September 2021 - FreeIPA-users - Fedora mailing-lists

domain attribute
by Ciro Iriarte 09 Sep '21

09 Sep '21

Good afternoon, I'm looking for integrating VMware Identity Manager with FreeIPA and it looks better than vCenter so far because there are options to customize filters and map attributes. The only missing bit seems to be the "domain" attribute that vIDM expects to be present in users & groups. Would that be something that can be accommodated with the stock schemas?, I can not find any reference to it. Regards, CI.-

2 6

Re: Why is ipa-ods-exporter broken after running ipa-dns-install? (Was - Unable to start directory server after updates)
by Florence Renaud 08 Sep '21

08 Sep '21

Hi Jeremy, to enable debugging you can simply create /etc/ipa/server.conf if the file does not exist: # cat /etc/ipa/server.conf [global] debug=True # systemctl restart httpd The HTTPd certificate is stored in /var/lib/ipa/certs/httpd.crt, you can examine its content with # openssl x509 -noout -text -in /var/lib/ipa/certs/httpd.crt If the IPA deployment includes an embedded CA, the CA that issued the httpd cert is stored in /etc/ipa/ca.crt and can also be checked with openssl command. flo On Tue, Sep 7, 2021 at 6:09 PM Jeremy Tourville < jeremy_tourville(a)hotmail.com> wrote: > I think I see the issue but I am unsure what to do to fix it. See below. > > To answer your question, yes I did accept the security exception. > > Also, I don't see a server.conf file at /etc/ipa so that I may enable > debugging. What can you suggest for this issue? > > > [root@utility ~]# ipactl status > Directory Service: RUNNING > krb5kdc Service: RUNNING > kadmin Service: RUNNING > named Service: RUNNING > httpd Service: RUNNING > ipa-custodia Service: RUNNING > pki-tomcatd Service: RUNNING > smb Service: RUNNING > winbind Service: RUNNING > ipa-otpd Service: RUNNING > ipa-ods-exporter Service: STOPPED > ods-enforcerd Service: RUNNING > ipa-dnskeysyncd Service: RUNNING > ipa: INFO: The ipactl command was successful > > [root@utility ~]# kinit admin > Password for admin(a)IDM.NAC-ISSA.ORG: > > [root@utility ~]# klist > Ticket cache: KCM:0:43616 > Default principal: admin(a)IDM.NAC-ISSA.ORG > > Valid starting Expires Service principal > 09/07/2021 10:59:23 09/08/2021 10:09:04 krbtgt/ > IDM.NAC-ISSA.ORG(a)IDM.NAC-ISSA.ORG > > [root@utility ~]# ipa config-show > ipa: ERROR: cannot connect to 'https://utility.idm.nac-issa.org/ipa/json': > [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897) > > > ------------------------------ > *From:* Florence Renaud <flo(a)redhat.com> > *Sent:* Tuesday, September 7, 2021 10:47 AM > *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > *Cc:* Jeremy Tourville <jeremy_tourville(a)hotmail.com> > *Subject:* Re: [Freeipa-users] Re: Why is ipa-ods-exporter broken after > running ipa-dns-install? (Was - Unable to start directory server after > updates) > > Hi Jeremy, > Did you accept the security exception displayed by the browser (I'm > trying to eliminate obvious issues)? > If nothing is displayed, can you check if ipa command-line is working as > expected (for instance do "kinit admin; ipa config-show")? > You may want to enable debug logs (add debug=True to the [global] section > of /etc/ipa/server.conf and restart httpd service), retry WebUI > authentication and check the generated logs in /var/log/http/error_log > > flo > > On Tue, Sep 7, 2021 at 2:01 PM Jeremy Tourville via FreeIPA-users < > freeipa-users(a)lists.fedorahosted.org> wrote: > > OK, > Why don't I see anything on the initial login page? > All I see is the URL and the fact that the certificate is not trusted. > The certificate is not expired yet. Not until Nov 2021. > The login in page is mostly solid white with no login or password field. > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure > >

2 2

freeIPA Status Debian/Ubuntu
by Nico Maas 08 Sep '21

08 Sep '21

Hello there, with the decline of CentOS I need to migrate away from CentOS 8 to something different. I just wanted to ask how currently the status of the Debian or Ubuntu versions of freeIPA is - and if there is any possibility to migrate freeIPA installation / "backup and restore"? Best regards, Nico

10 14

dogtag-ipa-ca-renew-agent-submit: Updated certificate not available
by Russell Jones 07 Sep '21

07 Sep '21

Hi all, I have a replica that, while offline due to maintenance, some certificates appear to have been auto renewed. Upon bringing the node back online the ipa-healthcheck script showed several errors that were fixed by re-initializing the replica. However, the following errors were not fixed by reinitializing: [root@freeipa4 ~]# ipa-healthcheck --output-type human --failures-only | grep -v ipahealthcheck.ipa.idns WARNING: ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20200130170451: Request id 20200130170451 expires in 26 days WARNING: ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20200130170452: Request id 20200130170452 expires in 26 days WARNING: ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20200130170453: Request id 20200130170453 expires in 26 days WARNING: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20200130170451: Request id 20200130170451 expires in 26 days WARNING: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20200130170452: Request id 20200130170452 expires in 26 days WARNING: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20200130170453: Request id 20200130170453 expires in 26 days When I try to use getcert resubmit, it shows either: freeipa4 dogtag-ipa-ca-renew-agent-submit: Updated certificate not available or freeipa4 certmonger: 2021-09-02 15:43:15 [1264] Invalid cookie: u'' Any ideas on how to get this guy healthy again? Thanks!

2 4

Re: Why is ipa-ods-exporter broken after running ipa-dns-install? (Was - Unable to start directory server after updates)
by Jeremy Tourville 07 Sep '21

07 Sep '21

Disregard this part >>>Also, I don't see a server.conf file at /etc/ipa so that I may enable debugging. What can you suggest for this issue? The file is /etc/ipa/default.conf. I should have looked before replying. I have uploaded the httpd error_log to pastebin for review. https://pastebin.com/RpK5EZQr ________________________________ From: Jeremy Tourville <jeremy_tourville(a)hotmail.com> Sent: Tuesday, September 7, 2021 11:09 AM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Florence Renaud <flo(a)redhat.com> Subject: Re: [Freeipa-users] Re: Why is ipa-ods-exporter broken after running ipa-dns-install? (Was - Unable to start directory server after updates) I think I see the issue but I am unsure what to do to fix it. See below. To answer your question, yes I did accept the security exception. Also, I don't see a server.conf file at /etc/ipa so that I may enable debugging. What can you suggest for this issue? [root@utility ~]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING smb Service: RUNNING winbind Service: RUNNING ipa-otpd Service: RUNNING ipa-ods-exporter Service: STOPPED ods-enforcerd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful [root@utility ~]# kinit admin Password for admin(a)IDM.NAC-ISSA.ORG: [root@utility ~]# klist Ticket cache: KCM:0:43616 Default principal: admin(a)IDM.NAC-ISSA.ORG Valid starting Expires Service principal 09/07/2021 10:59:23 09/08/2021 10:09:04 krbtgt/IDM.NAC-ISSA.ORG(a)IDM.NAC-ISSA.ORG [root@utility ~]# ipa config-show ipa: ERROR: cannot connect to 'https://utility.idm.nac-issa.org/ipa/json': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897) ________________________________ From: Florence Renaud <flo(a)redhat.com> Sent: Tuesday, September 7, 2021 10:47 AM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Jeremy Tourville <jeremy_tourville(a)hotmail.com> Subject: Re: [Freeipa-users] Re: Why is ipa-ods-exporter broken after running ipa-dns-install? (Was - Unable to start directory server after updates) Hi Jeremy, Did you accept the security exception displayed by the browser (I'm trying to eliminate obvious issues)? If nothing is displayed, can you check if ipa command-line is working as expected (for instance do "kinit admin; ipa config-show")? You may want to enable debug logs (add debug=True to the [global] section of /etc/ipa/server.conf and restart httpd service), retry WebUI authentication and check the generated logs in /var/log/http/error_log flo On Tue, Sep 7, 2021 at 2:01 PM Jeremy Tourville via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> wrote: OK, Why don't I see anything on the initial login page? All I see is the URL and the fact that the certificate is not trusted. The certificate is not expired yet. Not until Nov 2021. The login in page is mostly solid white with no login or password field. _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

1 0

Why is ipa-ods-exporter broken after running ipa-dns-install? (Was - Unable to start directory server after updates)
by Jeremy Tourville 07 Sep '21

07 Sep '21

I have made some progress since my last post which was entitled " Unable to start directory server after updates" A little background- this server was running as the master for over a year and was integrated with Active Directory. AFAIK, all DNS was setup properly, otherwise how could you integrate with AD without having DNS setup properly? #rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server package freeipa-server is not installed package freeipa-client is not installed ipa-server-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64 ipa-client-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64 389-ds-base-1.4.3.16-19.module_el8.4.0+884+e9b25896.x86_64 pki-ca-10.10.5-3.module_el8.4.0+816+beb6e9a3.noarch krb5-server-1.18.2-8.el8.x86_64 Here are the steps i have taken so far- 1.Centos was updated from 8.2 to 8.4.2105 and now the problems began 2. Directory Server would not start so.. 3. IPA was updated/ugraded from 4.8.4 to 4.9.2 (successfully) 4. Directory server now worked not but named-pkcs11 service would not start. 5. Ipactl start -f reported that ipa-dnskeysyncd was started when actually it was having issues. A review of journal logs after turning on some debugging revealed that- The unit ipa-dnskeysyncd.service has entered the 'failed' state with result 'exit-code'. 6. At this point I found someone who was able to fix the ipa-dnskeysyncd by running ipa-dns-install again. 7. named-pkcs11 and ipa-dnskeysyncd are now fixed but ipa-ods-exporter is now broken after this install See the install sequence below: [root@utility ipa]# ipa-dns-install --dnssec-master The log file for this installation can be found in /var/log/ipaserver-dns-install.log ============================================================================== This program will setup DNS for the IPA Server. This includes: * Configure DNS (bind) * Configure SoftHSM (required by DNSSEC) * Configure ipa-dnskeysyncd (required by DNSSEC) * Configure ipa-ods-exporter (required by DNSSEC key master) * Configure OpenDNSSEC (required by DNSSEC key master) * Generate DNSSEC master key (required by DNSSEC key master) NOTE: DNSSEC zone signing is not enabled by default Plan carefully, replacing DNSSEC key master is not recommended To accept the default shown in brackets, press the Enter key. Do you want to setup this IPA server as DNSSEC key master? [no]: yes Do you want to configure DNS forwarders? [yes]: Following DNS servers are configured in /etc/resolv.conf: 127.0.0.1 Do you want to configure these servers as DNS forwarders? [yes]: no Enter an IP address for a DNS forwarder, or press Enter to skip: 172.30.50.10 DNS forwarder 172.30.50.10 added. You may add another. Enter an IP address for a DNS forwarder, or press Enter to skip: DNS forwarders: 172.30.50.10 Checking DNS forwarders, please wait ... Do you want to search for missing reverse zones? [yes]: The following operations may take some minutes to complete. Please wait until the prompt is returned. Configuring DNS (named) [1/8]: generating rndc key file [2/8]: setting up our own record [3/8]: adding NS record to the zones [4/8]: setting up kerberos principal [5/8]: setting up named.conf [6/8]: setting up server configuration [7/8]: configuring named to start on boot [8/8]: changing resolv.conf to point to ourselves Done configuring DNS (named). Restarting the web server to pick up resolv.conf changes Configuring DNS key synchronization service (ipa-dnskeysyncd) [1/7]: checking status [2/7]: setting up bind-dyndb-ldap working directory [3/7]: setting up kerberos principal [4/7]: setting up SoftHSM [5/7]: adding DNSSEC containers [6/7]: creating replica keys [7/7]: configuring ipa-dnskeysyncd to start on boot Done configuring DNS key synchronization service (ipa-dnskeysyncd). Configuring IPA OpenDNSSEC exporter daemon (ipa-ods-exporter) [1/5]: setting up DNS Key Exporter [2/5]: setting up kerberos principal [3/5]: disabling default signer daemon [4/5]: starting DNS Key Exporter [5/5]: configuring DNS Key Exporter to start on boot Done configuring IPA OpenDNSSEC exporter daemon (ipa-ods-exporter). Configuring OpenDNSSEC enforcer daemon (ods-enforcerd) [1/7]: setting up configuration files [2/7]: setting up ownership and file mode bits [3/7]: generating master key [4/7]: setting up OpenDNSSEC [5/7]: setting up ipa-dnskeysyncd [6/7]: starting OpenDNSSEC enforcer [7/7]: configuring OpenDNSSEC enforcer to start on boot Done configuring OpenDNSSEC enforcer daemon (ods-enforcerd). Restarting ipa-dnskeysyncd Restarting named Updating DNS system records ============================================================================== Setup complete Global DNS configuration in LDAP server is empty You can use 'dnsconfig-mod' command to set global DNS options that would override settings in local named.conf files You must make sure these network ports are open: TCP Ports: * 53: bind UDP Ports: * 53: bind [root@utility ipa]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING smb Service: RUNNING winbind Service: RUNNING ipa-otpd Service: RUNNING ipa-ods-exporter Service: STOPPED ods-enforcerd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful [root@utility ipa]# ipactl start Existing service file detected! Assuming stale, cleaning and proceeding Starting Directory Service Starting krb5kdc Service Starting kadmin Service Starting named Service Starting httpd Service Starting ipa-custodia Service Starting pki-tomcatd Service Starting smb Service Starting winbind Service Starting ipa-otpd Service Starting ipa-ods-exporter Service Starting ods-enforcerd Service Starting ipa-dnskeysyncd Service ipa: INFO: The ipactl command was successful [root@utility ipa]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING smb Service: RUNNING winbind Service: RUNNING ipa-otpd Service: RUNNING ipa-ods-exporter Service: RUNNING ods-enforcerd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful [root@utility ipa]# ipactl stop Stopping ipa-dnskeysyncd Service Stopping ods-enforcerd Service Stopping ipa-ods-exporter Service Stopping ipa-otpd Service Stopping winbind Service Stopping smb Service Stopping pki-tomcatd Service Stopping ipa-custodia Service Stopping httpd Service Stopping named Service Stopping kadmin Service Stopping krb5kdc Service Stopping Directory Service ipa: INFO: The ipactl command was successful [root@utility ipa]# ipactl start Starting Directory Service Starting krb5kdc Service Starting kadmin Service Starting named Service Starting httpd Service Starting ipa-custodia Service Starting pki-tomcatd Service Starting smb Service Starting winbind Service Starting ipa-otpd Service Starting ipa-ods-exporter Service Starting ods-enforcerd Service Starting ipa-dnskeysyncd Service ipa: INFO: The ipactl command was successful [root@utility ipa]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING smb Service: RUNNING winbind Service: RUNNING ipa-otpd Service: RUNNING ipa-ods-exporter Service: STOPPED ods-enforcerd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful [root@utility log]# systemctl status ipa-ods-exporter ● ipa-ods-exporter.service - IPA OpenDNSSEC Signer replacement Loaded: loaded (/usr/lib/systemd/system/ipa-ods-exporter.service; disabled; vendor preset: disabled) Active: inactive (dead) since Sun 2021-09-05 05:55:32 CDT; 8min ago Process: 5089 ExecStart=/usr/libexec/ipa/ipa-ods-exporter (code=exited, status=0/SUCCESS) Main PID: 5089 (code=exited, status=0/SUCCESS) Sep 05 05:55:32 utility.idm.nac-issa.org ipa-ods-exporter[5089]: ipa-ods-exporter: DEBUG new zone keys in local HSM: set() Sep 05 05:55:32 utility.idm.nac-issa.org ipa-ods-exporter[5089]: ipa-ods-exporter: INFO master2ldap_zone_keys: keys in local HSM & LDAP: > Sep 05 05:55:32 utility.idm.nac-issa.org ipa-ods-exporter[5089]: ipa-ods-exporter: INFO master2ldap_zone_keys: keys in local HSM & LDAP: > Sep 05 05:55:32 utility.idm.nac-issa.org ipa-ods-exporter[5089]: ipa-ods-exporter: DEBUG accepting new connection Sep 05 05:55:32 utility.idm.nac-issa.org ipa-ods-exporter[5089]: ipa-ods-exporter: DEBUG accepted new connection <ipaserver.dnssec._ods21.> Sep 05 05:55:32 utility.idm.nac-issa.org ipa-ods-exporter[5089]: ipa-ods-exporter: DEBUG received command "ipa-hsm-update" from systemd so> Sep 05 05:55:32 utility.idm.nac-issa.org ipa-ods-exporter[5089]: ipa-ods-exporter: DEBUG parse_command returned msg: HSM synchronization f> Sep 05 05:55:32 utility.idm.nac-issa.org ipa-ods-exporter[5089]: ipa-ods-exporter: DEBUG parse_command returned cmd: ipa-hsm-update Sep 05 05:55:32 utility.idm.nac-issa.org ipa-ods-exporter[5089]: ipa-ods-exporter: INFO HSM synchronization finished, skipping zone synch> Sep 05 05:55:32 utility.idm.nac-issa.org systemd[1]: ipa-ods-exporter.service: Succeeded. [root@utility log]# systemctl start ipa-ods-exporter [root@utility log]# systemctl status ipa-ods-exporter ● ipa-ods-exporter.service - IPA OpenDNSSEC Signer replacement Loaded: loaded (/usr/lib/systemd/system/ipa-ods-exporter.service; disabled; vendor preset: disabled) Active: active (running) since Sun 2021-09-05 06:05:05 CDT; 2s ago Main PID: 5170 (ipa-ods-exporte) Tasks: 1 (limit: 37317) Memory: 72.8M CGroup: /system.slice/ipa-ods-exporter.service └─5170 /usr/libexec/platform-python -I /usr/libexec/ipa/ipa-ods-exporter Sep 05 06:05:07 utility.idm.nac-issa.org ipa-ods-exporter[5170]: ipa-ods-exporter: DEBUG enabled replica key ids: {'0xa75863f538583b5d6d74> Sep 05 06:05:07 utility.idm.nac-issa.org ipa-ods-exporter[5170]: ipa-ods-exporter: DEBUG processing master key data: 0xd2c3520e317cf8ae4b1> Sep 05 06:05:07 utility.idm.nac-issa.org ipa-ods-exporter[5170]: ipa-ods-exporter: DEBUG master key 0xd2c3520e317cf8ae4b1194a52a3c2e1b is > Sep 05 06:05:07 utility.idm.nac-issa.org ipa-ods-exporter[5170]: ipa-ods-exporter: DEBUG processing master key data: 0x284dcba6251d8d68f46> Sep 05 06:05:07 utility.idm.nac-issa.org ipa-ods-exporter[5170]: ipa-ods-exporter: DEBUG master key 0x284dcba6251d8d68f464e447537f3bb0 is > Sep 05 06:05:07 utility.idm.nac-issa.org ipa-ods-exporter[5170]: ipa-ods-exporter: DEBUG zone keys in LDAP: set() Sep 05 06:05:07 utility.idm.nac-issa.org ipa-ods-exporter[5170]: ipa-ods-exporter: DEBUG zone keys in local HSM: set() Sep 05 06:05:07 utility.idm.nac-issa.org ipa-ods-exporter[5170]: ipa-ods-exporter: DEBUG new zone keys in local HSM: set() Sep 05 06:05:07 utility.idm.nac-issa.org ipa-ods-exporter[5170]: ipa-ods-exporter: INFO master2ldap_zone_keys: keys in local HSM & LDAP: > Sep 05 06:05:07 utility.idm.nac-issa.org ipa-ods-exporter[5170]: ipa-ods-exporter: INFO master2ldap_zone_keys: keys in local HSM & LDAP: > [root@utility log]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING smb Service: RUNNING winbind Service: RUNNING ipa-otpd Service: RUNNING ipa-ods-exporter Service: RUNNING ods-enforcerd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful [root@utility log]# systemctl status ipa-ods-exporter ● ipa-ods-exporter.service - IPA OpenDNSSEC Signer replacement Loaded: loaded (/usr/lib/systemd/system/ipa-ods-exporter.service; disabled; vendor preset: disabled) Active: activating (auto-restart) (Result: exit-code) since Sun 2021-09-05 06:06:12 CDT; 7s ago Process: 5316 ExecStart=/usr/libexec/ipa/ipa-ods-exporter (code=exited, status=1/FAILURE) Main PID: 5316 (code=exited, status=1/FAILURE) [root@utility log]# systemctl start ipa-ods-exporter [root@utility log]# systemctl status ipa-ods-exporter ● ipa-ods-exporter.service - IPA OpenDNSSEC Signer replacement Loaded: loaded (/usr/lib/systemd/system/ipa-ods-exporter.service; disabled; vendor preset: disabled) Active: activating (auto-restart) (Result: exit-code) since Sun 2021-09-05 06:07:15 CDT; 3s ago Process: 5330 ExecStart=/usr/libexec/ipa/ipa-ods-exporter (code=exited, status=1/FAILURE) Main PID: 5330 (code=exited, status=1/FAILURE) [root@utility log]# systemctl stop ipa-ods-exporter Warning: Stopping ipa-ods-exporter.service, but it can still be activated by: ipa-ods-exporter.socket [root@utility log]# systemctl start ipa-ods-exporter.socket [root@utility log]# systemctl status ipa-ods-exporter ● ipa-ods-exporter.service - IPA OpenDNSSEC Signer replacement Loaded: loaded (/usr/lib/systemd/system/ipa-ods-exporter.service; disabled; vendor preset: disabled) Active: inactive (dead) (Result: exit-code) since Sun 2021-09-05 06:08:09 CDT; 37s ago Process: 5330 ExecStart=/usr/libexec/ipa/ipa-ods-exporter (code=exited, status=1/FAILURE) Main PID: 5330 (code=exited, status=1/FAILURE) Sep 05 06:08:09 utility.idm.nac-issa.org systemd[1]: Stopped IPA OpenDNSSEC Signer replacement. [root@utility log]# systemctl start ipa-ods-exporter [root@utility log]# systemctl status ipa-ods-exporter ● ipa-ods-exporter.service - IPA OpenDNSSEC Signer replacement Loaded: loaded (/usr/lib/systemd/system/ipa-ods-exporter.service; disabled; vendor preset: disabled) Active: activating (auto-restart) (Result: exit-code) since Sun 2021-09-05 06:09:01 CDT; 169ms ago Process: 5348 ExecStart=/usr/libexec/ipa/ipa-ods-exporter (code=exited, status=1/FAILURE) Main PID: 5348 (code=exited, status=1/FAILURE) [root@utility log]# journalctl -xe Sep 05 06:09:03 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'mirrors.vcea.wsu.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: validating mirror.vcu.edu/CNAME: bad cache hit (edu/DS) Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'mirror.vcu.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: validating mirrors.cmich.edu/A: bad cache hit (edu/DS) Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'mirrors.cmich.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: validating mirrors.lug.mtu.edu/A: bad cache hit (edu/DS) Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'mirrors.lug.mtu.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: *validating edu/DNSKEY: bad cache hit (edu/DS) Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'mirror.cs.pitt.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: validating edu/DNSKEY: bad cache hit (edu/DS) Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'bay.uchicago.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: validating centos.s.uw.edu/CNAME: bad cache hit (edu/DS) Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'centos.s.uw.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: validating ftp.usf.edu/A: bad cache hit (edu/DS) Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'ftp.usf.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: validating mirrors.vcea.wsu.edu/A: bad cache hit (edu/DS) Sep 05 06:09:06 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'mirrors.vcea.wsu.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: validating gnome.org/DNSKEY: bad cache hit (gnome.org/DS) Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: validating gnome.org/DNSKEY: bad cache hit (gnome.org/DS) Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'extensions.gnome.org/AAAA/IN': 172.30.50.10#53 Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'extensions.gnome.org/A/IN': 172.30.50.10#53 Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: validating mirror.vcu.edu/CNAME: bad cache hit (edu/DS) Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'mirror.vcu.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: validating mirrors.cmich.edu/A: bad cache hit (edu/DS) Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'mirrors.cmich.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: *validating edu/DNSKEY: bad cache hit (edu/DS) Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'mirror.cs.pitt.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: validating mirrors.lug.mtu.edu/A: bad cache hit (edu/DS) Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: validating edu/DNSKEY: bad cache hit (edu/DS) Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'mirrors.lug.mtu.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:10 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'bay.uchicago.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:11 utility.idm.nac-issa.org named-pkcs11[4487]: validating ftp.usf.edu/A: bad cache hit (edu/DS) Sep 05 06:09:11 utility.idm.nac-issa.org named-pkcs11[4487]: validating centos.s.uw.edu/CNAME: bad cache hit (edu/DS) Sep 05 06:09:11 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'ftp.usf.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:11 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'centos.s.uw.edu/A/IN': 172.30.50.10#53 Sep 05 06:09:11 utility.idm.nac-issa.org named-pkcs11[4487]: validating mirrors.vcea.wsu.edu/A: bad cache hit (edu/DS) Sep 05 06:09:11 utility.idm.nac-issa.org named-pkcs11[4487]: broken trust chain resolving 'mirrors.vcea.wsu.edu/A/IN': 172.30.50.10#53 [root@utility log]# reboot

2 6

Waiting for CA subsystem to start
by MERCIER Jonathan 06 Sep '21

06 Sep '21

Dear, On Rocky Linux 8.4 I fail to install ipa server, firstly I encounter the issue describe here: https://lists.fedorahosted.org/archives/list/tfreeipa-users@lists.fedorahos… So as workaround I have removed these two lines from /etc/crypto-policies/back-ends/nss.config: name=p11-kit-proxy library=p11-kit-proxy.so And I have downgrade 389-ds-base: dnf downgrade -y 389-ds-base With this workaround I getting rid of the error: --> usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock while evrything seemms to be fine the command `ipa-server-install` end with a timeout ----> waiting for CA subsystem to start I checked I see any error with this command: find /var/log/pki/pki-tomcat -name '*.log' | xargs cat And both pkcsslotd, pki-tomcatd@pki-tomcat servicess seems to run without error. Any help are welcome Thanks a lot

5 10

Update link on directory server troubleshooting page
by Simon Keng 02 Sep '21

02 Sep '21

Hello, I found the "Directory server tuning" link directs to a RedHat page with a 404 https://www.freeipa.org/page/Troubleshooting/Directory_Server The broken link is: https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.2/… Would someone mind pointing me to the relevant page? Sincerely, *Simon Keng* | Software Developer, Core Infrastructure [image: Schrodinger Logo] <https://www.schrodinger.com/>

2 1

Upgrade FreeIPA cluster from v4.6 (el7) to v4.9 (el8)
by Mikhail Kiselev 02 Sep '21

02 Sep '21

Hello, how can I update the cluster specified in the subject without data loss and service downtime? I raised the host from EL8 and ran ipa-replica-install. Log output: Configuring directory server (dirsrv). Estimated time: 30 seconds [1/38]: creating directory server instance [2/38]: tune ldbm plugin [3/38]: adding default schema [4/38]: enabling memberof plugin [5/38]: enabling winsync plugin [6/38]: configure password logging [7/38]: configuring replication version plugin [8/38]: enabling IPA enrollment plugin [9/38]: configuring uniqueness plugin [10/38]: configuring uuid plugin [11/38]: configuring modrdn plugin [12/38]: configuring DNS plugin [13/38]: enabling entryUSN plugin [14/38]: configuring lockout plugin [15/38]: configuring topology plugin [16/38]: creating indices [17/38]: enabling referential integrity plugin [18/38]: configuring certmap.conf [19/38]: configure new location for managed entries [20/38]: configure dirsrv ccache and keytab [21/38]: enabling SASL mapping fallback [22/38]: restarting directory server [23/38]: creating DS keytab [24/38]: ignore time skew for initial replication [25/38]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 11676 seconds elapsed tail -f /var/log/dirsrv/slapd-OPENTECH-LOCAL/access [02/Sep/2021:20:09:48.282984535 +0700] conn=84 op=6 SRCH base="cn=schema" scope=0 filter="(objectClass=*)" attrs="objectClasses" [02/Sep/2021:20:09:48.366825074 +0700] conn=84 op=6 RESULT err=0 tag=101 nentries=1 wtime=0.000158968 optime=0.083844272 etime=0.083999242 [02/Sep/2021:20:09:48.368297195 +0700] conn=84 op=7 SRCH base="cn=schema" scope=0 filter="(objectClass=*)" attrs="attributeTypes" [02/Sep/2021:20:09:48.455352207 +0700] conn=84 op=7 RESULT err=0 tag=101 nentries=1 wtime=0.000181242 optime=0.087049680 etime=0.087227596 [02/Sep/2021:20:09:48.598806315 +0700] conn=84 op=8 SRCH base="cn=schema" scope=0 filter="(objectClass=*)" attrs="objectClasses" [02/Sep/2021:20:09:48.682435023 +0700] conn=84 op=8 RESULT err=0 tag=101 nentries=1 wtime=0.000253118 optime=0.083640981 etime=0.083890259 [02/Sep/2021:20:09:48.683959959 +0700] conn=84 op=9 SRCH base="cn=schema" scope=0 filter="(objectClass=*)" attrs="attributeTypes" [02/Sep/2021:20:09:48.770110056 +0700] conn=84 op=9 RESULT err=0 tag=101 nentries=1 wtime=0.000208691 optime=0.086154930 etime=0.086360171 [02/Sep/2021:20:09:48.909866069 +0700] conn=84 op=10 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [02/Sep/2021:20:09:48.912490317 +0700] conn=84 op=10 RESULT err=0 tag=120 nentries=0 wtime=0.000289908 optime=0.002650238 etime=0.002936579 Am I doing the right thing and how long will the replica take to rise?

1 0

Re: Unable to start directory server after updates
by Rob Crittenden 01 Sep '21

01 Sep '21

Jeremy Tourville wrote: > Hi Flo, yes, I agree selinux appeared to be the issue initially but > after I set it to disabled and rebooted the named-pkcs11 service still > would not start. > > As I stated in my previous post, I ****think**** this might be the > issue- Can you confirm? > > It looks like I need to troubleshoot section 4 further, auth_method, > sasl_mech, sasl_user, all seem to be present in my /etc/named.conf file. > I was unable to find bind_dn, password, sasl_realm, sasl_password and > krb5_principal. > > I know the account used to do ldap lookups. That would be the bind_dn, > correct? > I am not sure that I know the sasl_realm, sasl_password and > krb5_principal, maybe there are some context clues in other files? What is in your configuration is sufficient for the type of authentication being used. I suspect start startup failures may be related to the p11-kit changes you made. Can you try reverting them? softhsm is used to store the DNSSEC keys. I see this in your log: > initializing DST: PKCS#11 initialization failed rob > > #less /etc/named.conf > // If not explicitly set, the ACLs for "allow-query-cache" and > // "allow-recursion" are set to "localnets; localhost;". > // If either "allow-query-cache" or "allow-r > ecursion" is set, > // the other would be set the same value. > // Please refer to /etc/named[root@utility data]# cat /etc/named.conf > options { > // turns on IPv6 for port 53, IPv4 is on by default for all ifaces > #listen-on-v6 {any;}; > > // Put files that named is allowed to write in the data/ directory: > directory "/var/named"; // the default > dump-file "data/cache_dump.db"; > statistics-file "data/named_stats.txt"; > memstatistics-file "data/named_mem_stats.txt"; > > /ipa-ext.conf > // for more information > tkey-gssapi-keytab "/etc/named.keytab"; > pid-file "/run/named/named.pid"; > > dnssec-enable yes; > dnssec-validation yes; > > /* Path to ISC DLV key */ > bindkeys-file "/etc/named.iscdlv.key"; > > managed-keys-directory "/var/named/dynamic"; > > /* crypto policy snippet on platforms with system-wide policy. */ > // not available > }; > > /* If you want to enable debugging, eg. using the 'rndc trace' command, > * By default, SELinux policy does not allow named to modify the > /var/named directory, > * so put the default debug log file in data/ : > */ > logging { > channel default_debug { > file "data/named.run"; > severity dynamic; > print-time yes; > }; > }; > > zone "." IN { > type hint; > file "named.ca <http://named.ca/>"; > }; > > include "/etc/named.rfc1912.zones"; > include "/etc/named.root.key"; > > /* custom configuration snippet */ > include "/etc/named/ipa-ext.conf"; > > /* WARNING: This part of the config file is IPA-managed. > * Modifications may break IPA setup or upgrades. > */ > dyndb "ipa" "/usr/lib64/bind/ldap.so" { > uri "ldapi://%2fvar%2frun%2fslapd-IDM-NAC-ISSA-ORG.socket"; > base "cn=dns,dc=idm,dc=nac-issa,dc=org"; > server_id "utility.idm.nac-issa.org <http://utility.idm.nac-issa.org/>"; > auth_method "sasl"; > sasl_mech "GSSAPI"; > sasl_user "DNS/utility.idm.nac-issa.org <http://utility.idm.nac-issa.org/>"; > }; > /* End of IPA-managed part. */ > > > ------------------------------------------------------------------------ > *From:* Florence Renaud <flo(a)redhat.com> > *Sent:* Tuesday, August 31, 2021 2:16 AM > *To:* Jeremy Tourville <jeremy_tourville(a)hotmail.com> > *Cc:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Rob > Crittenden <rcritten(a)redhat.com> > *Subject:* Re: [Freeipa-users] Re: Unable to start directory server > after updates > > Hi, > > - Are you using the targeted selinux policy? (what is the output of > "sestatus" command) > - are the selinux-policy / selinux-policy-targeted / ipa-selinux > packages up-to-date? > > To troubleshoot further, I would first try to start named-pkcs11 in > permissive mode (setenforce 0; systemctl start named-pkcs11). If it > works, it means the error is related to SELinux. Go back in enforcing > mode (setenforce 1) and look for AVCs with > # date; systemctl start named-pkcs11 > # ausearch -m AVC -ts recent > (look for AVCs happening after the date you started the service) > > flo > > On Mon, Aug 30, 2021 at 2:44 PM Jeremy Tourville > <jeremy_tourville(a)hotmail.com <mailto:jeremy_tourville@hotmail.com>> wrote: > > To answer your question, yes, /etc/named/ipa-ext.conf and > /etc/named/ipa-options-ext.conf exist. > > When I attempted to start named*-pkcs11*.service. It failed. > Journalctl initially said there were issues with selinux. Anyhow, I > attempted to start the service again after making the selinux policy > entries that were suggested. I still was unable to get the service > to start. Though, this time I didn't get any selinux messages. > > Here is what happened at the first start of named*-pkcs11*.service > just for reference: > [root@utility ~]# journalctl -xe > You > can generate a local policy module to allow this access. > Do > > allow this access for now by executing: > # > ausearch -c 'ipa-dnskeysync-' --raw | audit2allow -M my-ipadnskeysync > # > semodule -X 300 -i my-ipadnskeysync.pp > > Aug 30 07:10:49 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> setroubleshoot[21841]: > AnalyzeThread.run(): Set alarm timeout to 10 > Aug 30 07:10:49 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> setroubleshoot[21841]: > AnalyzeThread.run(): Cancel pending alarm > Aug 30 07:10:49 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> setroubleshoot[21841]: SELinux is > preventing /usr/libexec/platform-python3.6 from 'read, write' acce> > Aug 30 07:10:49 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> setroubleshoot[21841]: SELinux is > preventing /usr/libexec/platform-python3.6 from 'read, write' acce> > > > ***** Plugin catchall (100. confidence) suggests > ************************** > > If > you believe that platform-python3.6 should be allowed read write > access on> > Then > you should report this as a bug. > You > can generate a local policy module to allow this access. > Do > > allow this access for now by executing: > # > ausearch -c 'ipa-dnskeysync-' --raw | audit2allow -M my-ipadnskeysync > # > semodule -X 300 -i my-ipadnskeysync.pp > > Aug 30 07:10:49 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> setroubleshoot[21841]: > AnalyzeThread.run(): Set alarm timeout to 10 > Aug 30 07:10:49 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> setroubleshoot[21841]: > AnalyzeThread.run(): Cancel pending alarm > Aug 30 07:10:49 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> setroubleshoot[21841]: SELinux is > preventing /usr/libexec/platform-python3.6 from lock access on the> > Aug 30 07:10:49 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> setroubleshoot[21841]: SELinux is > preventing /usr/libexec/platform-python3.6 from lock access on the> > > > ***** Plugin catchall (100. confidence) suggests > ************************** > > If > you believe that platform-python3.6 should be allowed lock access on > the g> > Then > you should report this as a bug. > You > can generate a local policy module to allow this access. > Do > > allow this access for now by executing: > # > ausearch -c 'ipa-dnskeysync-' --raw | audit2allow -M my-ipadnskeysync > # > semodule -X 300 -i my-ipadnskeysync.pp > > Aug 30 07:10:49 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> setroubleshoot[21841]: > AnalyzeThread.run(): Set alarm timeout to 10 > > Here is the 2nd run after making the selinux entries. > > [root@utility ~]# systemctl start named-pkcs11.service > Job for named-pkcs11.service failed because the control process > exited with error code. > See "systemctl status named-pkcs11.service" and "journalctl -xe" for > details. > [root@utility ~]# journalctl -xe > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: built with > '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '> > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: running as: > named-pkcs11 -u named -c /etc/named.conf > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: compiled by > GCC 8.4.1 20200928 (Red Hat 8.4.1-1) > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: compiled with > libxml2 version: 2.9.7 > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: linked to > libxml2 version: 20907 > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: compiled with > libjson-c version: 0.13.1 > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: linked to > libjson-c version: 0.13.1 > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: compiled with > zlib version: 1.2.11 > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: linked to > zlib version: 1.2.11 > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: threads > support is enabled > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: > ---------------------------------------------------- > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: BIND 9 is > maintained by Internet Systems Consortium, > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: Inc. (ISC), a > non-profit 501(c)(3) public-benefit > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: corporation. > Support and training for BIND 9 are > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: available at > https://www.isc.org/support > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: > ---------------------------------------------------- > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: adjusted > limit on open files from 262144 to 1048576 > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: found 4 CPUs, > using 4 worker threads > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: using 3 UDP > listeners per interface > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: using up to > 21000 sockets > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: initializing > DST: PKCS#11 initialization failed > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22071]: exiting (due > to fatal error) > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> systemd[1]: named-pkcs11.service: > Control process exited, code=exited status=1 > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> systemd[1]: named-pkcs11.service: > Failed with result 'exit-code'. > -- Subject: Unit failed > -- Defined-By: systemd > -- Support: https://access.redhat.com/support > -- > -- The unit named-pkcs11.service has entered the 'failed' state with > result 'exit-code'. > Aug 30 07:15:51 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> systemd[1]: Failed to start > Berkeley Internet Name Domain (DNS) with native PKCS#11. > -- Subject: Unit named-pkcs11.service has failed > -- Defined-By: systemd > -- Support: https://access.redhat.com/support > -- > -- Unit named-pkcs11.service has failed. > -- > -- The result is failed. > > [root@utility ~]# cat /etc/named/ipa-ext.conf > // Custom managed file. > // Here you can set your own options, for instance ACL for recursion > access: > // > // acl "trusted_network" { > // localnets; > // localhost; > // 234.234.234.0/24 <http://234.234.234.0/24>; > // 2001::co:ffee:babe:1/48; > // }; > // options { > // allow-recursion {trusted_network;}; > // allow-query-cache {trusted_network;}; > // }; > // > // This file will NOT be overridden during updates! > > [root@utility ~]# cat /etc/named/ipa-options-ext.conf > /* User customization for BIND named > * > * This file is included in /etc/named.conf and is not modified > during IPA > * upgrades. > * > * It must only contain "options" settings. Any other setting must be > * configured in /etc/named/ipa-ext.conf. > * > * Examples: > * allow-recursion { trusted_network; }; > * allow-query-cache { trusted_network; }; > */ > > /* turns on IPv6 for port 53, IPv4 is on by default for all ifaces */ > listen-on-v6 { any; }; > > /* dnssec-enable is obsolete and 'yes' by default */ > dnssec-validation yes; > > [root@utility data]# systemctl status named-pkcs11.service > ● named-pkcs11.service - Berkeley Internet Name Domain (DNS) with > native PKCS#11 > Loaded: loaded (/usr/lib/systemd/system/named-pkcs11.service; > disabled; vendor preset: disabled) > Active: failed (Result: exit-code) since Mon 2021-08-30 07:27:50 > CDT; 4min 49s ago > Process: 22249 ExecStart=/usr/sbin/named-pkcs11 -u named -c > ${NAMEDCONF} $OPTIONS (code=exited, status=1/FAILURE) > Process: 22244 ExecStartPre=/bin/bash -c if [ ! > "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf > -z "$NAMEDCONF"; else e> > > Aug 30 07:27:50 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22250]: > ---------------------------------------------------- > Aug 30 07:27:50 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22250]: adjusted > limit on open files from 262144 to 1048576 > Aug 30 07:27:50 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22250]: found 4 CPUs, > using 4 worker threads > Aug 30 07:27:50 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22250]: using 3 UDP > listeners per interface > Aug 30 07:27:50 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22250]: using up to > 21000 sockets > Aug 30 07:27:50 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22250]: initializing > DST: PKCS#11 initialization failed > Aug 30 07:27:50 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named-pkcs11[22250]: exiting (due > to fatal error) > Aug 30 07:27:50 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> systemd[1]: named-pkcs11.service: > Control process exited, code=exited status=1 > Aug 30 07:27:50 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> systemd[1]: named-pkcs11.service: > Failed with result 'exit-code'. > Aug 30 07:27:50 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> systemd[1]: Failed to start > Berkeley Internet Name Domain (DNS) with native PKCS#11. > [root@utility data]# journalctl -xe > Aug 30 07:27:53 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> systemd[1]: Stopped PKI Tomcat > Server pki-tomcat. > -- Subject: Unit pki-tomcatd(a)pki-tomcat.service has finished > shutting down > -- Defined-By: systemd > -- Support: https://access.redhat.com/support > -- > -- Unit pki-tomcatd(a)pki-tomcat.service has finished shutting down. > Aug 30 07:27:54 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> ns-slapd[1665]: > [30/Aug/2021:07:27:54.054683013 -0500] - INFO - bdb_pre_close - > Waiting for 4 databa> > Aug 30 07:27:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> ns-slapd[1665]: > [30/Aug/2021:07:27:55.032053458 -0500] - INFO - bdb_pre_close - All > database threads> > Aug 30 07:27:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: LDAP error: Can't > contact LDAP server: ldap_sync_poll() failed > Aug 30 07:27:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: ldap_syncrepl will > reconnect in 60 seconds > Aug 30 07:27:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> ns-slapd[1665]: > [30/Aug/2021:07:27:55.054454093 -0500] - INFO - > ldbm_back_instance_set_destructor - > > Aug 30 07:27:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> ns-slapd[1665]: > [30/Aug/2021:07:27:55.057417960 -0500] - INFO - > connection_post_shutdown_cleanup - s> > Aug 30 07:27:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> ns-slapd[1665]: > [30/Aug/2021:07:27:55.059926010 -0500] - INFO - main - slapd stopped. > Aug 30 07:27:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> systemd[1]: > dirsrv(a)IDM-NAC-ISSA-ORG.service: Succeeded. > -- Subject: Unit succeeded > -- Defined-By: systemd > -- Support: https://access.redhat.com/support > -- > -- The unit dirsrv(a)IDM-NAC-ISSA-ORG.service has successfully entered > the 'dead' state. > Aug 30 07:27:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> systemd[1]: Stopped 389 Directory > Server IDM-NAC-ISSA-ORG.. > -- Subject: Unit dirsrv(a)IDM-NAC-ISSA-ORG.service has finished > shutting down > -- Defined-By: systemd > -- Support: https://access.redhat.com/support > -- > -- Unit dirsrv(a)IDM-NAC-ISSA-ORG.service has finished shutting down. > Aug 30 07:27:59 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: network unreachable > resolving 'a-ups-presencecore4-prod-azsc.eastus2.cloudapp.azure.com > <http://a-ups-presencecore4-prod-azsc.eastus2.cloudapp.azure.com>> > Aug 30 07:27:59 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: network unreachable > resolving 'a-ups-presencecore4-prod-azsc.eastus2.cloudapp.azure.com > <http://a-ups-presencecore4-prod-azsc.eastus2.cloudapp.azure.com>> > Aug 30 07:28:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: LDAP error: Can't > contact LDAP server: bind to LDAP server failed > Aug 30 07:28:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: ldap_syncrepl will > reconnect in 60 seconds > Aug 30 07:29:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: LDAP error: Can't > contact LDAP server: bind to LDAP server failed > Aug 30 07:29:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: ldap_syncrepl will > reconnect in 60 seconds > Aug 30 07:30:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: LDAP error: Can't > contact LDAP server: bind to LDAP server failed > Aug 30 07:30:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: ldap_syncrepl will > reconnect in 60 seconds > Aug 30 07:31:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: LDAP error: Can't > contact LDAP server: bind to LDAP server failed > Aug 30 07:31:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: ldap_syncrepl will > reconnect in 60 seconds > Aug 30 07:32:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: LDAP error: Can't > contact LDAP server: bind to LDAP server failed > Aug 30 07:32:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[1527]: ldap_syncrepl will > reconnect in 60 seconds > > > It looks like I need to troubleshoot section 4 further.. > auth_method, sasl_mech, sasl_user, all seem to be present in > my /etc/named.conf file > I was unable to find bind_dn, password, sasl_realm, sasl_password > and krb5_principal. > > // If not explicitly set, the ACLs for "allow-query-cache" and > // "allow-recursion" are set to "localnets; localhost;". > // If either "allow-query-cache" or "allow-r > ecursion" is set, > // the other would be set the same value. > // Please refer to /etc/named[root@utility data]# cat /etc/named.conf > options { > // turns on IPv6 for port 53, IPv4 is on by default for all ifaces > #listen-on-v6 {any;}; > > // Put files that named is allowed to write in the data/ directory: > directory "/var/named"; // the default > dump-file "data/cache_dump.db"; > statistics-file "data/named_stats.txt"; > memstatistics-file "data/named_mem_stats.txt"; > > /ipa-ext.conf > // for more information > tkey-gssapi-keytab "/etc/named.keytab"; > pid-file "/run/named/named.pid"; > > dnssec-enable yes; > dnssec-validation yes; > > /* Path to ISC DLV key */ > bindkeys-file "/etc/named.iscdlv.key"; > > managed-keys-directory "/var/named/dynamic"; > > /* crypto policy snippet on platforms with system-wide policy. */ > // not available > }; > > /* If you want to enable debugging, eg. using the 'rndc trace' command, > * By default, SELinux policy does not allow named to modify the > /var/named directory, > * so put the default debug log file in data/ : > */ > logging { > channel default_debug { > file "data/named.run"; > severity dynamic; > print-time yes; > }; > }; > > zone "." IN { > type hint; > file "named.ca <http://named.ca>"; > }; > > include "/etc/named.rfc1912.zones"; > include "/etc/named.root.key"; > > /* custom configuration snippet */ > include "/etc/named/ipa-ext.conf"; > > /* WARNING: This part of the config file is IPA-managed. > * Modifications may break IPA setup or upgrades. > */ > dyndb "ipa" "/usr/lib64/bind/ldap.so" { > uri "ldapi://%2fvar%2frun%2fslapd-IDM-NAC-ISSA-ORG.socket"; > base "cn=dns,dc=idm,dc=nac-issa,dc=org"; > server_id "utility.idm.nac-issa.org <http://utility.idm.nac-issa.org>"; > auth_method "sasl"; > sasl_mech "GSSAPI"; > sasl_user "DNS/utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org>"; > }; > /* End of IPA-managed part. */ > > ------------------------------------------------------------------------ > *From:* Florence Renaud <flo(a)redhat.com <mailto:flo@redhat.com>> > *Sent:* Monday, August 30, 2021 2:39 AM > *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > *Cc:* Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>>; Jeremy Tourville > <jeremy_tourville(a)hotmail.com <mailto:jeremy_tourville@hotmail.com>> > *Subject:* Re: [Freeipa-users] Re: Unable to start directory server > after updates > > Hi, > > on rhel8, IPA is using named*-pkcs11*.service, not named.service. In > order to manually start the bind service, you would need to use > "systemctl start named-pkcs11.service". > The journal may contain additional logs, as well as the output of > "systemctl status named-pkcs11.service". > > IIRC in ipa 4.9, ipa introduced bind configuration snippets in > /etc/named/ipa-ext.conf and /etc/named/ipa-options-ext.conf. Do you > have such configuration files? > flo > > On Sun, Aug 29, 2021 at 3:45 PM Jeremy Tourville via FreeIPA-users > <freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> wrote: > > I found this page on troubleshooting > - https://docs.pagure.org/bind-dyndb-ldap/BIND9/NamedCannotStart.html > > I can manually start named.service but cannot start named when > using ipactl. > > *Section 1* > I was able to get a log (this log is prior to changes made in > section 4) > > #less /var/named/data/named.run > > reloading configuration succeeded > reloading zones succeeded > network unreachable resolving './DNSKEY/IN': 2001:7fd::1#53 > network unreachable resolving './DNSKEY/IN': 2001:500:1::53#53 > network unreachable resolving './DNSKEY/IN': 2001:500:9f::42#53 > network unreachable resolving './DNSKEY/IN': 2001:500:2f::f#53 > network unreachable resolving './DNSKEY/IN': 2001:500:12::d0d#53 > network unreachable resolving './DNSKEY/IN': 2001:500:200::b#53 > network unreachable resolving './DNSKEY/IN': 2001:503:ba3e::2:30#53 > network unreachable resolving './DNSKEY/IN': 2001:500:a8::e#53 > network unreachable resolving './DNSKEY/IN': 2001:7fe::53#53 > network unreachable resolving './DNSKEY/IN': 2001:dc3::35#53 > network unreachable resolving './DNSKEY/IN': 2001:500:2::c#53 > network unreachable resolving './DNSKEY/IN': 2001:500:2d::d#53 > network unreachable resolving './DNSKEY/IN': 2001:503:c27::2:30#53 > all zones loaded > running > managed-keys-zone: Key 20326 for zone . acceptance timer > complete: key now trusted > > With the changes in section 4 (below) I now see this additional > info in the log: > received control channel command 'stop' > shutting down: flushing changes > stopping command channel on 127.0.0.1#953 > stopping command channel on ::1#953 > no longer listening on 127.0.0.1#53 > no longer listening on ::1#53 > exiting > > I was unable to get a log from tmp/named_krb5.log using the > rhel/fedora method. Do I need to use the archlinux method? > > *Section 2* > I don't see any evidence of this issue based on logs. > Furthermore, hostname FQDN and /etc/hosts are set properly > according to the examples shown > > *Section 3* > The values here match > > *Section 4* > I see that my system was running a named.conf file that didn't > have any credentials. I looked at my yum history and the > timestamps for my named.conf* files. The yum update that most > likely affected them was run at 9:52. The two oldest files are > marked 9:55 and I presume are the backups as part of the update > process. > [root@utility etc]# ls -la named.conf* > -rw-r-----. 1 root named 1876 Aug 29 08:01 named.conf > -rw-r-----. 1 root named 1705 May 27 15:49 named.conf.bak > -rw-r--r--. 1 root root 1876 Aug 28 09:55 named.conf.ipa-backup > -rw-r-----. 1 root named 1535 Aug 28 09:55 named.conf.rpmsave > > I did attempt to copy the oldest files over the existing > named.conf and start the named service. I still didn't have any > luck in either case. > #cp named.conf.rpmsave named.conf > #ipactl start > #cp named.conf.ipa-backup named.conf > #ipactl start > > Systemctl status when using named.conf.rpmsave version: > > [root@utility etc]# systemctl status named > ● named.service - Berkeley Internet Name Domain (DNS) > Loaded: loaded (/usr/lib/systemd/system/named.service; > linked; vendor preset: disabled) > Active: active (running) since Sun 2021-08-29 08:38:05 CDT; > 1s ago > Process: 2294 ExecStart=/usr/sbin/named -u named -c > ${NAMEDCONF} $OPTIONS (code=exited, status=0/SUCCESS) > Process: 2291 ExecStartPre=/bin/bash -c if [ ! > "$DISABLE_ZONE_CHECKING" == "yes" ]; then > /usr/sbin/named-checkconf -z "$NAMEDCONF"; else ec> > Main PID: 2296 (named) > Tasks: 8 (limit: 37317) > Memory: 59.5M > CGroup: /system.slice/named.service > └─2296 /usr/sbin/named -u named -c /etc/named.conf > > Aug 29 08:38:05 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2296]: > managed-keys-zone: Key 20326 for zone . acceptance timer > complete: key now trusted > Aug 29 08:38:06 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2296]: resolver priming > query complete > Aug 29 08:38:06 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2296]: LDAP > configuration synchronization failed: socket is not connected > Aug 29 08:38:06 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2296]: ldap_syncrepl > will reconnect in 60 seconds > Aug 29 08:38:06 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2296]: network > unreachable resolving '_ldap._tcp.idm.nac-issa.org/SRV/IN > <http://tcp.idm.nac-issa.org/SRV/IN>': 2001:500:f::1#53 > Aug 29 08:38:06 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2296]: network > unreachable resolving '_ldap._tcp.idm.nac-issa.org/SRV/IN > <http://tcp.idm.nac-issa.org/SRV/IN>': 2001:500:c::1#53 > Aug 29 08:38:06 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2296]: network > unreachable resolving '_ldap._tcp.idm.nac-issa.org/SRV/IN > <http://tcp.idm.nac-issa.org/SRV/IN>': 2001:500:40::1#53 > Aug 29 08:38:06 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2296]: network > unreachable resolving '_ldap._tcp.idm.nac-issa.org/SRV/IN > <http://tcp.idm.nac-issa.org/SRV/IN>': 2001:500:48::1#53 > Aug 29 08:38:06 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2296]: network > unreachable resolving '_ldap._tcp.idm.nac-issa.org/SRV/IN > <http://tcp.idm.nac-issa.org/SRV/IN>': 2001:500:b::1#53 > Aug 29 08:38:06 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2296]: network > unreachable resolving '_ldap._tcp.idm.nac-issa.org/SRV/IN > <http://tcp.idm.nac-issa.org/SRV/IN>': 2001:500:e::1#53 > > > Systemctl status when using named.conf.ipa-backup version: > > [root@utility etc]# systemctl start named > [root@utility etc]# systemctl status named > ● named.service - Berkeley Internet Name Domain (DNS) > Loaded: loaded (/usr/lib/systemd/system/named.service; > linked; vendor preset: disabled) > Active: active (running) since Sun 2021-08-29 08:33:54 CDT; > 5s ago > Process: 2251 ExecStart=/usr/sbin/named -u named -c > ${NAMEDCONF} $OPTIONS (code=exited, status=0/SUCCESS) > Process: 2247 ExecStartPre=/bin/bash -c if [ ! > "$DISABLE_ZONE_CHECKING" == "yes" ]; then > /usr/sbin/named-checkconf -z "$NAMEDCONF"; else ec> > Main PID: 2252 (named) > Tasks: 8 (limit: 37317) > Memory: 64.7M > CGroup: /system.slice/named.service > └─2252 /usr/sbin/named -u named -c /etc/named.conf > > Aug 29 08:33:55 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2252]: network > unreachable resolving 'eur2.akam.net/AAAA/IN > <http://eur2.akam.net/AAAA/IN>': 2600:1401:1::43#53 > Aug 29 08:33:56 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2252]: network > unreachable resolving 'kube2.idm.nac-issa.org/AAAA/IN > <http://kube2.idm.nac-issa.org/AAAA/IN>': 2a00:edc0:107::1#53 > Aug 29 08:33:56 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2252]: network > unreachable resolving 'kube2.idm.nac-issa.org/AAAA/IN > <http://kube2.idm.nac-issa.org/AAAA/IN>': 2a00:edc0:107::49#53 > Aug 29 08:33:56 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2252]: network > unreachable resolving 'kube2.idm.nac-issa.org/AAAA/IN > <http://kube2.idm.nac-issa.org/AAAA/IN>': 2402:cf80:107::1#53 > Aug 29 08:33:56 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2252]: network > unreachable resolving 'kube2.idm.nac-issa.org/AAAA/IN > <http://kube2.idm.nac-issa.org/AAAA/IN>': 2402:cf80:107::49#53 > Aug 29 08:33:56 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2252]: network > unreachable resolving 'nac-issa.org/DS/IN > <http://nac-issa.org/DS/IN>': 2001:500:c::1#53 > Aug 29 08:33:56 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2252]: network > unreachable resolving 'kube1.idm.nac-issa.org/A/IN > <http://kube1.idm.nac-issa.org/A/IN>': 2402:cf80:107::1#53 > Aug 29 08:33:56 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2252]: network > unreachable resolving 'kube1.idm.nac-issa.org/AAAA/IN > <http://kube1.idm.nac-issa.org/AAAA/IN>': 2402:cf80:107::1#53 > Aug 29 08:33:56 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2252]: network > unreachable resolving > 'kube3.idm.nac-issa.org.idm.nac-issa.org/A/IN > <http://kube3.idm.nac-issa.org.idm.nac-issa.org/A/IN>': 2402:cf80> > Aug 29 08:33:56 utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org> named[2252]: network > unreachable resolving > 'kube3.idm.nac-issa.org.idm.nac-issa.org/AAAA/IN > <http://kube3.idm.nac-issa.org.idm.nac-issa.org/AAAA/IN>': 2402:c> > > > Here are the contents of my file: > #less /etc/named.conf (named.conf.rpm version) > > options { > // turns on IPv6 for port 53, IPv4 is on by default for > all ifaces > listen-on-v6 {any;}; > > // Put files that named is allowed to write in the data/ > directory: > directory "/var/named"; // the default > dump-file "data/cache_dump.db"; > statistics-file "data/named_stats.txt"; > memstatistics-file "data/named_mem_stats.txt"; > > // If not explicitly set, the ACLs for > "allow-query-cache" and > // "allow-recursion" are set to "localnets; localhost;". > // If either "allow-query-cache" or "allow-recursion" is > set, > // the other would be set the same value. > // Please refer to /etc/named/ipa-ext.conf > // for more informations > > tkey-gssapi-keytab "/etc/named.keytab"; > pid-file "/run/named/named.pid"; > > dnssec-enable yes; > dnssec-validation yes; > > /* Path to ISC DLV key */ > bindkeys-file "/etc/named.iscdlv.key"; > > managed-keys-directory "/var/named/dynamic"; > > /* crypto policy snippet on platforms with system-wide > policy. */ > // not available > }; > > /* If you want to enable debugging, eg. using the 'rndc trace' > command, > * By default, SELinux policy does not allow named to modify the > /var/named directory, > * so put the default debug log file in data/ : > */ > logging { > channel default_debug { > file "data/named.run"; > severity dynamic; > print-time yes; > }; > }; > > zone "." IN { > type hint; > file "named.ca <http://named.ca>"; > }; > > include "/etc/named.rfc1912.zones"; > include "/etc/named.root.key"; > > /* custom configuration snippet */ > include "/etc/named/ipa-ext.conf"; > > /* WARNING: This part of the config file is IPA-managed. > * Modifications may break IPA setup or upgrades. > */ > dyndb "ipa" "/usr/lib64/bind/ldap.so" { > uri "ldapi://%2fvar%2frun%2fslapd-IDM-NAC-ISSA-ORG.socket"; > base "cn=dns, dc=idm,dc=nac-issa,dc=org"; > server_id "utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org>"; > auth_method "sasl"; > sasl_mech "GSSAPI"; > sasl_user "DNS/utility.idm.nac-issa.org > <http://utility.idm.nac-issa.org>"; > }; > /* End of IPA-managed part. */ > > > I also compared the two oldest files but I am not sure what > changes should be made in my existing named.conf. > # diff named.conf.rpmsave named.conf.ipa-backup > > 1,9d0 > < /* WARNING: This config file is managed by IPA. > < * > < * DO NOT MODIFY! Any modification will be overwritten by > upgrades. > < * > < * > < * - /etc/named/ipa-options-ext.conf (for options) > < * - /etc/named/ipa-ext.conf (all other settings) > < */ > < > 10a2,4 > > // turns on IPv6 for port 53, IPv4 is on by default for all ifaces > > listen-on-v6 {any;}; > > > 17c11,16 > < tkey-gssapi-keytab "/etc/named.keytab"; > --- > > // If not explicitly set, the ACLs for "allow-query-cache" and > > // "allow-recursion" are set to "localnets; localhost;". > > // If either "allow-query-cache" or "allow-recursion" is set, > > // the other would be set the same value. > > // Please refer to /etc/named/ipa-ext.conf > > // for more informations > 18a18 > > tkey-gssapi-keytab "/etc/named.keytab"; > 21c21,25 > < managed-keys-directory "/var/named/dynamic"; > --- > > dnssec-enable yes; > > dnssec-validation yes; > > > > /* Path to ISC DLV key */ > > bindkeys-file "/etc/named.iscdlv.key"; > 23,24c27 > < /* user customizations of options */ > < include "/etc/named/ipa-options-ext.conf"; > --- > > managed-keys-directory "/var/named/dynamic"; > 50c53 > < /* user customization */ > --- > > /* custom configuration snippet */ > 52a56,58 > > /* WARNING: This part of the config file is IPA-managed. > > * Modifications may break IPA setup or upgrades. > > */ > 55c61 > < base "cn=dns,dc=idm,dc=nac-issa,dc=org"; > --- > > base "cn=dns, dc=idm,dc=nac-issa,dc=org"; > 60a67 > > /* End of IPA-managed part. */ > > > ------------------------------------------------------------------------ > *From:* Jeremy Tourville <jeremy_tourville(a)hotmail.com > <mailto:jeremy_tourville@hotmail.com>> > *Sent:* Saturday, August 28, 2021 7:07 PM > *To:* freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > <freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > *Cc:* Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> > *Subject:* Re: [Freeipa-users] Unable to start directory server > after updates > > OK, I quickly realized I couldn't yum/dnf downgrade as I still > had a version/data mismatch. Now I understand what the error > means. I did the latter part of my previous question and > performed an ipa-server-upgrade. > .... > ..... > The IPA services were upgraded > The ipa-server-upgrade command was successful > > Now I tried to start my ipa server but had limited success. > Named service won't start > .... > .... > Starting named Service > Failed to start named Service > Shutting down > > I tried to force and see what else would have issues > #ipactl start --ignore-service-failure > .... > .... > Failed to start named Service > Forced start, ignoring named Service, continuing normal operation > .... > .... > Starting ipa-dnskeysyncd Service > Failed to start ipa-dnskeysyncd Service > Forced start, ignoring ipa-dnskeysyncd Service, continuing > normal operation > ipa: INFO: The ipactl command was successful > > > > > Here is the entire sequence- > [root@utility slapd-IDM-NAC-ISSA-ORG]# ipa-server-upgrade > Upgrading IPA:. Estimated time: 1 minute 30 seconds > [1/9]: saving configuration > [2/9]: disabling listeners > [3/9]: enabling DS global lock > [4/9]: disabling Schema Compat > [5/9]: starting directory server > [6/9]: updating schema > [7/9]: upgrading server > [8/9]: stopping directory server > [9/9]: restoring configuration > Done. > Update complete > Upgrading IPA services > Upgrading the configuration of the IPA services > Disabled p11-kit-proxy > [Verifying that root certificate is published] > [Migrate CRL publish directory] > CRL tree already moved > [Verifying that KDC configuration is using ipa-kdb backend] > [Fix DS schema file syntax] > Syntax already fixed > [Removing RA cert from DS NSS database] > RA cert already removed > [Enable sidgen and extdom plugins by default] > [Updating HTTPD service IPA configuration] > [Updating HTTPD service IPA WSGI configuration] > Nothing to do for configure_httpd_wsgi_conf > [Migrating from mod_nss to mod_ssl] > Already migrated to mod_ssl > [Moving HTTPD service keytab to gssproxy] > [Removing self-signed CA] > [Removing Dogtag 9 CA] > [Checking for deprecated KDC configuration files] > [Checking for deprecated backups of Samba configuration files] > [Remove FILE: prefix from 'dedicated keytab file' in Samba > configuration] > [Update 'max smbd processes' in Samba configuration to prevent > unlimited SMBLoris attack amplification] > dnssec-validation yes > [Add missing CA DNS records] > IPA CA DNS records already processed > DNS service is not configured > [Upgrading CA schema] > CA schema update complete > [Update certmonger certificate renewal configuration] > Certmonger certificate renewal configuration already up-to-date > [Enable PKIX certificate path discovery and validation] > PKIX already enabled > [Authorizing RA Agent to modify profiles] > [Authorizing RA Agent to manage lightweight CAs] > [Ensuring Lightweight CAs container exists in Dogtag database] > [Adding default OCSP URI configuration] > [Disabling cert publishing] > pki-tomcat configuration changed, restart pki-tomcat > [Ensuring CA is using LDAPProfileSubsystem] > [Migrating certificate profiles to LDAP] > Migrating profile 'caECServerCertWithSCT' > Migrating profile 'caServerCertWithSCT' > Migrating profile 'caServerKeygen_DirUserCert' > Migrating profile 'caServerKeygen_UserCert' > [Ensuring presence of included profiles] > [Add default CA ACL] > Default CA ACL already added > [Updating ACME configuration] > [Migrating to authselect profile] > Already migrated to authselect profile > [Create systemd-user hbac service and rule] > hbac service systemd-user already exists > [Add root(a)IDM.NAC-ISSA.ORG <mailto:root@IDM.NAC-ISSA.ORG> alias > to admin account] > Alias already exists > [Setup SPAKE] > [Setup PKINIT] > [Enable server krb5.conf snippet] > [Adding ipa-ca alias to HTTP certificate] > Resubmitting HTTP cert tracking request > The IPA services were upgraded > The ipa-server-upgrade command was successful > [root@utility slapd-IDM-NAC-ISSA-ORG]# ipactl start > Existing service file detected! > Assuming stale, cleaning and proceeding > Starting Directory Service > Starting krb5kdc Service > Starting kadmin Service > Starting named Service > Failed to start named Service > Shutting down > Hint: You can use --ignore-service-failure option for forced > start in case that a non-critical service failed > Aborting ipactl > [root@utility slapd-IDM-NAC-ISSA-ORG]# ipactl start > --ignore-service-failure > Existing service file detected! > Assuming stale, cleaning and proceeding > Starting Directory Service > Starting krb5kdc Service > Starting kadmin Service > Starting named Service > Failed to start named Service > Forced start, ignoring named Service, continuing normal operation > Starting httpd Service > Starting ipa-custodia Service > Starting pki-tomcatd Service > Starting smb Service > Starting winbind Service > Starting ipa-otpd Service > Starting ipa-dnskeysyncd Service > Failed to start ipa-dnskeysyncd Service > Forced start, ignoring ipa-dnskeysyncd Service, continuing > normal operation > ipa: INFO: The ipactl command was successful > [root@utility slapd-IDM-NAC-ISSA-ORG]# > > > > > ------------------------------------------------------------------------ > *From:* Jeremy Tourville <jeremy_tourville(a)hotmail.com > <mailto:jeremy_tourville@hotmail.com>> > *Sent:* Saturday, August 28, 2021 6:45 PM > *To:* freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > <freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > *Cc:* Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> > *Subject:* Re: [Freeipa-users] Unable to start directory server > after updates > > CentOS Linux release 8.4.2105 > VERSION: 4.9.2, API_VERSION: 2.240 > > Prior to any updates I was at ver 8.2 of CentOS > > The shared library was loaded and now I can start dirsrv. > THANKS! That's definitely big a step in the right direction. > As I thought, my upgrade looks like it caused the version be too > new for the existing dirsrv data. I thought I had set my OS > distro release version and that is my own dumb mistake... > > IPA version error: data needs to be upgraded (expected version > '4.9.2-4.module_el8.4.0+846+96522ed7', current version > '4.8.4-7.module_el8.2.0+374+0d2d74a1') > > I am thinking I could downgrade to get things up and running or > do you suggest upgrading the data to work with the application > version I have installed? > > [root@utility slapd-IDM-NAC-ISSA-ORG]# ipactl status > Directory Service: RUNNING > krb5kdc Service: STOPPED > kadmin Service: STOPPED > named Service: STOPPED > httpd Service: STOPPED > ipa-custodia Service: STOPPED > pki-tomcatd Service: STOPPED > smb Service: STOPPED > winbind Service: STOPPED > ipa-otpd Service: STOPPED > ipa-dnskeysyncd Service: STOPPED > 9 service(s) are not running > [root@utility slapd-IDM-NAC-ISSA-ORG]# ipactl start > IPA version error: data needs to be upgraded (expected version > '4.9.2-4.module_el8.4.0+846+96522ed7', current version > '4.8.4-7.module_el8.2.0+374+0d2d74a1') > Automatically running upgrade, for details see > /var/log/ipaupgrade.log > Be patient, this may take a few minutes. > Starting Directory Service > Starting krb5kdc Service > Starting kadmin Service > Starting named Service > Failed to start named Service > Shutting down > Hint: You can use --ignore-service-failure option for forced > start in case that a non-critical service failed > Aborting ipactl > > ------------------------------------------------------------------------ > *From:* Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> > *Sent:* Saturday, August 28, 2021 5:31 PM > *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > *Cc:* Jeremy Tourville <jeremy_tourville(a)hotmail.com > <mailto:jeremy_tourville@hotmail.com>> > *Subject:* Re: [Freeipa-users] Unable to start directory server > after updates > > Jeremy Tourville via FreeIPA-users wrote: > > I was doing some maintenance and updates this morning. At some point I noticed I couldn't reach the web interface anymore. My server has been up and running for the last year and is not a new install. I reviewed //var/log/dirsrv/slapd-IDM-NAC-ISSA-ORG/errors. I also confirmed I did not have disk space issues. > > > > Here is part of my log file: > > [28/Aug/2021:10:46:35.380380540 -0500] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests > > [28/Aug/2021:10:46:35.383040751 -0500] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests > > [28/Aug/2021:10:46:35.385415998 -0500] - INFO - slapd_daemon - Listening on /var/run/slapd-IDM-NAC-ISSA-ORG.socket for LDAPI requests > > [28/Aug/2021:10:46:35.439358079 -0500] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! > > [28/Aug/2021:10:46:40.494600578 -0500] - WARN - str2entry_dupcheck - Duplicate value for attribute type memberUid detected in entry cn=sudo-infra,cn=groups,cn=compat,dc=idm,dc=nac-issa,dc=org. Extra value ignored. > > [28/Aug/2021:10:46:40.527665958 -0500] - WARN - str2entry_dupcheck - Duplicate value for attribute type memberUid detected in entry cn=sudo-devel,cn=groups,cn=compat,dc=idm,dc=nac-issa,dc=org. Extra value ignored. > > [28/Aug/2021:10:46:40.560185359 -0500] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=idm,dc=nac-issa,dc=org > > [28/Aug/2021:10:46:40.582782578 -0500] - ERR - schema-compat-plugin - Finished plugin initialization. > > [28/Aug/2021:11:20:49.697931599 -0500] - INFO - op_thread_cleanup - slapd shutting down - signaling operation threads - op stack size 4 max work q size 2 max work q stack size 2 > > [28/Aug/2021:11:20:49.706989092 -0500] - INFO - slapd_daemon - slapd shutting down - closing down internal subsystems and plugins > > [28/Aug/2021:11:20:49.724450159 -0500] - INFO - bdb_pre_close - Waiting for 4 database threads to stop > > [28/Aug/2021:11:20:51.131059518 -0500] - INFO - bdb_pre_close - All database threads now stopped > > [28/Aug/2021:11:20:51.152587508 -0500] - INFO - ldbm_back_instance_set_destructor - Set of instances destroyed > > [28/Aug/2021:11:20:51.155514615 -0500] - INFO - connection_post_shutdown_cleanup - slapd shutting down - freed 2 work q stack objects - freed 7 op stack objects > > [28/Aug/2021:11:20:51.158002944 -0500] - INFO - main - slapd stopped. > > [28/Aug/2021:13:14:20.585994349 -0500] - NOTICE - config_set_port - Non-Secure Port Disabled > > [28/Aug/2021:13:14:20.607117053 -0500] - ERR - symload_report_error - Netscape Portable Runtime error -5977: /usr/lib64/dirsrv/plugins/libipa_cldap.so: cannot open shared object file: No such file or directory > > [28/Aug/2021:13:14:20.609768545 -0500] - ERR - symload_report_error - Could not open library "/usr/lib64/dirsrv/plugins/libipa_cldap.so" for plugin ipa_cldap > > [28/Aug/2021:13:14:20.612257544 -0500] - ERR - load_plugin_entry - Unable to load plugin "cn=ipa_cldap,cn=plugins,cn=config" > > [28/Aug/2021:13:14:21.012890173 -0500] - ERR - symload_report_error - Netscape Portable Runtime error -5977: /usr/lib64/dirsrv/plugins/libipa_cldap.so: cannot open shared object file: No such file or directory > > [28/Aug/2021:13:14:21.018097465 -0500] - ERR - symload_report_error - Could not open library "/usr/lib64/dirsrv/plugins/libipa_cldap.so" for plugin ipa_cldap > > [28/Aug/2021:13:14:21.020655816 -0500] - ERR - load_plugin_entry - Unable to load plugin "cn=ipa_cldap,cn=plugins,cn=config" > > [28/Aug/2021:13:15:53.219524942 -0500] - ERR - symload_report_error - Netscape Portable Runtime error -5977: /usr/lib64/dirsrv/plugins/libipa_cldap.so: cannot open shared object file: No such file or directory > > [28/Aug/2021:13:15:53.228547473 -0500] - ERR - symload_report_error - Could not open library "/usr/lib64/dirsrv/plugins/libipa_cldap.so" for plugin ipa_cldap > > [28/Aug/2021:13:15:53.231054342 -0500] - ERR - load_plugin_entry - Unable to load plugin "cn=ipa_cldap,cn=plugins,cn=config" > > [28/Aug/2021:13:17:13.917125368 -0500] - NOTICE - config_set_port - Non-Secure Port Disabled > > [28/Aug/2021:13:17:13.932712979 -0500] - ERR - symload_report_error - Netscape Portable Runtime error -5977: /usr/lib64/dirsrv/plugins/libipa_cldap.so: cannot open shared object file: No such file or directory > > [28/Aug/2021:13:17:13.935253118 -0500] - ERR - symload_report_error - Could not open library "/usr/lib64/dirsrv/plugins/libipa_cldap.so" for plugin ipa_cldap > > [28/Aug/2021:13:17:13.937761206 -0500] - ERR - load_plugin_entry - Unable to load plugin "cn=ipa_cldap,cn=plugins,cn=config" > > > > Can anyone offer troubleshooting suggestions? Do you need a debug file or is this log enough? Thanks in advance for your input! > > Knowing the distribution and version would help. > > This missing shared library is provided by > [free]ipa-server-trust-ad, > ipa-server, or something like it depending on the release. > > rob > > _______________________________________________ > FreeIPA-users mailing list -- > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure >

2 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2021