Christian Reiss via FreeIPA-users wrote: > Hey folks, > > happyily using FreeIPA in my personal hobbyist space across 50vms and 8 > hosts. It worked like a charm. Ever since a few days ago I am unable to > delete hosts, disabling/ enabling users for example works, but not > deleting hosts. I am using AlmaLinux 8 with vendor-supplied FreeIPA > version. > > I duckduckgo'd around the net, tried to solve the issue myself. But no > errors our there helped me debug. I think I found the issue with > ipa-healthcheck, but I am unsure on how to fix. This is the output:
Start with this thread, https://lists.fedoraproject.org/archives/list/[email protected]/thread/NZLD5WHI4GCM2B437WPPD4HIHSCJT45F/#NCQWDDUK5X3FFL7FQ5V7D5HOOLXUFDWI rob > > ---- 8< ---- ---- 8< ---- ---- 8< ---- ---- 8< ---- ---- 8< ---- > > Internal server error 403 Client Error: 403 for url: > http://auth1.alpha-labs.net:80/ca/rest/securityDomain/domainInfo > Directory Server CA certificate not found, assuming 3rd party > ra.get_certificate(): Request failed with status 403: Non-2xx response > from CA REST API: 403. (403) > ra.get_certificate(): Request failed with status 403: Non-2xx response > from CA REST API: 403. (403) > ra.get_certificate(): Request failed with status 403: Non-2xx response > from CA REST API: 403. (403) > ra.get_certificate(): Request failed with status 403: Non-2xx response > from CA REST API: 403. (403) > ra.get_certificate(): Request failed with status 403: Non-2xx response > from CA REST API: 403. (403) > ra.get_certificate(): Request failed with status 403: Non-2xx response > from CA REST API: 403. (403) > ra.get_certificate(): Request failed with status 403: Non-2xx response > from CA REST API: 403. (403) > ra.get_certificate(): Request failed with status 403: Non-2xx response > from CA REST API: 403. (403) > ra.get_certificate(): Request failed with status 403: Non-2xx response > from CA REST API: 403. (403) > ra.get_certificate(): Request failed with status 403: Non-2xx response > from CA REST API: 403. (403) > [ > { > "source": "pki.server.healthcheck.meta.csconfig", > "check": "CADogtagCertsConfigCheck", > "result": "ERROR", > "uuid": "c76c5f53-1869-4cd5-95e3-dd7f3e0b7e0c", > "when": "20220128091051Z", > "duration": "0.361963", > "kw": { > "key": "ca_signing", > "nickname": "caSigningCert cert-pki-ca", > "directive": "ca.signing.cert", > "configfile": "/var/lib/pki/pki-tomcat/ca/conf/CS.cfg", > "msg": "Certificate 'caSigningCert cert-pki-ca' does not match the > value of ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg" > } > }, > { > "source": "ipahealthcheck.dogtag.ca", > "check": "DogtagCertsConnectivityCheck", > "result": "ERROR", > "uuid": "e98075a4-5d85-4ccf-a97e-b202fcc92789", > "when": "20220128091054Z", > "duration": "0.566005", > "kw": { > "msg": "Request for certificate failed, Certificate operation > cannot be completed: Request failed with status 403: Non-2xx response > from CA REST API: 403. (403)" > } > }, > { > "source": "ipahealthcheck.ds.replication", > "check": "ReplicationCheck", > "result": "WARNING", > "uuid": "d9dcf871-1a5d-47a6-8d2e-bcf4f61f09d1", > "when": "20220128091056Z", > "duration": "0.788714", > "kw": { > "key": "DSREPLLE0002", > "items": [ > "Replication", > "Conflict Entries" > ], > "msg": "There were 4 conflict entries found under the replication > suffix \"dc=alpha-labs,dc=net\"." > } > }, > { > "source": "ipahealthcheck.ipa.certs", > "check": "IPADogtagCertsMatchCheck", > "result": "ERROR", > "uuid": "1c96ee54-e8ca-4045-9bfc-294c261e4ab8", > "when": "20220128091101Z", > "duration": "0.198242", > "kw": { > "key": "caSigningCert cert-pki-ca", > "nickname": "caSigningCert cert-pki-ca", > "dbdir": "/etc/pki/pki-tomcat/alias", > "msg": "{nickname} certificate in NSS DB {dbdir} does not match > entry in LDAP" > } > }, > { > "source": "ipahealthcheck.ipa.certs", > "check": "IPACertRevocation", > "result": "ERROR", > "uuid": "17140733-ba3f-4d34-a48c-3b1e159b3488", > "when": "20220128091105Z", > "duration": "0.731259", > "kw": { > "key": "20201208073945", > "serial": 1073676292, > "error": "Certificate operation cannot be completed: Request > failed with status 403: Non-2xx response from CA REST API: 403. (403)", > "msg": "Request for certificate serial number {serial} in request > {key} failed: {error}" > } > }, > { > "source": "ipahealthcheck.ipa.certs", > "check": "IPACertRevocation", > "result": "ERROR", > "uuid": "9833fce2-5f98-480b-9a69-d2d41db21ef0", > "when": "20220128091105Z", > "duration": "0.888676", > "kw": { > "key": "20201208073937", > "serial": 1073676293, > "error": "Certificate operation cannot be completed: Request > failed with status 403: Non-2xx response from CA REST API: 403. (403)", > "msg": "Request for certificate serial number {serial} in request > {key} failed: {error}" > } > }, > { > "source": "ipahealthcheck.ipa.certs", > "check": "IPACertRevocation", > "result": "ERROR", > "uuid": "c3f1b686-a74b-42d6-8b55-b6fe36671933", > "when": "20220128091105Z", > "duration": "1.065141", > "kw": { > "key": "20201208073940", > "serial": 1073676291, > "error": "Certificate operation cannot be completed: Request > failed with status 403: Non-2xx response from CA REST API: 403. (403)", > "msg": "Request for certificate serial number {serial} in request > {key} failed: {error}" > } > }, > { > "source": "ipahealthcheck.ipa.certs", > "check": "IPACertRevocation", > "result": "ERROR", > "uuid": "f6073d14-b9eb-466b-ab29-6151c857d387", > "when": "20220128091105Z", > "duration": "1.226933", > "kw": { > "key": "20201208073942", > "serial": 1073676290, > "error": "Certificate operation cannot be completed: Request > failed with status 403: Non-2xx response from CA REST API: 403. (403)", > "msg": "Request for certificate serial number {serial} in request > {key} failed: {error}" > } > }, > { > "source": "ipahealthcheck.ipa.certs", > "check": "IPACertRevocation", > "result": "ERROR", > "uuid": "a465aaca-67b8-419e-8a38-a16c227d5db1", > "when": "20220128091105Z", > "duration": "1.394251", > "kw": { > "key": "20201208073943", > "serial": 20, > "error": "Certificate operation cannot be completed: Request > failed with status 403: Non-2xx response from CA REST API: 403. (403)", > "msg": "Request for certificate serial number {serial} in request > {key} failed: {error}" > } > }, > { > "source": "ipahealthcheck.ipa.certs", > "check": "IPACertRevocation", > "result": "ERROR", > "uuid": "33de05f4-1e8b-4d26-94ec-e742f4b7b8dc", > "when": "20220128091106Z", > "duration": "1.569087", > "kw": { > "key": "20201208073944", > "serial": 268238852, > "error": "Certificate operation cannot be completed: Request > failed with status 403: Non-2xx response from CA REST API: 403. (403)", > "msg": "Request for certificate serial number {serial} in request > {key} failed: {error}" > } > }, > { > "source": "ipahealthcheck.ipa.certs", > "check": "IPACertRevocation", > "result": "ERROR", > "uuid": "d723658c-74ab-41a4-a3e0-5b643a70e15d", > "when": "20220128091106Z", > "duration": "1.676748", > "kw": { > "key": "20201208073949", > "serial": 1073676289, > "error": "Certificate operation cannot be completed: Request > failed with status 403: Non-2xx response from CA REST API: 403. (403)", > "msg": "Request for certificate serial number {serial} in request > {key} failed: {error}" > } > }, > { > "source": "ipahealthcheck.ipa.certs", > "check": "IPACertRevocation", > "result": "ERROR", > "uuid": "5d67c6e0-785e-456c-9ae3-b2199c5d2051", > "when": "20220128091106Z", > "duration": "1.855003", > "kw": { > "key": "20201208073947", > "serial": 268238849, > "error": "Certificate operation cannot be completed: Request > failed with status 403: Non-2xx response from CA REST API: 403. (403)", > "msg": "Request for certificate serial number {serial} in request > {key} failed: {error}" > } > }, > { > "source": "ipahealthcheck.ipa.certs", > "check": "IPACertRevocation", > "result": "ERROR", > "uuid": "9c0441dc-2f20-41b0-816e-7690fca47448", > "when": "20220128091106Z", > "duration": "1.945158", > "kw": { > "key": "20200406205351", > "serial": 268238851, > "error": "Certificate operation cannot be completed: Request > failed with status 403: Non-2xx response from CA REST API: 403. (403)", > "msg": "Request for certificate serial number {serial} in request > {key} failed: {error}" > } > }, > { > "source": "ipahealthcheck.ipa.dna", > "check": "IPADNARangeCheck", > "result": "WARNING", > "uuid": "480e0baf-8814-47d5-bb71-e8d780867107", > "when": "20220128091107Z", > "duration": "0.687667", > "kw": { > "range_start": 0, > "range_max": 0, > "next_start": 0, > "next_max": 0, > "msg": "No DNA range defined. If no masters define a range then > users and groups cannot be created." > } > }, > { > "source": "ipahealthcheck.ipa.idns", > "check": "IPADNSSystemRecordsCheck", > "result": "WARNING", > "uuid": "37d1c6ed-982c-4046-b6b3-4c47ef6ed249", > "when": "20220128091107Z", > "duration": "0.779401", > "kw": { > "msg": "Got {count} ipa-ca A records, expected {expected}", > "count": 2, > "expected": 3 > } > }, > { > "source": "ipahealthcheck.ipa.files", > "check": "IPAFileCheck", > "result": "ERROR", > "uuid": "a7a5039b-7e4d-4501-ac39-f6b1d2080107", > "when": "20220128091108Z", > "duration": "0.006982", > "kw": { > "key": "_etc_hosts_mode", > "path": "/etc/hosts", > "type": "mode", > "expected": "0644", > "got": "0444", > "msg": "Permissions of /etc/hosts are too restrictive: 0444 and > should be 0644" > } > }, > { > "source": "ipahealthcheck.ipa.files", > "check": "IPAFileCheck", > "result": "WARNING", > "uuid": "71556f6a-b914-41a5-8f88-932b37edcf35", > "when": "20220128091108Z", > "duration": "0.007897", > "kw": { > "key": "_var_log_kadmind.log_mode", > "path": "/var/log/kadmind.log", > "type": "mode", > "expected": "0600", > "got": "0640", > "msg": "Permissions of /var/log/kadmind.log are too permissive: > 0640 and should be 0600" > } > } > ] > > ---- 8< ---- ---- 8< ---- ---- 8< ---- ---- 8< ---- ---- 8< ---- > > Any help is sooo greatly appreciated! > > > _______________________________________________ > FreeIPA-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/[email protected] > Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure > _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
