OK, I quickly realized I couldn't yum/dnf downgrade as I still had a version/data mismatch. Now I understand what the error means. I did the latter part of my previous question and performed an ipa-server-upgrade. .... ..... The IPA services were upgraded The ipa-server-upgrade command was successful
Now I tried to start my ipa server but had limited success. Named service won't start .... .... Starting named Service Failed to start named Service Shutting down I tried to force and see what else would have issues #ipactl start --ignore-service-failure .... .... Failed to start named Service Forced start, ignoring named Service, continuing normal operation .... .... Starting ipa-dnskeysyncd Service Failed to start ipa-dnskeysyncd Service Forced start, ignoring ipa-dnskeysyncd Service, continuing normal operation ipa: INFO: The ipactl command was successful Here is the entire sequence- [root@utility slapd-IDM-NAC-ISSA-ORG]# ipa-server-upgrade Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/9]: saving configuration [2/9]: disabling listeners [3/9]: enabling DS global lock [4/9]: disabling Schema Compat [5/9]: starting directory server [6/9]: updating schema [7/9]: upgrading server [8/9]: stopping directory server [9/9]: restoring configuration Done. Update complete Upgrading IPA services Upgrading the configuration of the IPA services Disabled p11-kit-proxy [Verifying that root certificate is published] [Migrate CRL publish directory] CRL tree already moved [Verifying that KDC configuration is using ipa-kdb backend] [Fix DS schema file syntax] Syntax already fixed [Removing RA cert from DS NSS database] RA cert already removed [Enable sidgen and extdom plugins by default] [Updating HTTPD service IPA configuration] [Updating HTTPD service IPA WSGI configuration] Nothing to do for configure_httpd_wsgi_conf [Migrating from mod_nss to mod_ssl] Already migrated to mod_ssl [Moving HTTPD service keytab to gssproxy] [Removing self-signed CA] [Removing Dogtag 9 CA] [Checking for deprecated KDC configuration files] [Checking for deprecated backups of Samba configuration files] [Remove FILE: prefix from 'dedicated keytab file' in Samba configuration] [Update 'max smbd processes' in Samba configuration to prevent unlimited SMBLoris attack amplification] dnssec-validation yes [Add missing CA DNS records] IPA CA DNS records already processed DNS service is not configured [Upgrading CA schema] CA schema update complete [Update certmonger certificate renewal configuration] Certmonger certificate renewal configuration already up-to-date [Enable PKIX certificate path discovery and validation] PKIX already enabled [Authorizing RA Agent to modify profiles] [Authorizing RA Agent to manage lightweight CAs] [Ensuring Lightweight CAs container exists in Dogtag database] [Adding default OCSP URI configuration] [Disabling cert publishing] pki-tomcat configuration changed, restart pki-tomcat [Ensuring CA is using LDAPProfileSubsystem] [Migrating certificate profiles to LDAP] Migrating profile 'caECServerCertWithSCT' Migrating profile 'caServerCertWithSCT' Migrating profile 'caServerKeygen_DirUserCert' Migrating profile 'caServerKeygen_UserCert' [Ensuring presence of included profiles] [Add default CA ACL] Default CA ACL already added [Updating ACME configuration] [Migrating to authselect profile] Already migrated to authselect profile [Create systemd-user hbac service and rule] hbac service systemd-user already exists [Add [email protected] alias to admin account] Alias already exists [Setup SPAKE] [Setup PKINIT] [Enable server krb5.conf snippet] [Adding ipa-ca alias to HTTP certificate] Resubmitting HTTP cert tracking request The IPA services were upgraded The ipa-server-upgrade command was successful [root@utility slapd-IDM-NAC-ISSA-ORG]# ipactl start Existing service file detected! Assuming stale, cleaning and proceeding Starting Directory Service Starting krb5kdc Service Starting kadmin Service Starting named Service Failed to start named Service Shutting down Hint: You can use --ignore-service-failure option for forced start in case that a non-critical service failed Aborting ipactl [root@utility slapd-IDM-NAC-ISSA-ORG]# ipactl start --ignore-service-failure Existing service file detected! Assuming stale, cleaning and proceeding Starting Directory Service Starting krb5kdc Service Starting kadmin Service Starting named Service Failed to start named Service Forced start, ignoring named Service, continuing normal operation Starting httpd Service Starting ipa-custodia Service Starting pki-tomcatd Service Starting smb Service Starting winbind Service Starting ipa-otpd Service Starting ipa-dnskeysyncd Service Failed to start ipa-dnskeysyncd Service Forced start, ignoring ipa-dnskeysyncd Service, continuing normal operation ipa: INFO: The ipactl command was successful [root@utility slapd-IDM-NAC-ISSA-ORG]# ________________________________ From: Jeremy Tourville <[email protected]> Sent: Saturday, August 28, 2021 6:45 PM To: [email protected] <[email protected]> Cc: Rob Crittenden <[email protected]> Subject: Re: [Freeipa-users] Unable to start directory server after updates CentOS Linux release 8.4.2105 VERSION: 4.9.2, API_VERSION: 2.240 Prior to any updates I was at ver 8.2 of CentOS The shared library was loaded and now I can start dirsrv. THANKS! That's definitely big a step in the right direction. As I thought, my upgrade looks like it caused the version be too new for the existing dirsrv data. I thought I had set my OS distro release version and that is my own dumb mistake... IPA version error: data needs to be upgraded (expected version '4.9.2-4.module_el8.4.0+846+96522ed7', current version '4.8.4-7.module_el8.2.0+374+0d2d74a1') I am thinking I could downgrade to get things up and running or do you suggest upgrading the data to work with the application version I have installed? [root@utility slapd-IDM-NAC-ISSA-ORG]# ipactl status Directory Service: RUNNING krb5kdc Service: STOPPED kadmin Service: STOPPED named Service: STOPPED httpd Service: STOPPED ipa-custodia Service: STOPPED pki-tomcatd Service: STOPPED smb Service: STOPPED winbind Service: STOPPED ipa-otpd Service: STOPPED ipa-dnskeysyncd Service: STOPPED 9 service(s) are not running [root@utility slapd-IDM-NAC-ISSA-ORG]# ipactl start IPA version error: data needs to be upgraded (expected version '4.9.2-4.module_el8.4.0+846+96522ed7', current version '4.8.4-7.module_el8.2.0+374+0d2d74a1') Automatically running upgrade, for details see /var/log/ipaupgrade.log Be patient, this may take a few minutes. Starting Directory Service Starting krb5kdc Service Starting kadmin Service Starting named Service Failed to start named Service Shutting down Hint: You can use --ignore-service-failure option for forced start in case that a non-critical service failed Aborting ipactl ________________________________ From: Rob Crittenden <[email protected]> Sent: Saturday, August 28, 2021 5:31 PM To: FreeIPA users list <[email protected]> Cc: Jeremy Tourville <[email protected]> Subject: Re: [Freeipa-users] Unable to start directory server after updates Jeremy Tourville via FreeIPA-users wrote: > I was doing some maintenance and updates this morning. At some point I > noticed I couldn't reach the web interface anymore. My server has been up > and running for the last year and is not a new install. I reviewed > //var/log/dirsrv/slapd-IDM-NAC-ISSA-ORG/errors. I also confirmed I did not > have disk space issues. > > Here is part of my log file: > [28/Aug/2021:10:46:35.380380540 -0500] - INFO - slapd_daemon - slapd started. > Listening on All Interfaces port 389 for LDAP requests > [28/Aug/2021:10:46:35.383040751 -0500] - INFO - slapd_daemon - Listening on > All Interfaces port 636 for LDAPS requests > [28/Aug/2021:10:46:35.385415998 -0500] - INFO - slapd_daemon - Listening on > /var/run/slapd-IDM-NAC-ISSA-ORG.socket for LDAPI requests > [28/Aug/2021:10:46:35.439358079 -0500] - ERR - schema-compat-plugin - > schema-compat-plugin tree scan will start in about 5 seconds! > [28/Aug/2021:10:46:40.494600578 -0500] - WARN - str2entry_dupcheck - > Duplicate value for attribute type memberUid detected in entry > cn=sudo-infra,cn=groups,cn=compat,dc=idm,dc=nac-issa,dc=org. Extra value > ignored. > [28/Aug/2021:10:46:40.527665958 -0500] - WARN - str2entry_dupcheck - > Duplicate value for attribute type memberUid detected in entry > cn=sudo-devel,cn=groups,cn=compat,dc=idm,dc=nac-issa,dc=org. Extra value > ignored. > [28/Aug/2021:10:46:40.560185359 -0500] - ERR - schema-compat-plugin - > warning: no entries set up under cn=computers, > cn=compat,dc=idm,dc=nac-issa,dc=org > [28/Aug/2021:10:46:40.582782578 -0500] - ERR - schema-compat-plugin - > Finished plugin initialization. > [28/Aug/2021:11:20:49.697931599 -0500] - INFO - op_thread_cleanup - slapd > shutting down - signaling operation threads - op stack size 4 max work q size > 2 max work q stack size 2 > [28/Aug/2021:11:20:49.706989092 -0500] - INFO - slapd_daemon - slapd shutting > down - closing down internal subsystems and plugins > [28/Aug/2021:11:20:49.724450159 -0500] - INFO - bdb_pre_close - Waiting for 4 > database threads to stop > [28/Aug/2021:11:20:51.131059518 -0500] - INFO - bdb_pre_close - All database > threads now stopped > [28/Aug/2021:11:20:51.152587508 -0500] - INFO - > ldbm_back_instance_set_destructor - Set of instances destroyed > [28/Aug/2021:11:20:51.155514615 -0500] - INFO - > connection_post_shutdown_cleanup - slapd shutting down - freed 2 work q stack > objects - freed 7 op stack objects > [28/Aug/2021:11:20:51.158002944 -0500] - INFO - main - slapd stopped. > [28/Aug/2021:13:14:20.585994349 -0500] - NOTICE - config_set_port - > Non-Secure Port Disabled > [28/Aug/2021:13:14:20.607117053 -0500] - ERR - symload_report_error - > Netscape Portable Runtime error -5977: > /usr/lib64/dirsrv/plugins/libipa_cldap.so: cannot open shared object file: No > such file or directory > [28/Aug/2021:13:14:20.609768545 -0500] - ERR - symload_report_error - Could > not open library "/usr/lib64/dirsrv/plugins/libipa_cldap.so" for plugin > ipa_cldap > [28/Aug/2021:13:14:20.612257544 -0500] - ERR - load_plugin_entry - Unable to > load plugin "cn=ipa_cldap,cn=plugins,cn=config" > [28/Aug/2021:13:14:21.012890173 -0500] - ERR - symload_report_error - > Netscape Portable Runtime error -5977: > /usr/lib64/dirsrv/plugins/libipa_cldap.so: cannot open shared object file: No > such file or directory > [28/Aug/2021:13:14:21.018097465 -0500] - ERR - symload_report_error - Could > not open library "/usr/lib64/dirsrv/plugins/libipa_cldap.so" for plugin > ipa_cldap > [28/Aug/2021:13:14:21.020655816 -0500] - ERR - load_plugin_entry - Unable to > load plugin "cn=ipa_cldap,cn=plugins,cn=config" > [28/Aug/2021:13:15:53.219524942 -0500] - ERR - symload_report_error - > Netscape Portable Runtime error -5977: > /usr/lib64/dirsrv/plugins/libipa_cldap.so: cannot open shared object file: No > such file or directory > [28/Aug/2021:13:15:53.228547473 -0500] - ERR - symload_report_error - Could > not open library "/usr/lib64/dirsrv/plugins/libipa_cldap.so" for plugin > ipa_cldap > [28/Aug/2021:13:15:53.231054342 -0500] - ERR - load_plugin_entry - Unable to > load plugin "cn=ipa_cldap,cn=plugins,cn=config" > [28/Aug/2021:13:17:13.917125368 -0500] - NOTICE - config_set_port - > Non-Secure Port Disabled > [28/Aug/2021:13:17:13.932712979 -0500] - ERR - symload_report_error - > Netscape Portable Runtime error -5977: > /usr/lib64/dirsrv/plugins/libipa_cldap.so: cannot open shared object file: No > such file or directory > [28/Aug/2021:13:17:13.935253118 -0500] - ERR - symload_report_error - Could > not open library "/usr/lib64/dirsrv/plugins/libipa_cldap.so" for plugin > ipa_cldap > [28/Aug/2021:13:17:13.937761206 -0500] - ERR - load_plugin_entry - Unable to > load plugin "cn=ipa_cldap,cn=plugins,cn=config" > > Can anyone offer troubleshooting suggestions? Do you need a debug file or is > this log enough? Thanks in advance for your input! Knowing the distribution and version would help. This missing shared library is provided by [free]ipa-server-trust-ad, ipa-server, or something like it depending on the release. rob
_______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
