Hi there,
I appear to be stuck in a failing upgrade.
On Rocky Linux 8.6. The server is one of 2 replicas, both CA and DNS servers.
ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
pki-tomcatd Service: STOPPED
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
1 service(s) are not running
and unable to go up again, with these errors:
SEVERE: LdapBoundConnFactory: Unable to connect to LDAP server: Authentication failed
netscape.ldap.LDAPException: Authentication failed (48)
Having read something about a similar issue being caused by nss 3.67 (the one installed in the system), I ran a dnf update (4.9.8-8 installed).
This actually complicated things, because now it still fails, but also it tries to upgrade every time it starts, failing the upgrade. As far as I can see in the upgrade log, The actual upgrade succeeds, but starting the services at the end fails, which makes the whole procedure fail.
So running ipactl restart --ignore-service-failures does not help, because the automatic upgrade fails and that stops all the services as a last step.
I'm not sure how I could continue, some pointer would be appreciated.
Errors I see now:
ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/
ipa02.hq.spinque.com@HQ.SPINQUE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm)
ldap_child[2130]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Cannot contact any KDC for realm '
HQ.SPINQUE.COM'. Unable to create GSSAPI-encrypted LDAP connection.
Thanks for your help,
Roberto