Kat via FreeIPA-users wrote:
And now a new error if I just try to install as a simple replica with
no
CA or DNS :-(
Done configuring NTP daemon (ntpd).
Configuring directory server (dirsrv). Estimated time: 30 seconds
[1/40]: creating directory server instance
[error] RuntimeError: failed to create DS instance Command
'/usr/sbin/setup-ds.pl --silent --logfile - -f /tmp/tmpml5FQc' returned
non-zero exit status 1
Any ideas/suggestions on this one? Only ran "ipa-replica-install" after
client was installed and working. So frustrating since the other 4 have
been working flawlessly for months.
You have to look in ipareplica-install.log for details.
rob
-k
On 2/5/18 12:52, Simo Sorce wrote:
> I think this could be considered a bug, not sure if there is a ticket
> open already, but I think someone else reported something similar
> previously.
>
> Simo.
>
> On Mon, 2018-02-05 at 10:06 -0600, Kat wrote:
>> Yes, D is CA
>>
>> Firewalling is not 100% accurate. The masters are in different VPCs
>> across AWS AZ's. I use secure tunnels (stunnel) to connect the
>> master/replicas, which has worked fine for months. This is the 3rd VPC.
>> And in this case, rather than stunnel decided to peer the VPCs instead.
>>
>> They are all DNS servers too, but because of the unique VPCs, used
>> "location" settings to have DNS work properly (this works great BTW)
>>
>> -k
>>
>>
>> On 2/5/18 09:58, Simo Sorce wrote:
>>> On Sun, 2018-02-04 at 14:28 -0600, Kat via FreeIPA-users wrote:
>>>> This is a new one I have not seen before.
>>>>
>>>> Have 4 servers, trying to add a 5th.
>>>>
>>>> Master A and B (in one location) can talk to C and D (in another
>>>> location)
>>>>
>>>> Trying to add E, which is a new location with the master to replicate
>>>> from being D.
>>>>
>>>> When I run client install, no issues at all. Then I try to install
>>>> E as
>>>> a replica with DNS and CA setup and it gets almost all the way and
>>>> ends
>>>> up failing with (from the logs):
>>>>
>>>> 2018-02-04T20:00:56Z DEBUG The ipa-replica-install command failed,
>>>> exception: RuntimeError: Timed out trying to obtain keys.
>>>> 2018-02-04T20:00:56Z ERROR Timed out trying to obtain keys.
>>>>
>>>> It actually dies at:
>>>>
>>>> Done configuring ipa-otpd.
>>>> Configuring ipa-custodia
>>>> [1/4]: Generating ipa-custodia config file
>>>> [2/4]: Generating ipa-custodia keys
>>>> [3/4]: starting ipa-custodia
>>>> [4/4]: configuring ipa-custodia to start on boot
>>>> Done configuring ipa-custodia.
>>>> Your system may be partly configured.
>>>> Run /usr/sbin/ipa-server-install --uninstall to clean up.
>>>>
>>>> What is confusing, the log also shows that it times out waiting for
>>>> keys
>>>> to appear on "A", which it cannot get to because of
location/firewall
>>>> settings. What I don't understand, since I am building the replica
off
>>>> "D", why is it trying to communicate with A?
>>>>
>>>> Any ideas on how to resolve this?
>>> Is D a CA master ?
>>> I think the replica installation code picks the first master it can
>>> find, so it may be picking A (if that's a CA) in your case.
>>>
>>> What's the reason to firewall off masters from each other ?
>>>
>>> Simo.
>>>
>>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org