3:53 a.m.
Dear,
After a package update from ipa-server-4.9.2-4.module+el8.4.0+589+9650b94f.x86_64 to
ipa-server-4.9.2-4.module+el8.4.0+664+1636a961.x86_64
I am unable to restart ipa server services indeed the command /usr/sbin/ipa-server-upgrade
fail as it is not able to reach
'https://ipa.somewhere.com:8443/ca/rest/account/login' . Indeed the dns service is
on the same server and is started by ipa services.
below a piece of log
Thanks for your help
Best regards
--------
IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command
ipa-server-upgrade manually.
Unexpected error - see /var/log/ipaupgrade.log for details:
NetworkError: cannot connect to
'https://ipa.somewhere.com:8443/ca/rest/account/login': [Errno 113] No route to
host
The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information
See the upgrade log for more details and/or run /usr/sbin/ipa-server-upgrade again
Stopping ipa-dnskeysyncd Service
Stopping ipa-otpd Service
Stopping pki-tomcatd Service
Stopping ipa-custodia Service
Stopping httpd Service
Stopping named Service
Stopping kadmin Service
Stopping krb5kdc Service
Stopping Directory Service
----
4:16 a.m.
New subject: Fail to restart ipa server after ipa packages updates
to complete information
the named-pkcs11 service is started so it is not a problem to resolv host
Here I see that the rest api is down to my understanding
----
# systemctl status named-pkcs11
● named-pkcs11.service - Berkeley Internet Name Domain (DNS) with native PKCS#11
Loaded: loaded (/usr/lib/systemd/system/named-pkcs11.service; disabled; vendor preset:
disabled)
Active: active (running) since Thu 2021-11-04 10:11:36 CET; 1min 55s ago
Main PID: 8585 (named-pkcs11)
Tasks: 7 (limit: 23441)
Memory: 59.6M
CGroup: /system.slice/named-pkcs11.service
└─8585 /usr/sbin/named-pkcs11 -u named -c /etc/named.conf
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
74.125.47.11#63950 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
74.125.181.4#45716 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
172.253.248.34#61146 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
172.217.41.200#37484 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
74.125.73.84#43464 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80ebf40
172.253.215.71#43628 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
74.125.47.12#50980 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
74.125.47.149#38369 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:31 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
74.125.181.1#38708 (_ldap._tcp.somewhere.com): query (cache)
'_ldap._tcp.somewhere.com/SRV/IN' denied
nov. 04 10:13:31 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80ebf40
172.217.41.200#62570 (_ldap._tcp.somewhere.com): query (cache)
'_ldap._tcp.somewhere.com/SRV/IN' denied
[root@ipa ~]# dig ipa.somewhere.com
; <<>> DiG 9.11.26-RedHat-9.11.26-4.el8_4 <<>> ipa.somewhere.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 22587
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: ec506fda56122893ea1f0c686183a448049b2db129924d5d (good)
;; QUESTION SECTION:
;ipa.somewhere.com. IN A
;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: jeu. nov. 04 10:13:44 CET 2021
;; MSG SIZE rcvd: 80
4:45 a.m.
New subject: Fail to restart ipa server after ipa packages updates
On to, 04 marras 2021, MERCIER Jonathan via FreeIPA-users wrote:
to complete information
the named-pkcs11 service is started so it is not a problem to resolv host
Here I see that the rest api is down to my understanding
Most likely you need to downgrade a JDK build. It is a known issue that
is fixed in RHEL 8.5 in jss and pki. Not sure if that was backported to
CentOS 8 Stream.
----
# systemctl status named-pkcs11
● named-pkcs11.service - Berkeley Internet Name Domain (DNS) with native PKCS#11
Loaded: loaded (/usr/lib/systemd/system/named-pkcs11.service; disabled; vendor preset:
disabled)
Active: active (running) since Thu 2021-11-04 10:11:36 CET; 1min 55s ago
Main PID: 8585 (named-pkcs11)
Tasks: 7 (limit: 23441)
Memory: 59.6M
CGroup: /system.slice/named-pkcs11.service
└─8585 /usr/sbin/named-pkcs11 -u named -c /etc/named.conf
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
74.125.47.11#63950 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
74.125.181.4#45716 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
172.253.248.34#61146 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
172.217.41.200#37484 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
74.125.73.84#43464 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80ebf40
172.253.215.71#43628 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
74.125.47.12#50980 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:29 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
74.125.47.149#38369 (ipa.somewhere.com): query (cache) 'ipa.somewhere.com/A/IN'
denied
nov. 04 10:13:31 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80dd4e0
74.125.181.1#38708 (_ldap._tcp.somewhere.com): query (cache)
'_ldap._tcp.somewhere.com/SRV/IN' denied
nov. 04 10:13:31 ipa.somewhere.com named-pkcs11[8585]: client @0x7f3ae80ebf40
172.217.41.200#62570 (_ldap._tcp.somewhere.com): query (cache)
'_ldap._tcp.somewhere.com/SRV/IN' denied
[root@ipa ~]# dig ipa.somewhere.com
; <<>> DiG 9.11.26-RedHat-9.11.26-4.el8_4 <<>> ipa.somewhere.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 22587
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: ec506fda56122893ea1f0c686183a448049b2db129924d5d (good)
;; QUESTION SECTION:
;ipa.somewhere.com. IN A
;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: jeu. nov. 04 10:13:44 CET 2021
;; MSG SIZE rcvd: 80
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
5:14 a.m.
New subject: Fail to restart ipa server after ipa packages updates
Thanks a lot Alexander for your quick answer and as always thanks for to your team for all
works done one freeipa.
I am using a rockylinux 8 which should be close to a centos/rhel
In order to provide more information I put below more log data. So currently I downdgrade
those ipa packages to the previous version and that works and the rest endpoint is
working.
--------------------------
2021-11-05T05:19:24Z DEBUG Loading StateFile from
'/var/lib/ipa/sysupgrade/sysupgrade.state'
2021-11-05T05:19:24Z DEBUG request GET
https://ipa.somewhere.com:8443/ca/rest/account/login
2021-11-05T05:19:24Z DEBUG request body ''
2021-11-05T05:19:24Z DEBUG httplib request failed:
Traceback (most recent call last):
File "/usr/lib/python3.6/site-packages/ipapython/dogtag.py", line 262, in
_httplib_request
conn.request(method, path, body=request_body, headers=headers)
File "/usr/lib64/python3.6/http/client.py", line 1269, in request
self._send_request(method, url, body, headers, encode_chunked)
File "/usr/lib64/python3.6/http/client.py", line 1315, in _send_request
self.endheaders(body, encode_chunked=encode_chunked)
File "/usr/lib64/python3.6/http/client.py", line 1264, in endheaders
self._send_output(message_body, encode_chunked=encode_chunked)
File "/usr/lib64/python3.6/http/client.py", line 1040, in _send_output
self.send(msg)
File "/usr/lib64/python3.6/http/client.py", line 978, in send
self.connect()
File "/usr/lib64/python3.6/http/client.py", line 1429, in connect
super().connect()
File "/usr/lib64/python3.6/http/client.py", line 950, in connect
(self.host,self.port), self.timeout, self.source_address)
File "/usr/lib64/python3.6/socket.py", line 724, in create_connection
raise err
File "/usr/lib64/python3.6/socket.py", line 713, in create_connection
sock.connect(sa)
OSError: [Errno 113] No route to host
2021-11-05T05:19:24Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and
run command ipa-server-upgrade manually.
2021-11-05T05:19:24Z DEBUG File
"/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 180, in execute
return_value = self.run()
File
"/usr/lib/python3.6/site-packages/ipaserver/install/ipa_server_upgrade.py", line
54, in run
server.upgrade()
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/upgrade.py",
line 1961, in upgrade
upgrade_configuration()
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/upgrade.py",
line 1827, in upgrade_configuration
cainstance.repair_profile_caIPAserviceCert()
File "/usr/lib/python3.6/site-packages/ipaserver/install/cainstance.py", line
1981, in repair_profile_caIPAserviceCert
with api.Backend.ra_certprofile as profile_api:
File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py", line
1199, in __enter__
method='GET'
File "/usr/lib/python3.6/site-packages/ipapython/dogtag.py", line 209, in
https_request
method=method, headers=headers)
File "/usr/lib/python3.6/site-packages/ipapython/dogtag.py", line 271, in
_httplib_request
raise NetworkError(uri=uri, error=str(e))
2021-11-05T05:19:24Z DEBUG The ipa-server-upgrade command failed, exception: NetworkError:
cannot connect to 'https://ipa.somewhere.com:8443/ca/rest/account/login': [Errno
113] No route to host
2021-11-05T05:19:24Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details:
NetworkError: cannot connect to
'https://ipa.somewhere.com:8443/ca/rest/account/login': [Errno 113] No route to
host
2021-11-05T05:19:24Z ERROR The ipa-server-upgrade command failed. See
/var/log/ipaupgrade.log for more information
11:51 p.m.
New subject: Fail to restart ipa server after ipa packages updates
I can't tell if this is a clean install or a migration from CentOS to Rocky. I'll
assume it's a new installation (I've not had this happen on new installs). Could
you show ipactl status after upgrading the new packages? Could you also show systemctl
status for each service?
7:54 a.m.
New subject: Fail to restart ipa server after ipa packages updates
Thanks Louis for your help.
I try 2 times on 2 different days to update packages without success (see log from
previous post). So in order to be able to get security updates I put until now all ipa
packages into the exlude list inside dnf.conf file.
I order to provides another try today add to add requested services status, I removed ipa
packages from the exclude list and that seems to works !
Really strange I did not know if in the meantime I got any update that would help ipa to
works today ... really strange
I know I done a server reboot as I got a kernel update ...
I would like to send to the freeipa team and helper a thousand of thanks for yours help
I whish you a awesome day ;-)
Best rergards
-------------------------------
# LANG=C dnf info ipa-server
Last metadata expiration check: 1:36:05 ago on Sun Nov 7 13:13:39 2021.
Installed Packages
Name : ipa-server
Version : 4.9.2
Release : 4.module+el8.4.0+664+1636a961
Architecture : x86_64
Size : 1.0 M
Source : ipa-4.9.2-4.module+el8.4.0+664+1636a961.src.rpm
Repository : @System
From repo : appstream
Summary : The IPA authentication server
URL : http://www.freeipa.org/
License : GPLv3+
Description : IPA is an integrated solution to provide centrally managed Identity
(users,
: hosts, services), Authentication (SSO, 2FA), and Authorization
: (host access control, SELinux user roles, services). The solution provides
: features for further integration with Linux based clients (SUDO,
automount)
: and integration with Active Directory based infrastructures (Trusts).
: If you are installing an IPA server, you need to install this package.
[root@ipa ~]# LANG=C ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
ipa: INFO: The ipactl command was successful
4:30 p.m.
New subject: Fail to restart ipa server after ipa packages updates
You may be hitting was Alexander is pointing out with jss/pki. I think he was suggesting
to have everything updated but have an older JDK build installed instead (eg downgrade
it). I just don't know what version may work or if it's just a matter of going
down just one version. I just don't have an IPA domain that ran into this problem.
Perhaps you could try java-1.8.0-openjdk-1.8.0.302.b08-0.el8_4.x86_64 and see if you still
run into the same issue.
900
days inactive
903
days old
freeipa-users@lists.fedorahosted.org
6 comments
3 participants
participants (3)
-
Alexander Bokovoy -
Louis Abel -
MERCIER Jonathan