Installing the IPA client is broken due to some chrony FUBAR [1], but I worked
around that with a mock service:
| # cat /run/systemd/system/chrony.service
| [Service]
| Type=oneshot
| ExecStart=/bin/true
| # systemctl unmask chrony
After that, joining a domain works:
| # ipa-client-install --domain cockpit.lan --realm COCKPIT.LAN --principal admin -W
| This program will set up IPA client.
| Version 4.9.8
|
| WARNING: conflicting time&date synchronization service 'ntp' will be disabled in favor of chronyd
|
| Discovery was successful!
| Do you want to configure chrony with NTP server or pool address? [no]:
| Client hostname: x0.cockpit.lan
| Realm: COCKPIT.LAN
| DNS Domain: cockpit.lan
| IPA Server: f0.cockpit.lan
| BaseDN: dc=cockpit,dc=lan
|
| Continue to configure the system with these values? [no]: yes
| [...]
| The ipa-client-install command was successful
But leaving it crashes:
| # ipa-client-install --uninstall
| Unenrolling client from IPA server
| Removing Kerberos service principals from /etc/krb5.keytab
| Disabling client Kerberos and LDAP configurations
| Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
| Restoring client configuration files
| Unconfiguring the NIS domain.
| nscd daemon is not installed, skip configuration
| nslcd daemon is not installed, skip configuration
| Some installation state for ntp has not been restored, see /var/lib/ipa/sysrestore/sysrestore.state
| Some installation state has not been restored.
| This may cause re-installation to fail.
| It should be safe to remove /var/lib/ipa-client/sysrestore.state but it may
| mean your system hasn't been restored to its pre-installation state.
| Systemwide CA database updated.
| Client uninstall complete.
| The original nsswitch.conf configuration has been restored.
| You may need to restart services or reboot the machine.
| Do you want to reboot the machine? [no]: no
| The ipa-client-install command failed. See /var/log/ipaclient-uninstall.log for more information
|
| root@x0:~# echo $?
| 4
That log indeed has a rather non-descriptive stack trace:
| 022-03-24T11:22:02Z DEBUG File "/usr/lib/python3/dist-packages/ipapython/admintool.py", line 180, in execute
| return_value = self.run()
| File "/usr/lib/python3/dist-packages/ipapython/install/cli.py", line 342, in run
| return cfgr.run()
| File "/usr/lib/python3/dist-packages/ipapython/install/core.py", line 360, in run
| return self.execute()
| [...]
| File "/usr/lib/python3/dist-packages/ipaclient/install/client.py", line 3659, in uninstall
| raise ScriptError(rval=rv)
But this doesn't seem to be related to chronyd or my hack.
(Fun fact: The uninstall log is *exactly* 66666 bytes. 👿)
I attach the full install and uninstall logs for reference.
Thanks,
Martin
[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008195