I have freeipa-server listening in my local network, providing a "COCKPIT.LAN"
realm (all of this is test VMs). [1]
Iniitally, on the unjoined machine, chrony is running:
| # systemctl --all|grep -E 'ntp|chrony'
| chrony.service loaded active running chrony, an NTP client/server
| initrd-parse-etc.service loaded inactive dead Mountpoints Configured in the Real Root
| ● ntp.service not-found inactive dead ntp.service
| ● ntpsec.service not-found inactive dead ntpsec.service
| ● openntpd.service not-found inactive dead openntpd.service
This isn't my preference (timesyncd), but FreeIPA only really works with
chronyd, and Recommends: it, so there isn't really much choice.
Joining the domain with
| echo admin-password | ipa-client-install --unattended --principal admin -W
works fine [2], even though it shows a warning about NTP; which is a bit weird,
as there is no running ntpd (just chrony). After joining, chrony/ntp status is
still the same as above.
However, leaving the domain again with `ipa-client-install --uninstall --unattended` fails:
| Unenrolling client from IPA server
| Removing Kerberos service principals from /etc/krb5.keytab
| Disabling client Kerberos and LDAP configurations
| Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
| Restoring client configuration files
| Unconfiguring the NIS domain.
| nscd daemon is not installed, skip configuration
| nslcd daemon is not installed, skip configuration
| Some installation state for ntp has not been restored, see /var/lib/ipa/sysrestore/sysrestore.state
| Some installation state has not been restored.
| This may cause re-installation to fail.
| It should be safe to remove /var/lib/ipa-client/sysrestore.state but it may
| mean your system hasn't been restored to its pre-installation state.
| Systemwide CA database updated.
| Client uninstall complete.
| The ipa-client-install command failed. See /var/log/ipaclient-uninstall.log for more information
That log says:
2023-06-23T07:21:19Z ERROR Some installation state for ntp has not been restored, see /var/lib/ipa/sysrestore/sysrestore.state
/var/lib/ipa/sysrestore/sysrestore.state does not actually exist, but this
does:
| # cat /var/lib/ipa-client/sysrestore/sysrestore.state
| [ntp]
| enabled = True
| running = False
So somehow this gets confused by some imagined "NTP service"?
This fails in the same way when I disable chronyd before joining:
| systemctl disable --now chronyd
| systemctl disable --now chrony
(I don't know which one is right, they both seem to do half of the job. chrony
is really weird..)
Incidentally, it's possible to remove the chrony package, but then
ipa-client-install fails immediately, on
CalledProcessError(Command ['/bin/systemctl', 'restart', 'chrony.service'] returned non-zero exit status 5: 'Failed to restart chrony.service: Unit chrony.service not found.\n')
So "Recommends:" is really too weak.
I didn't find a workaround for this so far.
[1]
# realm discover
cockpit.lan
type: kerberos
realm-name: COCKPIT.LAN
domain-name: cockpit.lan
configured: no
server-software: ipa
client-software: sssd
required-package: freeipa-client
required-package: sssd-tools
required-package: sssd
required-package: libnss-sss
required-package: libpam-sss
[2]
This program will set up IPA client.
Version 4.9.11
WARNING: conflicting time&date synchronization service 'ntp' will be disabled in favor of chronyd
Discovery was successful!
Client hostname: x0.cockpit.lan
Realm: COCKPIT.LAN
DNS Domain: cockpit.lan
IPA Server: f0.cockpit.lan
BaseDN: dc=cockpit,dc=lan
Synchronizing time
No SRV records of NTP servers found and no NTP server or pool address was provided.
Using default chrony configuration.
Attempting to sync time with chronyc.
Process chronyc waitsync failed to sync time!
Unable to sync time with chrony server, assuming the time is in sync. Please check that 123 UDP port is opened, and any time server is on network.
Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=COCKPIT.LAN
Issuer: CN=Certificate Authority,O=COCKPIT.LAN
Valid From: 2023-05-07 22:42:23
Valid Until: 2043-05-07 22:42:23
Enrolled in IPA realm COCKPIT.LAN
Created /etc/ipa/default.conf
Configured /etc/sssd/sssd.conf
Systemwide CA database updated.
Hostname (x0.cockpit.lan) does not have A/AAAA record.
Missing reverse record(s) for address(es): 10.111.113.1.
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
SSSD enabled
/etc/ldap/ldap.conf does not exist.
Failed to configure /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config.d/04-ipa.conf
Configuring cockpit.lan as NIS domain.
Configured /etc/krb5.conf for IPA realm COCKPIT.LAN
Client configuration complete.
The ipa-client-install command was successful