Hello everyone,

We were using Freeipa on Fedora 24. And we are in the process to upgrade to Fedora 28.
We have a cluster of 2 nodes (freeipa-01 and freeipa-02).

I am trying to upgrade one server after the other, from one release to the next.

Basically:

freeipa-01 Fedora 24 -> Fedora 25

freeipa-02 Fedora 24 -> Fedora 25
freeipa-02 Fedora 25 -> Fedora 26

freeipa-01 Fedora 25 -> Fedora 26
freeipa-01 Fedora 26 -> Fedora 27

freeipa-02 Fedora 26 -> Fedora 27
freeipa-02 Fedora 27 -> Fedora 28

freeipa-01 Fedora 27 -> Fedora 28

Since Fedora doesn’t support to jump from one version to another, except one release at the time.

My idea is to check that once a server is upgraded, then everything is stable, before going to the next server, and try to be as near as possible from a version point of view between the 2 freeipa node cluster.

Today, I could upgrade without problems from Fedora 24 -> Fedora 25 on both nodes (freeipa-01 and freeipa-02).

In trying to upgrade to Fedora 26, I got some problems, the main problem is that the upgrade of ldap 389 is not successful, and the one from IPA either.
After investigating a long moment, I have found that ns-slapd listen only to IPv6, on UDP, and NOT on IPv4 and TCP.

Here is what I have:

[root@freeipa-02 lib]# lsof -Pni |grep slap
ns-slapd  21005    dirsrv    9u  IPv6 1617283379      0t0  UDP *:389
ns-slapd  21005    dirsrv   77u  IPv4 1617321218      0t0  TCP 10.100.0.102:60646->10.100.0.101:389 (ESTABLISHED)
ns-slapd  21005    dirsrv   81u  IPv4 1617317640      0t0  TCP 10.100.0.102:60648->10.100.0.101:389 (ESTABLISHED)


So, I decided to look at the file dse.ldif, and found that the entry "nsslapd-port” was set to “0” and no “nsslapd-listenhost” was not set at all.
I have then added the line

nsslapd-listenhost: 0.0.0.0

and changed the nsslapd-port to look like:

nsslap-port: 389

And after doing a 

systemctl stop dirsrv@DOM-LOCAL ; systemctl start dirsrv@DOM-LOCAL

No changes… all modification on my dse.ldif were gone.

I stopped again the dirsrv, did again my changes on dse.ldif, and run the following command:

/usr/sbin/ns-slapd -D /etc/dirsrv/slapd-DOM-LOCAL -i /var/run/dirsrv/slapd-DOM-LOCAL.pid

and now, I have the following:

[root@freeipa-02 updates]# lsof -Pni |grep 389
ns-slapd  78507    dirsrv   10u  IPv6 1681165214      0t0  UDP *:389
ns-slapd  78507    dirsrv   11u  IPv4 1681165216      0t0  TCP *:389 (LISTEN)
ns-slapd  78507    dirsrv  114u  IPv4 1684131928      0t0  TCP 10.100.0.102:389->10.100.0.110:36828 (ESTABLISHED)

So my questions are:
- how to change the dse.ldif file? 
- Is there another way to ensure that the port that listen is TCP / 389 on IPv4?
- Is there something that needs to be done between Fedora 25 and 26? Knowing that I will go to Fedora 28, is there something that I need to be aware of?
- Anything that can help me generally with my upgrade path?

Best regards,
Alessandro