Bug 1075165
| Summary: | ipa-replica-install never checks for 7389 port | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Martin Kosek <mkosek> |
| Component: | ipa | Assignee: | Martin Kosek <mkosek> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Namita Soman <nsoman> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 7.0 | CC: | dpal, mkosek, rcritten, spoore |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-3.3.3-22.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-06-13 11:04:34 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1073810 | ||
|
Description
Martin Kosek
2014-03-11 15:48:28 UTC
Fixed upstream master: https://fedorahosted.org/freeipa/changeset/0be66e9a67e433d36b9e4c00a17b45393d51a888 ipa-3-3: https://fedorahosted.org/freeipa/changeset/892daaa79dba5473b30816d97e15b27d7d4b9d58 Just to clarify, to test this, we will have to test against a RHEL6 IPA master, right? Ok, I tested with ipa-server-3.3.3-18.el7 to successfully reproduce the issue with a RHEL 6.5 IPA Master:
[root@replica1 ~]# ipa-replica-install -U --setup-ca --setup-dns --forwarder=$DNSFORWARD \
> -w Secret123 -p Secret123 /dev/shm/replica-info-$REPLICA1.gpg
Run connection check to master
Check connection from replica to remote master 'master.ipa1075165.example.test':
Directory Service: Unsecure port (389): OK
Directory Service: Secure port (636): OK
Kerberos KDC: TCP (88): OK
Kerberos Kpasswd: TCP (464): OK
HTTP Server: Unsecure port (80): OK
HTTP Server: Secure port (443): OK
The following list of ports use UDP protocol and would need to be
checked manually:
Kerberos KDC: UDP (88): SKIPPED
Kerberos Kpasswd: UDP (464): SKIPPED
Connection from replica to master is OK.
Start listening on required ports for remote master check
Get credentials to log in to remote master
Check SSH connection to remote master
Execute check on remote master
Check connection from master to remote replica 'replica1.ipa1075165.example.test':
Directory Service: Unsecure port (389): OK
Directory Service: Secure port (636): OK
Kerberos KDC: TCP (88): OK
Kerberos KDC: UDP (88): OK
Kerberos Kpasswd: TCP (464): OK
Kerberos Kpasswd: UDP (464): OK
HTTP Server: Unsecure port (80): OK
HTTP Server: Secure port (443): OK
Connection from master to replica is OK.
Connection check OK
ipa : CRITICAL CA DS schema check failed. Make sure the PKI service on the remote master is operational.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
Can't contact LDAP server
Verified. Version :: ipa-server-3.3.3-25.el7.x86_64 Results :: IPA Master setup on RHEL 6.5 server and ipa-replica-prepare run and copied to RHEL 7.0 replica server. Then result below: [root@replica1 ~]# ipa-replica-install -U --setup-ca --setup-dns --forwarder=$DNSFORWARD -w Secret123 -p Secret123 /dev/shm/replica-info-$REPLICA1.gpg Run connection check to master Check connection from replica to remote master 'master.ipa1075165.example.test': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos Kpasswd: TCP (464): OK HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK PKI-CA: Directory Service port (7389): FAILED Port check failed! Inaccessible port(s): 7389 (TCP) Connection check failed! Please fix your network settings according to error messages above. If the check results are not valid it can be skipped with --skip-conncheck parameter. ACK - this is perfect verification. Thanks! This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. |