Hi Christian Some things to check first: Have you checked your times are in sync within 5 minutes? Have you checked DNS is working for all node entries between all nodes? Have you used ipactl [status|restart|stop]? -> Do you see certain services fail and have you checked their logs?
I'm hoping your remaining IPA server is the renewal master: On remaining good server: kinit admin ipa config-show | grep "IPA CA renewal master" If it is then the following rebuild instructions should be ok. If it is not, then you prolly need some other advice (I haven't faced that situation yet ...) I have recently rebuilt a couple of our IPA servers, the process I followed was: On another ipa server: ipa server-del <FQDN_of_ipa_to_be_deleted> Then on deleted IPA server ipa-server-install --uninstall ipa-client-install (with the standard options you use specific to your environment) ipa-replica-install --principal admin --setup-ca --mkhomedir --no-ntp (options above specific to my environment, check man page for suitable options) In my environment, the IPAs to be rebuilt were responding, so you might hit some issues removing replica agreements (ipa server-del) with the state of 2 of your IPAs. Regards Angus ________________________________ From: Christian Reiss via FreeIPA-users <[email protected]> Sent: 06 December 2019 14:24 To: [email protected] <[email protected]> Cc: Christian Reiss <[email protected]> Subject: [Freeipa-users] No Login on GUI Hey folks, I am running a 4.6.5 (CentOS 7) Cluster containing out of 3 nodes. Replication is working and I have been using it for nearly a year now. Now, two issues arose. First on my first node, I can no longer login to the WebUI, neither with password nor with Kerberos Login. I can login on the 2nd node without any issues. Replication works, however (If I delete a host on node1 it is replicated to node2, and creating a host on node2 will replicate to node1). /var/log/httpd/* yields not usable errors. Login with password just says "wrong password". Second issue: My home server where node3 was running died. I have file based backup, but several errors are flashing up, no good. Can I simply replace the VM with a fresh one, re-attach it using the same name and all is well? What would be the correct way to replace a node? Thanks for your help, Chris. -- Christian Reiss - [email protected] /"\ ASCII Ribbon [email protected] \ / Campaign X against HTML WEB alpha-labs.net / \ in eMails GPG Retrieval https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgpg.christian-reiss.de&data=02%7C01%7C%7C858fb3983cad4901a88c08d77a4f9f5b%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637112354703072684&sdata=6xuCi5AgQjI6bIBxpFnXn%2FFrH7GKRLJCJ45SRTTgtpg%3D&reserved=0 GPG ID ABCD43C5, 0x44E29126ABCD43C5 GPG fingerprint = 9549 F537 2596 86BA 733C A4ED 44E2 9126 ABCD 43C5 "It's better to reign in hell than to serve in heaven.", John Milton, Paradise lost. _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedoraproject.org%2Fen-US%2Fproject%2Fcode-of-conduct%2F&data=02%7C01%7C%7C858fb3983cad4901a88c08d77a4f9f5b%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637112354703072684&sdata=FE0gknVRxyB6rhdhZHNyZy8m68FRQHJzgeV73pmtpww%3D&reserved=0 List Guidelines: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedoraproject.org%2Fwiki%2FMailing_list_guidelines&data=02%7C01%7C%7C858fb3983cad4901a88c08d77a4f9f5b%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637112354703072684&sdata=y0%2Bh0kImW1xFFjrQXsnKNkvRobjGPNByAkmHo%2FzetQ0%3D&reserved=0 List Archives: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fedorahosted.org%2Farchives%2Flist%2Ffreeipa-users%40lists.fedorahosted.org&data=02%7C01%7C%7C858fb3983cad4901a88c08d77a4f9f5b%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637112354703072684&sdata=P6TGFzzh6IaCeMH5ko5%2BeBltM%2FkyIlBaEaROvUSGz5E%3D&reserved=0
_______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
