Unable to determine enabled services from ldap.

[tsch]

Hi there

I'm installing a multi-server test environment, where one server is the ldap/store and another one is the mta. Setup went without a problem, but when I try to start zimbra on the mta server I get the following error:

Unable to determine enabled services from ldap.
Unable to determine enabled services. Cache is out of date or doesn't exist.

And no service is started. The same error is displayed when I run `zmcontrol status`. There's no firewall in between and the ldap service is running and accessible on the other host. I looked through the logs and can't find any indication of what's wrong.

Does anybody have an idea what may be wrong or where I should look?

[uxbod]

Welcome to the forums

I would check out your DNS and hosts first :- [SOLVED] Serious installation problems

[tsch]

Hi uxbod

Thanks for the suggestion. I had already looked at the thread. MX records are fine, my hosts file just has the localhost definition.

[tsch]

I updated the hosts file to also contain the hostnames and ip addresses of the other server, but the result stays the same. Anybody has any suggestions on how to debug this?

tnx

[sinopeach]

I have the same issue now.

When I installed my initial cluster the whole master/slave LDAP thing went great.

I am now adding in the rest of our cluster (Geographical locales) and trying to link in a regional LDAP slave to the master one.

During install the system connects and pulls from LDAP master the correct time zone, etc.

Upon restart it does not work. The only thing now is that the outside users can connect with a comemrical cert. So I deployed that wildcart cert to the new ldap slave node and a restart still fails.

HOSTS and DNS are correct.

There is no MX set for this server as it is JUST an LDAP slave sever. MX is set for the MTA nodes of course...

What is wrong....? I can't seem to find much online and my replica passwords for LDAP are confirmed correct and the like.... the only difference is that this new node is installed with the lates 6.0.6 and the master has 6.0.6 without the latest patch.

[sinopeach]

OK Zimbra support got me the answer.

Seems this is all to do with the new COMMERCIAL certs.

The commercial certs were deployed fine. However you must also as ROOT run:

/opt/zimbra/bin/zmcertmgr addcacert /opt/zimbra/ssl/zimbra/commercial/commercial.crt

Now this made my new slave LDAP server function fine. I am now going to install the mailbox, mta and proxy nodes for this geographic location. Will see if these nodes ALSO need the above run or if they can connect.....

[padraig]

thanks Sinopeach
Very Helpful Post!

[sinopeach]

All is working now except the zmudateauthkeys is still failing for the new nodes.... it seems that A LOT of stuff breaks and needs commands issued when commercial certs are installed. And this starts with the web GUI manager not working at ALL when it comes to cert deployment.... Documentation in this regard is quite lax. Needs more propper use case scenarios written down...

So far have 2 geographic locations done... adding a third this week and the fourth in 2 weeks after that. Now just need to get all the iscsi and VPN's working for correct DR...

I must say - that when zimbra works - it works better than anything else I've used. But the multitude of problems we have had with "out of the box functionality" is kind of disconcerting...

[padraig]

Hi Sinopeach,

ran into the same issue, found solution here:

Mail Queue Monitoring - Zimbra :: Wiki

To regenerate the ssh keys, on all hosts (as the zimbra user):

zmsshkeygen

To deploy the keys, on all hosts (as the zimbra user):

zmupdateauthkeys

[sinopeach]

Going to try the zmsshkeygen now... support didn't even know about that. However the bug is - is that these keys weren't auto made on the new nodes - but they were on the old.... going to try this now... thanks!