Actually, I wonder if this is related.

From journalctl -xe:

Jul 11 16:40:01 ipa.services.COMPANY audit[10280]: USER_ACCT pid=10280 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct="fedora" exe="/usr/sbin/cron
Jul 11 16:40:01 ipa.services.COMPANY audit[10280]: CRED_ACQ pid=10280 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_localuser,pam_unix acct="fedora" exe="/usr/sbin/crond" host
Jul 11 16:40:01 ipa.services.COMPANY crond[10280]: pam_systemd(crond:session): Failed to create session: Maximum number of sessions (8192) reached, refusing further sessions.
Jul 11 16:40:01 ipa.services.COMPANY audit[10280]: USER_START pid=10280 uid=0 auid=1000 ses=28963 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_sss acct="fedora" exe="/usr/sbin/cr
Jul 11 16:40:01 ipa.services.COMPANY audit[10280]: CRED_REFR pid=10280 uid=0 auid=1000 ses=28963 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_localuser,pam_unix acct="fedora" exe="/usr/sbin/crond" hostname=? add
Jul 11 16:40:01 ipa.services.COMPANY CROND[10282]: (fedora) CMD (cd /opt/cleanup && /opt/cleanup/venv/bin/python host-cleanup.py >> /var/log/cron)

Think that's connected? Is there some reason that would happen?

- greg

On 2018-07-11 13:19, None via FreeIPA-users wrote:

Hey,

Sorry for the delay, I couldn't reproduce the issue at the time, but it's happening now.

Yes, gssproxy is running:

# systemctl status gssproxy.service
● gssproxy.service - GSSAPI Proxy Daemon
   Loaded: loaded (/usr/lib/systemd/system/gssproxy.service; disabled; vendor preset: disabled)
   Active: active (running) since Thu 2018-03-15 17:08:17 UTC; 3 months 26 days ago
 Main PID: 24938 (gssproxy)
    Tasks: 6 (limit: 4915)
   CGroup: /system.slice/gssproxy.service
           └─24938 /usr/sbin/gssproxy -D

I also have a /etc/gssproxy/10-ipa.conf proxy file - I saw that come up in another thread.

- greg

On 2018-06-22 08:40, Florence Blanc-Renaud via FreeIPA-users wrote:

On 06/21/2018 06:05 PM, None via FreeIPA-users wrote:
Hey everyone: I posted this like a week ago and didn't get a response. Hoping someone can respond, since it's happened to us again. Any ideas?


On 2018-06-12 10:58, greg@greg-gilbert.com wrote:


Hi all,

I've been having an issue recently where my servers can't install FreeIPA due to this error:

Cannot connect to the server due to generic error: error marshalling data for XML-RPC transport: message: need a <type 'unicode'>; got 'No valid Negotiate header in server response' (a <type 'str'>)
Installation failed. Rolling back changes.
Unenrolling client from IPA server

Restarting FreeIPA (ipactl stop, ipactl start) solves the solution, but not permanently.

I captured the FreeIPA logs during that event, which you can see here: https://pastebin.com/WL7Cg90V

Any ideas what's going wrong? One solution would be to have a cron restart FreeIPA nightly, but that's not ideal.
Hi,

is the gssproxy service running?
# systemctl status gssproxy

Flo

Thanks,
Greg



_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/message/XMIC5H7JXMRN4PYOH4EKSLXSJOLUGQA3/
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/message/ZP2OOYZWQ2CWF32466Z2VTTGMGI5IMQR/



_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/message/S46OLKLCK3VKAQP2DI7ALWVQTRZMBFHI/