not sure if it was ever implemented as there is no discussion of it on
the Free-IPA mailing list
IPA server:
ipa-server-4.4.0-14.el7_3.6.x86_64
Apache: (IPA client)
httpd-2.4.6-45.el7
Regards,
William
6 years, 8 months
Chromium complains about ipa's web server certificate
by Harald Dunkel
Hi folks,
My freeipa installation (Centos 7.3, freeipa 4.4.0) was signed by
an external root CA. Problem:
Even though I have imported the root CA and clicked on all the trust
checkboxes, chromium complains about the certificate of the web admin
interface running on https://ipa1.example.com/ :
- Subject Alternative Name missing
The certificate for this site does not contain a Subject Alternative
Name extension containing a domain name or IP address.
- Certificate error
There are issues with the site's certificate chain
(net::ERR_CERT_COMMON_NAME_INVALID).
The CN is "ipa1.example.com", matching the host name. The Subject
Alternative Name is
Not Critical
Microsoft Principal Name: HTTP/ipa1.example.com(a)EXAMPLE.COM
OID.1.3.6.1.5.2.2: 30 30 A0 0B 1B 09 41 49 58 49 47 4F 2E 44 45 A1
21 30 1F A0 03 02 01 01 A1 18 30 16 1B 04 48 54
54 50 1B 0E 69 70 61 31 2E 61 69 78 69 67 6F 2E
64 65
I haven't seen this mentioned here, but Google provides some more
information:
https://support.google.com/chrome/a/answer/7391219?hl=en
How can I tell freeipa?
Every helpful comment is highly appreciated
Harri
6 years, 8 months
FreeIPA client offline with sudo
by Matthew Carter
The clients machines on my network from time to time get brought to
another network and plugged in to test programs that are being
developed. In the past this hasn't been an issue as it's usually a short
stay and thus the kerberos key is cached and doesn't expire. Recently I
have had a user who has requested that he be able to mount an NFS share
on the "other network".
Naturally I thought of building a sudo rule and adding it to the freeipa
server, as we don't allow user mounts due to security requirements. The
issue is however that the sudo mount request will be made when the user
is not on the network and thus I imagine that it will get denied. Anyone
have experience with this, or thoughts? If I put a rule to allow
mounting the share by this user in the local sudoers file, will the
system verify the user against the cached user key and thus allow the mount?
I feel like I'm overthinking this . . .
Thanks for any help!
V/r,
Matthew
6 years, 8 months
remove ipa-dns-server ?
by Günther J. Niederwimmer
Hello,
CentOS 7.3
what is the best way to remove a installed ipa-dns-server?
I can't found any helpful Doc's for this only for installing the server I
found Docs
Thanks for the Help,
--
mit freundlichen Grüssen / best regards,
Günther J. Niederwimmer
6 years, 8 months
FreeIPA and postfix issue.
by Bob Rentschler
This may be related to the issue discussed here:
https://lists.fedorahosted.org/archives/list/freeipa-
users(a)lists.fedorahosted.org/message/SC7GYMHMJ2DNT6BDDSWG5F4HL252EJOD/
But it seems not to be, layer 8 is still open though.
Using the instructions here
https://www.dalemacartney.com/2013/03/14/deploying-postfix-with-ldap-free...
to enable postfix virtual users from freeIPA I seem to have hit a sticking
point in that postfix is unable to fetch the mail attribute.
this is the query filter I modified as per the referenced email in the
archive.
query_filter = (&(objectclass=posixaccount)(mail=%s))
When run from postmap it gets nothing. If I change it for testing to search
by uid or another attribute it works as expected. a simple filter like
(uid=%s) works everytime.
This ldapsearch run using the postfix servers keytab as credentials works
as well:
ldapsearch -LLL -Y GSSAPI -b cn=users,cn=accounts,dc=example,dc=org
'(&(objectclass=posixaccount)(|(mail=validuser(a)example.org)))'
The FreeIPA version is 4.4.4 running on Fedora 26
Is there something I may be overlooking here? I dove off into IPA v4
permissions and everything *seems* ok, but it is my chief suspect right now.
Thanks!
6 years, 8 months
another failed upgrade
by Charles Hedrick
I was unable to install an update for Centos 7.
I had done a default install, and then moved to commercial certs for LDAP and HTTP, using https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP. We don’t use the CA.
We have a replica. It upgraded fine, but then it’s CA-less.
The upgrade for the primary failed, because the upgrade of the CA failed. It tried to update Server-Cert for LDAP, but the actual cert has an alias based on the DN.
I assume there’s a different naming convention when a 3rd party CA is in use than when the cert is issued by Dogtag.
Any ideas how to recover? I’d be happy just to disable the CA component if that’s possible.
Can I rerun the upgrade?
At the moment I’m running in production with a half-upgraded system. It appears that the only thing that failed was the upgrade of the CA, which I don’t use. But this doesn’t seem to be a good idea in the long run. I’ve considered producing another CA-less replica, which presumably would upgrade fine, and decommissioning the original.
6 years, 8 months
ipa topology re-initialize
by grace rante thompson
> I'm having problems with replication on my two node ipa cluster (left-right, right-left) so I tried to re-initialize my replica.
>
> [root@idm02 ~]# ipa topologysegment-find domain
> -----------------
> 1 segment matched
> -----------------
> Segment name: idm01.domain.com-to-idm02.domain.com
> Left node: idm01.domain.com
> Right node: idm02.domain.com
> Connectivity: left-right
> ----------------------------
> Number of entries returned 1
> ----------------------------
>
> [root@idm01 ~]# ipa topologysuffix-verify domain
> ========================================================
> Replication topology of suffix "domain" contains errors.
> ========================================================
> ------------------------
> Topology is disconnected
> ------------------------
>
> Server idm02.domain.com can't contact servers: idm01.domain.com
>
> [root@idm01 ~]# ipa topologysegment-reinitialize --right
> Suffix name: domain
> Segment name: idm01.domain.com-to-idm02.domain.com
> --------------------------------------------------------------------------------------------------------
> Replication refresh for segment: "idm01.domain.com-to-idm02.domain.com" requested.
> --------------------------------------------------------------------------------------------------------
>
> How do I proceed? i cant find any online documentation on using the new topology commands
>
>
> thanks
6 years, 8 months