Christopher Lamb via FreeIPA-users wrote:
Hi All
Last night we successfully upgraded our ipa server to OEL 7.9, and
ipa-server-4.6.8-5.el7.
However the ipa.service will not start, because it fails at the NTP Service.
All other ipa components start if we use the --ignore-service-failures
option.
# ipactl start --ignore-service-failures
Existing service file detected!
Assuming stale, cleaning and proceeding
Starting Directory Service
Starting krb5kdc Service
Starting kadmin Service
Starting httpd Service
Starting ntpd Service
Failed to start ntpd Service
Forced start, ignoring ntpd Service, continuing normal operation
Starting pki-tomcatd Service
Starting ipa-otpd Service
I am ok with ntpd not starting, we have long since moved to chrony, and
have ntpd disabled and masked.
The question is, how do I configure our ipa-server to not use ntpd?
I am aware that there are options for ntpd on installation, but am
unsure how to do this for an existing server.
https://www.freeipa.org/page/V4/ntpd_deprecation/chronyd_support
Masking the service won't help because it is managed by ipactl. It
determines the list of services by looking in
cn=masters,cn=ipa,cn=etc,$SUFFIX
A entry looks like:
dn: cn=NTP,cn=ipa.example.test,cn=masters,cn=ipa,cn=etc,dc=example,dc=tes
t
objectClass: nsContainer
objectClass: ipaConfigObject
objectClass: top
cn: NTP
ipaConfigString: startOrder 45
ipaConfigString: enabledService
ipactl only looks at the startOrder of ipaConfigString. You'll need to
delete this entry entirely.
rob