Get this error when trying to restart ipa service on apparently not working replica.
This iscat /etc/redhat-releaseCentOS Linux release 7.3.1611
(Core)andipa-server-4.4.0-14.el7.centos.7.x86_64
and389-ds-base-1.3.5.10-20.el7_3.x86_64
ausearch -m avc -ts today<no matches>
slapd log shows the following
[22/Sep/2017:20:17:09.347682405 +0000] SSL alert: Sending pin request to SVRCore. You may
need to run systemd-tty-ask-password-agent to provide the
password.[22/Sep/2017:20:17:09.349071947 +0000] SSL alert: Security Initialization:
Enabling default cipher set.[22/Sep/2017:20:17:09.349375124 +0000] SSL alert: Configured
NSS Ciphers[22/Sep/2017:20:17:09.349563797 +0000] SSL alert:
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled[22/Sep/2017:20:17:09.349777578 +0000]
SSL alert: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
enabled[22/Sep/2017:20:17:09.350058874 +0000] SSL alert:
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled[22/Sep/2017:20:17:09.350253063 +0000]
SSL alert: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
enabled[22/Sep/2017:20:17:09.350444460 +0000] SSL alert:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled[22/Sep/2017:20:17:09.350701172 +0000] SSL
alert: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled[22/Sep/2017:20:17:09.350893090
+0000] SSL alert: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
enabled[22/Sep/2017:20:17:09.351072545 +0000] SSL alert:
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled[22/Sep/2017:20:17:09.351309052 +0000] SSL
alert: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled[22/Sep/2017:20:17:09.351583340
+0000] SSL alert: TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
enabled[22/Sep/2017:20:17:09.351769757 +0000] SSL alert:
TLS_DHE_DSS_WITH_AES_256_CBC_SHA: enabled[22/Sep/2017:20:17:09.351974981 +0000] SSL
alert: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled[22/Sep/2017:20:17:09.352164262
+0000] SSL alert: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
enabled[22/Sep/2017:20:17:09.352340685 +0000] SSL alert:
TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled[22/Sep/2017:20:17:09.352542263 +0000] SSL
alert: TLS_DHE_DSS_WITH_AES_128_CBC_SHA: enabled[22/Sep/2017:20:17:09.352733543
+0000] SSL alert: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
enabled[22/Sep/2017:20:17:09.352918881 +0000] SSL alert:
TLS_RSA_WITH_AES_256_GCM_SHA384: enabled[22/Sep/2017:20:17:09.353101704 +0000] SSL
alert: TLS_RSA_WITH_AES_256_CBC_SHA: enabled[22/Sep/2017:20:17:09.353281802 +0000]
SSL alert: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled[22/Sep/2017:20:17:09.353466924
+0000] SSL alert: TLS_RSA_WITH_AES_128_GCM_SHA256:
enabled[22/Sep/2017:20:17:09.353685045 +0000] SSL alert:
TLS_RSA_WITH_AES_128_CBC_SHA: enabled[22/Sep/2017:20:17:09.353892808 +0000] SSL alert:
TLS_RSA_WITH_AES_128_CBC_SHA256: enabled[22/Sep/2017:20:17:09.354107226 +0000] SSL
alert: TLS_AES_128_GCM_SHA256: enabled[22/Sep/2017:20:17:09.354318986 +0000] SSL
alert: TLS_CHACHA20_POLY1305_SHA256: enabled[22/Sep/2017:20:17:09.354531161 +0000]
SSL alert: TLS_AES_256_GCM_SHA384: enabled[22/Sep/2017:20:17:09.354740409 +0000] SSL
alert: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
enabled[22/Sep/2017:20:17:09.354935016 +0000] SSL alert:
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled[22/Sep/2017:20:17:09.355128927
+0000] SSL alert: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
enabled[22/Sep/2017:20:17:09.362744793 +0000] SSL Initialization - Configured SSL version
range: min: TLS1.0, max: TLS1.2[22/Sep/2017:20:17:09.363153851 +0000]
389-Directory/1.3.5.10 B2017.102.203 starting up[22/Sep/2017:20:17:09.374289379 +0000]
default_mr_indexer_create: warning - plugin [caseIgnoreIA5Match] does not handle
caseExactIA5Match[22/Sep/2017:20:17:09.381853474 +0000] WARNING: changelog: entry cache
size 2097152 B is less than db size 90570752 B; We recommend to increase the entry cache
size nsslapd-cachememsize.[22/Sep/2017:20:17:09.382628247 +0000] Detected Disorderly
Shutdown last time Directory Server was running, recovering
database.[22/Sep/2017:20:17:09.440619592 +0000] schema-compat-plugin - scheduled
schema-compat-plugin tree scan in about 5 seconds after the server
startup![22/Sep/2017:20:17:09.541575136 +0000] NSACLPlugin - The ACL target cn=automember
rebuild membership,cn=tasks,cn=config does not exist[22/Sep/2017:20:17:09.548822508 +0000]
dna-plugin - dna_parse_config_entry: Unable to locate shared configuration entry
(cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=company,dc=domain)[22/Sep/2017:20:17:09.549220205
+0000] dna-plugin - dna_parse_config_entry: Invalid config entry [cn=posix
ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config]
skipped[22/Sep/2017:20:17:09.566729598 +0000] schema-compat-plugin - schema-compat-plugin
tree scan will start in about 5 seconds![22/Sep/2017:20:17:09.575270590 +0000] slapd
started. Listening on All Interfaces port 389 for LDAP
requests[22/Sep/2017:20:17:09.575561870 +0000] Listening on All Interfaces port 636 for
LDAPS requests[22/Sep/2017:20:17:09.575772412 +0000] Listening on
/var/run/slapd-company-domain.socket for LDAPI requests[22/Sep/2017:20:17:09.855493846
+0000] slapd shutting down - signaling operation threads - op stack size 1 max work q size
1 max work q stack size 1[22/Sep/2017:20:17:09.856267729 +0000] slapd shutting down -
waiting for 27 threads to terminate[22/Sep/2017:20:17:09.856664101 +0000] slapd shutting
down - closing down domain subsystems and plugins[22/Sep/2017:20:17:14.572232152 +0000]
Waiting for 4 database threads to stop[22/Sep/2017:20:17:15.430730850 +0000] All database
threads now stopped[22/Sep/2017:20:17:15.448323210 +0000] slapd shutting down - freed 1
work q stack objects - freed 1 op stack objects[22/Sep/2017:20:17:15.580988368 +0000]
slapd stopped.
I found a mention of this
bug https://bugzilla.redhat.com/show_bug.cgi?id=996716
but it seems to be for older version of dirsrv then what we have installed.