Had some success earlier today, but I seem to be unable to replicate it. I've been working with the "full" proxy.conf file lately,. and even that seems to be preventing a replica. It is quite possible that the problem is something on one of the two systems, as I've found that install/uninstall often leaves some of the files being owned by non-existent users. At this point, I'm not sure if the patch I've submitted will work on a vanilla system. Testing it has proven to be a pretty time consuming endeavour. Here's what I've gotten it down to: ON One machine, run ipa-server-install -U -r ` hostname | tr '[:lower:]' '[:upper:]'` -p freeipa4all -a freeipa4all --setup-dns --no-forwarders once that succeeds, I have to reset /etc/resolv.conf as the lab DNS server gets removed: cp ~/resolve.conf /etc then ipa-replica-prepare $REPLICA scp /var/lib/ipa/replica-info-$REPLICA.gpg root@$REPLICA: On the replica: ipa-replica-install --setup-ca replica-info-$HOSTNAME.gpg I have firewall off on master and replica At one point I had a replica install that worked with the Proxy, so I know it is possible, but for the last couple of hours this last command has been failing with: creation of replica failed: Configuration of CA failed pkisilent reports the failure in the debug log, but not the URL it is trying to reach. I'm going to modify it to give some more information in the morning. I'm not seeing anything in /var/log/httpd/error|access.log on the master, which is weird. I see this in /var/log/ipareplica-conncheck.log. We should not be trying to do anything in /home/admin 2011-08-24 21:52:18,544 DEBUG stderr= 2011-08-24 21:52:19,521 DEBUG args=/usr/bin/ssh -q -o StrictHostKeychecking=no -o UserKnownHostsFile=/dev/null admin@vm-088.idm.lab.bos.redhat.com /usr/sbin/ipa-replica-conncheck --replica vm-116.idm.lab.bos.redhat.com --check-ca 2011-08-24 21:52:19,521 DEBUG stdout=Check connection from master to remote replica 'vm-116.idm.lab.bos.redhat.com': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos (88): OK PKI-CA: Directory Service port (7389): OK PKI-CA: Agent secure port (9443): OK PKI-CA: EE secure port (9444): OK PKI-CA: Admin secure port (9445): OK PKI-CA: EE secure client auth port (9446): OK PKI-CA: Unsecure port (9180): OK Connection from master to replica is OK. 2011-08-24 21:52:19,522 DEBUG stderr=Could not chdir to home directory /home/admin: No such file or directory Ade Lee noticed that the replica install is failing before it ever attempts to talk to the Master, which corresponds with what I am seeing. I see in the PKI install log that [2011-08-24 22:23:50] [error] FAILED run_command("/sbin/service pki-cad restart pki-ca"), exit status=1 output="Stopping pki-ca: [FAILED] Starting pki-ca: [ OK ]^M" Running this command by hand gets the same output. In less /var/log/pki-ca/catalina.out /var/lib/pki-ca/logs/catalina.out: Permission denied /var/log/pki-ca/catalina.out (END) SO it looks like another cleanup issue.
When I looked at one point, I noticed that /var/log/pki-ca/catalina.out was owned by root. And in fact the whole /var/log/pki-ca directory was owned by root. If the CA process runs as pkiuser, that would explain the permission denied bit. Adam, please reproduce and do not clean up. I can go in at that point and try to figure out what went wrong. Ade On Wed, 2011-08-24 at 22:29 -0400, Adam Young wrote:
Had some success earlier today, but I seem to be unable to replicate it. I've been working with the "full" proxy.conf file lately,. and even that seems to be preventing a replica. It is quite possible that the problem is something on one of the two systems, as I've found that install/uninstall often leaves some of the files being owned by non-existent users. At this point, I'm not sure if the patch I've submitted will work on a vanilla system. Testing it has proven to be a pretty time consuming endeavour.
Here's what I've gotten it down to:
ON One machine, run
ipa-server-install -U -r ` hostname | tr '[:lower:]' '[:upper:]'` -p freeipa4all -a freeipa4all --setup-dns --no-forwarders
once that succeeds, I have to reset /etc/resolv.conf as the lab DNS server gets removed:
cp ~/resolve.conf /etc
then
ipa-replica-prepare $REPLICA
scp /var/lib/ipa/replica-info-$REPLICA.gpg root@$REPLICA:
On the replica:
ipa-replica-install --setup-ca replica-info-$HOSTNAME.gpg
I have firewall off on master and replica
At one point I had a replica install that worked with the Proxy, so I know it is possible, but for the last couple of hours this last command has been failing with:
creation of replica failed: Configuration of CA failed
pkisilent reports the failure in the debug log, but not the URL it is trying to reach. I'm going to modify it to give some more information in the morning.
I'm not seeing anything in /var/log/httpd/error|access.log on the master, which is weird.
I see this in /var/log/ipareplica-conncheck.log. We should not be trying to do anything in /home/admin
2011-08-24 21:52:18,544 DEBUG stderr= 2011-08-24 21:52:19,521 DEBUG args=/usr/bin/ssh -q -o StrictHostKeychecking=no -o UserKnownHostsFile=/dev/null admin@vm-088.idm.lab.bos.redhat.com /usr/sbin/ipa-replica-conncheck --replica vm-116.idm.lab.bos.redhat.com --check-ca 2011-08-24 21:52:19,521 DEBUG stdout=Check connection from master to remote replica 'vm-116.idm.lab.bos.redhat.com': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos (88): OK PKI-CA: Directory Service port (7389): OK PKI-CA: Agent secure port (9443): OK PKI-CA: EE secure port (9444): OK PKI-CA: Admin secure port (9445): OK PKI-CA: EE secure client auth port (9446): OK PKI-CA: Unsecure port (9180): OK
Connection from master to replica is OK.
2011-08-24 21:52:19,522 DEBUG stderr=Could not chdir to home directory /home/admin: No such file or directory
Ade Lee noticed that the replica install is failing before it ever attempts to talk to the Master, which corresponds with what I am seeing. I see in the PKI install log that
[2011-08-24 22:23:50] [error] FAILED run_command("/sbin/service pki-cad restart pki-ca"), exit status=1 output="Stopping pki-ca: [FAILED] Starting pki-ca: [ OK ]^M"
Running this command by hand gets the same output.
In less /var/log/pki-ca/catalina.out
/var/lib/pki-ca/logs/catalina.out: Permission denied /var/log/pki-ca/catalina.out (END)
SO it looks like another cleanup issue.
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
On 08/24/2011 10:59 PM, Ade Lee wrote:
When I looked at one point, I noticed that /var/log/pki-ca/catalina.out was owned by root. And in fact the whole /var/log/pki-ca directory was owned by root.
If the CA process runs as pkiuser, that would explain the permission denied bit.
/var/log/pki-ca and it's contents should be owned by pkiuser. However not all copies of catalina.out which get created should be owned by pkiuser, see: https://bugzilla.redhat.com/show_bug.cgi?id=693815 The distinction is there is a log file written to by the initscript before the pki process begins. Doesn't sound like this applies to in this instance, but just FYI. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
Adam Young wrote:
Had some success earlier today, but I seem to be unable to replicate it. I've been working with the "full" proxy.conf file lately,. and even that seems to be preventing a replica. It is quite possible that the problem is something on one of the two systems, as I've found that install/uninstall often leaves some of the files being owned by non-existent users. At this point, I'm not sure if the patch I've submitted will work on a vanilla system. Testing it has proven to be a pretty time consuming endeavour.
Here's what I've gotten it down to:
ON One machine, run
ipa-server-install -U -r ` hostname | tr '[:lower:]' '[:upper:]'` -p freeipa4all -a freeipa4all --setup-dns --no-forwarders
once that succeeds, I have to reset /etc/resolv.conf as the lab DNS server gets removed:
cp ~/resolve.conf /etc
You could also not use --setup-dns on the master.
then
ipa-replica-prepare $REPLICA
scp /var/lib/ipa/replica-info-$REPLICA.gpg root@$REPLICA:
On the replica:
ipa-replica-install --setup-ca replica-info-$HOSTNAME.gpg
I have firewall off on master and replica
At one point I had a replica install that worked with the Proxy, so I know it is possible, but for the last couple of hours this last command has been failing with:
creation of replica failed: Configuration of CA failed
pkisilent reports the failure in the debug log, but not the URL it is trying to reach. I'm going to modify it to give some more information in the morning.
I'm not seeing anything in /var/log/httpd/error|access.log on the master, which is weird.
I see this in /var/log/ipareplica-conncheck.log. We should not be trying to do anything in /home/admin
2011-08-24 21:52:18,544 DEBUG stderr= 2011-08-24 21:52:19,521 DEBUG args=/usr/bin/ssh -q -o StrictHostKeychecking=no -o UserKnownHostsFile=/dev/null admin@vm-088.idm.lab.bos.redhat.com /usr/sbin/ipa-replica-conncheck --replica vm-116.idm.lab.bos.redhat.com --check-ca 2011-08-24 21:52:19,521 DEBUG stdout=Check connection from master to remote replica 'vm-116.idm.lab.bos.redhat.com': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos (88): OK PKI-CA: Directory Service port (7389): OK PKI-CA: Agent secure port (9443): OK PKI-CA: EE secure port (9444): OK PKI-CA: Admin secure port (9445): OK PKI-CA: EE secure client auth port (9446): OK PKI-CA: Unsecure port (9180): OK
Connection from master to replica is OK.
2011-08-24 21:52:19,522 DEBUG stderr=Could not chdir to home directory /home/admin: No such file or directory
We ssh to the remote machine so we can be sure that the firewall is open in both directions. This is just a side-effect of authenticating as admin.
Ade Lee noticed that the replica install is failing before it ever attempts to talk to the Master, which corresponds with what I am seeing. I see in the PKI install log that
[2011-08-24 22:23:50] [error] FAILED run_command("/sbin/service pki-cad restart pki-ca"), exit status=1 output="Stopping pki-ca: [FAILED] Starting pki-ca: [ OK ]^M"
Running this command by hand gets the same output.
In less /var/log/pki-ca/catalina.out
/var/lib/pki-ca/logs/catalina.out: Permission denied /var/log/pki-ca/catalina.out (END)
SO it looks like another cleanup issue.
I don't think so. pkiremove removes all pki-ca directories including logs. You might try strace on it to see what is going on. rob
participants (4)
-
Adam Young -
Ade Lee -
John Dennis -
Rob Crittenden