Hi guys.
This is from a box which I recently updated - I mailed
earliel the list about pki* rpm packages issue - but also,
for other reasons, I did fresh installation of IPA/replica
on that box.
...
ipa-dnskeysync-replica: DEBUG master keys in local HSM: set()
ipa-dnskeysync-replica: DEBUG master keys in LDAP HSM:
{'0x89cb5ca422df63e9a', '0x4191a795f83cd3367607f'}
ipa-dnskeysync-replica: DEBUG new master keys in LDAP
HSM: {'0x89cb5d8ca422df63e9a', '0x4191a7953367607f'}
Traceback (most recent call last):
File "/usr/libexec/ipa/ipa-dnskeysync-replica", line 189,
in <module>
ldap2replica_master_keys_sync(ldapkeydb, localhsm)
File "/usr/libexec/ipa/ipa-dnskeysync-replica", line 90,
in ldap2replica_master_keys_sync
raise ValueError(
ValueError: Local HSM does not contain suitable unwrapping
key for master key 0x4191a795f83ade7634ec01cd3367607f
Traceback (most recent call last):
File "/usr/libexec/ipa/ipa-dnskeysyncd", line 113, in
<module>
while ldap_connection.syncrepl_poll(all=1,
msgid=ldap_search):
File
"/usr/lib64/python3.9/site-packages/ldap/syncrepl.py", line
465, in syncrepl_poll
self.syncrepl_refreshdone()
File
"/usr/lib/python3.9/site-packages/ipaserver/dnssec/keysyncer.py",
line 126, in syncrepl_refreshdone
self.hsm_replica_sync()
File
"/usr/lib/python3.9/site-packages/ipaserver/dnssec/keysyncer.py",
line 192, in hsm_replica_sync
ipautil.run([paths.IPA_DNSKEYSYNCD_REPLICA])
File
"/usr/lib/python3.9/site-packages/ipapython/ipautil.py",
line 598, in run
raise CalledProcessError(
ipapython.ipautil.CalledProcessError:
CalledProcessError(Command
['/usr/libexec/ipa/ipa-dnskeysync-replica'] returned
non-zero exit status 1: 'ipalib.plugable: DEBUG
...
DEBUG master keys in LDAP HSM: {\'0x89cb5d88042df63e9a\',
\'0x4191a795f83adecd3367607f\'}\nipa-dnskeysync-replica:
DEBUG new master keys in LDAP HSM:
{\'0x89cb5da422df63e9a\',
\'0x4191a795f83ade7634ec01cd3367607f\'}\nTraceback (most
recent call last):\n File
"/usr/libexec/ipa/ipa-dnskeysync-replica", line 189, in
<module>\n ldap2replica_master_keys_sync(ldapkeydb,
localhsm)\n File "/usr/libexec/ipa/ipa-dnskeysync-replica",
line 90, in ldap2replica_master_keys_sync\n raise
ValueError(\nValueError: Local HSM does not contain suitable
unwrapping key for master key 0x4191acd3367607f\n')
ipa-dnskeysyncd.service: Main process exited, code=exited,
status=1/FAILURE
...
Domain seems to function okey, IPA does not complain about
anything else except this 'ipa-dnskeysyncd.service'
I wonder if it's this one box having relevant/related
packages newer versions and other masters need updates to
"fix" the issue, or perhaps doing those updates on remaining
masters will make things worse..
or perhaps nature of the problems is altogether different.
All advises are much welcomed.
many thanks, L.
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure
