Bug 1211708

Can you share /var/log/ipaclient-install.log please?

There is 15 sec timeout for each ntp server.

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/4842

The 15s time is not in ipa-client-4.1.0-18.

master:
    a58b77ca9cd3620201306258dd6bd05ea1c73c73 Timeout when performing time sync during client install 

ipa-4-1:
    80aeb445e2034776f08668bf04dfd711af477b25 Timeout when performing time sync during client install

(In reply to Martin Bašti from comment #2)
> Can you share /var/log/ipaclient-install.log please?
> 
> There is 15 sec timeout for each ntp server.

Oh, I'm so sorry. Forgot to add one step.

Run service chronyd stop before ipa-client-install.

A few last lines from the log:
2015-04-14T16:49:52Z DEBUG Process finished, return code=3
2015-04-14T16:49:52Z DEBUG stdout=
2015-04-14T16:49:52Z DEBUG stderr=Failed to open keytab '/etc/krb5.keytab': No such file or directory

2015-04-14T16:49:52Z INFO Synchronizing time with KDC...
2015-04-14T16:49:52Z DEBUG Search DNS for SRV record of _ntp._udp.lab.eng.brq.redhat.com
2015-04-14T16:49:53Z DEBUG DNS record not found: NXDOMAIN
2015-04-14T16:49:53Z DEBUG Starting external process
2015-04-14T16:49:53Z DEBUG args='/usr/sbin/ntpd' '-qgc' '/tmp/tmp6FwPg1'
2015-04-14T16:50:38Z DEBUG Process interrupted

Hi, this problem still persist. Can you please advise when bug will be fixed and pushed to with latest updates?

IPA server was installed with following options (no ntpd):

ipa-server-install \
-n domain.net \
-r DOMAIN.NET \
-a KBpass \
-p DMpass \
--ip-address=1.1.1.1 \
--hostname=ipa01.domain.net \
--no-ntp \
--no_hbac_allow \
--idstart=50000 \
--idmax=99999 \
--setup-dns \
--no-forwarders \
--reverse-zone=1.1.1.in-addr.arpa \
--zonemgr=admin \
--ssh-trust-dns \
--mkhomedir \
--unattended

When trying to enroll ipa-client:

ipa-client-install --enable-dns-updates --mkhomedir --no-ntp --ssh-trust-dns

I am getting:

Continue to configure the system with these values? [no]: yes
Synchronizing time with KDC...


Is there any workaround?

Fixes for this BZ and for ipa-client-install --no-ntp were not yet released in RHEL. 

Workaround for ipa-client-install --no-ntp is not a have working NTP server which is discoverable through DNS or to apply this patch:
https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=f0c1daf7a2a8c88f6d84d81d66c7e39f571e0894

Your workaround still doesn't work, bug still persist.

Our setup:
1) IPA server running without NTPD servers (as per RHEL recommendations as these are virtual servers - for more details please see official RHEL 7 IDM PDF doc);
2) No other discoverable NTP servers on the network (switched access off temporary);
3) Ensuring that no access to any Network NTP service from client;
4) Executing IPA-CLIENT install with following:

ipa-client-install --enable-dns-updates --mkhomedir --no-ntp --ssh-trust-dns

and getting following same results:

Discovery was successful!
Hostname: myipaclient.domain.net
Realm: DOMAIN.NET
DNS Domain: domain.net
IPA Server: ipa01.domain.net
BaseDN: dc=domain,dc=net

Continue to configure the system with these values? [no]: yes
Synchronizing time with KDC...

So problem still persist and this is really anoying as it was working on first RHEL 7 release, earlier version of IPA-CLIENT. We need to enroll hundreds of RHEL servers and trying to make them working manually is an effort.

Please advise about possible workarounds, upcoming fixed version dates. Thanks

In addition to my previous comments, this is what is happening in ipa-client install debug logs:

2015-05-04T21:25:55Z DEBUG Search DNS for SRV record of _ntp._udp.domain.net
2015-05-04T21:25:55Z DEBUG DNS record not found: NXDOMAIN
2015-05-04T21:25:55Z DEBUG Starting external process
2015-05-04T21:25:55Z DEBUG args='/usr/sbin/ntpd' '-qgc' '/tmp/tmpCkyhb2'

Why is searching for ntp if I am passing options --no-ntp..

It's searching for ntp because there is a bug which will be fixed by a patch in comment 8.

Wrt comment 9: Sorry, there was a typo. I meant the opposite: "to have a working NTP server". In other words, because ipa-client-install tries to sync the time no matter what, one should either allow it to happen, fix the bug(comment 8) or fool it in other way.

1) I have same problem even if I am pointing to NTP server by adding option:
--ntp-server=xxx.xxx.xxx.xxx
2) How to apply in comment 8 given fix? It is fedora package, not RHEL..

We are talking here about RHEL production machines!

As far as I know, the only applicable workaround for your case would be to create _ntp._udp.IPA_DOMAIN DNS SRV records that would be pointing to a valid NTP server (it does not necessarily have to be a FreeIPA NTP server). ipa-client-install should then use this/these NTP server(s) for the one-time synchronization.

This is the workaround we propose. The proper fix is proposed for next RHEL minor version (7.2). If you want to request a more expedited fix (i.e. EUS/7.1 backport), please contact your Customer Service representative that will be able to discuss the available options with you.

Great, thanks. Confirmed that proposed workaround:"create _ntp._udp.IPA_DOMAIN DNS SRV records that would be pointing to a valid NTP server" works as expected.

Created attachment 1073166 [details]
Evidence of verify

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2362.html

(In reply to Pavel Picka from comment #17)
> Created attachment 1073166 [details]
> Evidence of verify

Was the part about --no-ntp tested?

Do you mean with server-install or with client-install?

(In reply to Pavel Picka from comment #20)
> Do you mean with server-install or with client-install?

ipa-client-install --no-ntp.