Hey everyone: I posted this like a week ago and didn't get a response. Hoping someone can respond, since it's happened to us again. Any ideas? On 2018-06-12 10:58, greg(a)greg-gilbert.com wrote: > Hi all, > > I've been having an issue recently where my servers can't install > FreeIPA due to this error: > > Cannot connect to the server due to generic error: error marshalling > data for XML-RPC transport: message: need a <type 'unicode'>; got 'No > valid Negotiate header in server response' (a <type 'str'>) > Installation failed. Rolling back changes. > Unenrolling client from IPA server > > Restarting FreeIPA (ipactl stop, ipactl start) solves the solution, > but not permanently. > > I captured the FreeIPA logs during that event, which you can see here: > https://pastebin.com/WL7Cg90V > > Any ideas what's going wrong? One solution would be to have a cron > restart FreeIPA nightly, but that's not ideal. >

> Thanks, > Greg > _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...

Jul 11 16:40:01 ipa.services.COMPANY audit[10280]: USER_ACCT pid=10280 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct="fedora" exe="/usr/sbin/cron Jul 11 16:40:01 ipa.services.COMPANY audit[10280]: CRED_ACQ pid=10280 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_localuser,pam_unix acct="fedora" exe="/usr/sbin/crond" host Jul 11 16:40:01 ipa.services.COMPANY crond[10280]: pam_systemd(crond:session): FAILED TO CREATE SESSION: MAXIMUM NUMBER OF SESSIONS (8192) REACHED, REFUSING FURTHER SESSIONS. Jul 11 16:40:01 ipa.services.COMPANY audit[10280]: USER_START pid=10280 uid=0 auid=1000 ses=28963 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_sss acct="fedora" exe="/usr/sbin/cr Jul 11 16:40:01 ipa.services.COMPANY audit[10280]: CRED_REFR pid=10280 uid=0 auid=1000 ses=28963 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_localuser,pam_unix acct="fedora" exe="/usr/sbin/crond" hostname=? add Jul 11 16:40:01 ipa.services.COMPANY CROND[10282]: (fedora) CMD (cd /opt/cleanup && /opt/cleanup/venv/bin/python host-cleanup.py >> /var/log/cron)

Hey, Sorry for the delay, I couldn't reproduce the issue at the time, but it's happening now. Yes, gssproxy is running: > # systemctl status gssproxy.service > ● gssproxy.service - GSSAPI Proxy Daemon > Loaded: loaded (/usr/lib/systemd/system/gssproxy.service; disabled; vendor preset: disabled) > Active: active (running) since Thu 2018-03-15 17:08:17 UTC; 3 months 26 days ago > Main PID: 24938 (gssproxy) > Tasks: 6 (limit: 4915) > CGroup: /system.slice/gssproxy.service > └─24938 /usr/sbin/gssproxy -D I also have a /etc/gssproxy/10-ipa.conf proxy file - I saw that come up in another thread. - greg On 2018-06-22 08:40, Florence Blanc-Renaud via FreeIPA-users wrote: On 06/21/2018 06:05 PM, None via FreeIPA-users wrote: Hey everyone: I posted this like a week ago and didn't get a response. Hoping someone can respond, since it's happened to us again. Any ideas? On 2018-06-12 10:58, greg(a)greg-gilbert.com wrote: Hi all, I've been having an issue recently where my servers can't install FreeIPA due to this error: Cannot connect to the server due to generic error: error marshalling data for XML-RPC transport: message: need a <type 'unicode'>; got 'No valid Negotiate header in server response' (a <type 'str'>) Installation failed. Rolling back changes. Unenrolling client from IPA server Restarting FreeIPA (ipactl stop, ipactl start) solves the solution, but not permanently. I captured the FreeIPA logs during that event, which you can see here: https://pastebin.com/WL7Cg90V Any ideas what's going wrong? One solution would be to have a cron restart FreeIPA nightly, but that's not ideal.

> Thanks, > Greg _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...