Hi Christian

Some things to check first:
Have you checked your times are in sync within 5 minutes?
Have you checked DNS is working for all node entries between all nodes?
Have you used ipactl [status|restart|stop]?
 -> Do you see certain services fail and have you checked their logs?


I'm hoping your remaining IPA server is the renewal master:

On remaining good server:
kinit admin
ipa config-show | grep "IPA CA renewal master"


If it is then the following rebuild instructions should be ok.
If it is not, then you prolly need some other advice (I haven't faced that situation yet ...)

I have recently rebuilt a couple of our IPA servers, the process I followed was:

On another ipa server:
ipa server-del <FQDN_of_ipa_to_be_deleted>

Then on deleted IPA server
ipa-server-install --uninstall

ipa-client-install
(with the standard options you use specific to your environment)

ipa-replica-install --principal admin --setup-ca --mkhomedir --no-ntp
(options above specific to my environment, check man page for suitable options)

In my environment, the IPAs to be rebuilt were responding, so you might hit some issues removing replica agreements (ipa server-del) with the state of 2 of your IPAs.

Regards
Angus


From: Christian Reiss via FreeIPA-users <freeipa-users@lists.fedorahosted.org>
Sent: 06 December 2019 14:24
To: freeipa-users@lists.fedorahosted.org <freeipa-users@lists.fedorahosted.org>
Cc: Christian Reiss <email@christian-reiss.de>
Subject: [Freeipa-users] No Login on GUI
 
Hey folks,

I am running a 4.6.5 (CentOS 7) Cluster containing out of 3 nodes.
Replication is working and I have been using it for nearly a year now.

Now, two issues arose. First on my first node, I can no longer login to
the WebUI, neither with password nor with Kerberos Login. I can login on
the 2nd node without any issues. Replication works, however (If I delete
a host on node1 it is replicated to node2, and creating a host on node2
will replicate to node1).

/var/log/httpd/* yields not usable errors. Login with password just says
"wrong password".

Second issue: My home server where node3 was running died. I have file
based backup, but several errors are flashing up, no good.
Can I simply replace the VM with a fresh one, re-attach it using the
same name and all is well? What would be the correct way to replace a node?

Thanks for your help,
Chris.

--
  Christian Reiss - email@christian-reiss.de         /"\  ASCII Ribbon
                    support@alpha-labs.net           \ /    Campaign
                                                      X   against HTML
  WEB alpha-labs.net                                 / \   in eMails

  GPG Retrieval https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgpg.christian-reiss.de&amp;data=02%7C01%7C%7C858fb3983cad4901a88c08d77a4f9f5b%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637112354703072684&amp;sdata=6xuCi5AgQjI6bIBxpFnXn%2FFrH7GKRLJCJ45SRTTgtpg%3D&amp;reserved=0
  GPG ID ABCD43C5, 0x44E29126ABCD43C5
  GPG fingerprint = 9549 F537 2596 86BA 733C  A4ED 44E2 9126 ABCD 43C5

  "It's better to reign in hell than to serve in heaven.",
                                           John Milton, Paradise lost.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedoraproject.org%2Fen-US%2Fproject%2Fcode-of-conduct%2F&amp;data=02%7C01%7C%7C858fb3983cad4901a88c08d77a4f9f5b%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637112354703072684&amp;sdata=FE0gknVRxyB6rhdhZHNyZy8m68FRQHJzgeV73pmtpww%3D&amp;reserved=0
List Guidelines: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedoraproject.org%2Fwiki%2FMailing_list_guidelines&amp;data=02%7C01%7C%7C858fb3983cad4901a88c08d77a4f9f5b%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637112354703072684&amp;sdata=y0%2Bh0kImW1xFFjrQXsnKNkvRobjGPNByAkmHo%2FzetQ0%3D&amp;reserved=0
List Archives: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fedorahosted.org%2Farchives%2Flist%2Ffreeipa-users%40lists.fedorahosted.org&amp;data=02%7C01%7C%7C858fb3983cad4901a88c08d77a4f9f5b%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637112354703072684&amp;sdata=P6TGFzzh6IaCeMH5ko5%2BeBltM%2FkyIlBaEaROvUSGz5E%3D&amp;reserved=0