yummiweb
February 13, 2025, 2:09pm
1
Dear community,
Unfortunately I’m already running into problems at the start of my first Nethserver 7> Nethserver 8 migration.
Background:
Freshly installed Debian 12 Minimal with freshly installed NETH8 (“/home” resides on an external btrfs data carrier).
Fixed IP (local), local FQDN hostname, pattern: “nath81.domain.internal”-
the external hostname is still used by Nethserver7 and will later be moved to NETH8
Both installations are in different subnets but have complete access to each other and to the Internet (also to the local DNS)
The NETH8 was opened for the first time via the configuration interface and only basic settings were made such as:
The first Nethserver 7 migration attempt was made immediately afterwards:
The final error is something like:
<3>LDAPSocketOpenError: socket ssl wrapping error: [Errno 104] Connection reset by peer
The Nethserver 7 has its own AD and no OpenLDAP.
I would be grateful for any help.
In particular, I am wondering at which step the external FQDN and the external port forwarding must point to the new NETH8 - or does that have to be the case at the start of the migration? At the moment, the Nethserver 7 is still in full operation. After the transfer of mail and SOGo, the NETH8 must of course be accessible externally, but not during the migration, right? Then I would have to take the entire system offline for the complete migration - because the data set in particular is very large (yes Andy, I can import the files in a different way, but the mail set is also extensive and should be migrated using the tool). In any case, I wanted to keep the external host names identical (including from the AD) so that the clients do not have to be changed.
But if problems such as “add external domain” arise so early on, is a complete re-resolution of the external FQDN expected here?
As far as I can see, I have met all the requirements and I do not see in the instructions that the external FQDN for migration should already be pointing to the NETH8:https://docs.nethserver.org/projects/ns8/en/latest/migration.html
Regards
mrmarkuz
February 13, 2025, 2:44pm
2
As a first step the migration tool creates the external user domain on NS8 pointing to the old NS7 to have users available on NS8 before migrating apps.
Please check if the NS7 DC LDAPS port is reachable for example using following command:
nc -zv <NS7 DC IP> 636
The result should be something like this:
(UNKNOWN) [192.168.0.100] 636 (ldaps) open
yummiweb
February 13, 2025, 3:24pm
3
Dear Markus,
Thank you for fast response.
nc -zv <NS7 DC IP> 636
But:
The “really” host-domainname from Nethserver 7 is like:
The AD ist also reachable under “ad.domain.tld”.
Which would be the correct reverse-resolving for the AD?
And which Names should be /reverse)resolved for the Nethserver7? The internal or the external Names?
This Different is because of my “reverse proxy”, that helps me to receive LetsEncrypt Certificate for Nethserver7 (Mail) and other Services (SOGo) has an Cert from the ReverseProxy ACME.
mrmarkuz
February 13, 2025, 3:35pm
4
If it’s reachable it should be OK.
yummiweb
February 13, 2025, 3:41pm
5
The NETH8 was opened via the configuration interface and only basic settings were made such as:
Nothing else.
mrmarkuz
February 13, 2025, 3:44pm
6
Sorry, I meant that maybe the account provider was created automatically tough the error appeared.
This is not the default, usually 10.5.4.0/24 is used.
yummiweb
February 13, 2025, 3:49pm
7
The cluster network can be defined during initial setup. This is a good thing, because you may want to operate multiple NETH8s that are not supposed to be in the same cluster.
Do you think this will hinder migration? Could the cluster network be changed later without having to worry about disadvantages or problems?
mrmarkuz
February 13, 2025, 3:51pm
8
No, it should work, I just noticed it.
yummiweb
February 13, 2025, 3:53pm
9
I try it again now and will look deeper in the Logs.
1 Like
yummiweb
February 13, 2025, 4:21pm
10
add-node = o.k.
This are the copied “Tasks-Progress”:
{“context”:{“action”:“add-external-domain”,“data”:{“base_dn”:“dc=ad,dc=domain,dc=tld”,“bind_dn”:“ldapservice@AD.DOMAIN.TLD”,“bind_password”:“XXX”,“domain”:“ad.domain.tld”,“host”:“”,“port”:389,“protocol”:“ldap”,“schema”:“ad”,“tls”:true,“tls_verify”:false},“extra”:{“isNotificationHidden”:false,“title”:“add-external-domain”},“id”:“48368fb0-6ce0-47ca-9b63-c13c1eca04e7”,“parent”:“”,“queue”:“cluster/tasks”,“timestamp”:“2025-02-13T15:58:29.013267174Z”,“user”:“admin”},“status”:“validation-failed”,“progress”:0,“subTasks”:
yummiweb
February 13, 2025, 4:21pm
11
This are the Logs from NETH8 while this Migration-Connection:
2025-02-13T16:58:09+01:00 [1:traefik1:traefik] - - [13/Feb/2025:15:58:09 +0000] “POST /cluster-admin/api/login HTTP/1.1” 200 269 “-” “-” 140 “ApiServer-https@file” “http://127.0.0.1:9311 ” 34mshttp://127.0.0.1:9311 ” 60mshttp://127.0.0.1:9311 ” 51mshttp://127.0.0.1:9311 ” 86mshttp://127.0.0.1:9311 ” 17mshttp://127.0.0.1:9311 ” 50mshttp://127.0.0.1:9311 ” 27mshttp://127.0.0.1:9311 ” 25mshttp://127.0.0.1:9311 ” 60mshttp://127.0.0.1:9311 ” 43mshttp://127.0.0.1:9311 ” 81mshttp://127.0.0.1:9311 ” 16mshttp://127.0.0.1:9311 ” 34mshttp://127.0.0.1:9311 ” 25mshttp://127.0.0.1:9311 ” 48mshttp://127.0.0.1:9311 ” 56mshttp://127.0.0.1:9311 ” 35mshttp://127.0.0.1:9311 ” 71mshttp://127.0.0.1:9311 ” 24mshttp://127.0.0.1:9311 ” 39mshttp://127.0.0.1:9311 ” 39mshttp://127.0.0.1:9311 ” 23mshttp://127.0.0.1:9311 ” 82mshttp://127.0.0.1:9311 ” 70mshttp://127.0.0.1:9311 ” 145mshttp://127.0.0.1:9311 ” 77mshttp://127.0.0.1:9311 ” 19mshttp://127.0.0.1:9311 ” 19mshttp://127.0.0.1:9311 ” 176mshttp://127.0.0.1:9311 ” 19mshttp://127.0.0.1:9311 ” 12mshttp://127.0.0.1:9311 ” 21mshttp://127.0.0.1:9311 ” 51mshttp://127.0.0.1:9311 ” 105mshttp://127.0.0.1:9311 ” 27mshttp://127.0.0.1:9311 ” 51mshttp://127.0.0.1:9311 ” 39mshttp://127.0.0.1:9311 ” 38mshttp://127.0.0.1:9311 ” 38mshttp://127.0.0.1:9311 ” 33mshttp://127.0.0.1:9311 ” 24mshttp://127.0.0.1:9311 ” 29mshttp://127.0.0.1:9311 ” 40mshttp://127.0.0.1:9311 ” 56mshttp://127.0.0.1:9311 ” 27mshttp://127.0.0.1:9311 ” 22mshttp://127.0.0.1:9311 ” 57mshttp://127.0.0.1:9311 ” 21mshttp://127.0.0.1:9311 ” 56mshttp://127.0.0.1:9311 ” 62mshttp://127.0.0.1:9311 ” 100mshttp://127.0.0.1:9311 ” 35mshttp://127.0.0.1:9311 ” 63mshttp://127.0.0.1:9311 ” 25mshttp://127.0.0.1:9311 ” 61mshttp://127.0.0.1:9311 ” 40mshttp://127.0.0.1:9311 ” 78mshttp://127.0.0.1:9311 ” 27mshttp://127.0.0.1:9311 ” 52mshttp://127.0.0.1:9311 ” 19mshttp://127.0.0.1:9311 ” 43mshttp://127.0.0.1:9311 ” 141mshttp://127.0.0.1:9311 ” 72mshttp://127.0.0.1:9311 ” 108mshttp://127.0.0.1:9311 ” 31mshttp://127.0.0.1:9311 ” 93mshttp://127.0.0.1:9311 ” 24mshttp://127.0.0.1:9311 ” 23mshttp://127.0.0.1:9311 ” 64mshttp://127.0.0.1:9311 ” 101mshttp://127.0.0.1:9311 ” 17mshttp://127.0.0.1:9311 ” 22mshttp://127.0.0.1:9311 ” 41mshttp://127.0.0.1:9311 ” 26mshttp://127.0.0.1:9311 ” 40mshttp://127.0.0.1:9311 ” 81mshttp://127.0.0.1:9311 ” 20ms
mrmarkuz
February 13, 2025, 5:07pm
12
Is the LDAP server URI on NS7 set to LDAPS like ldaps://nsdc-server.ad.domain.tld?
Andy_Wismer
February 13, 2025, 5:13pm
13
Hi
Maybe also make sure both subnets (LAN and VPN of NS8) are in NS7 “Trusted Networks” a common forgotten item in such a scenario… Otherwise reaching the AD might be problematic…
My 2 cents
1 Like
yummiweb
February 13, 2025, 5:14pm
14
I have rechecked this twice and also the fowardings between the different Networks.
EDIT: Do you mean the 10.xx.0.0/24 Node Network from the NETH8 Settings?
1 Like
yummiweb
February 13, 2025, 5:15pm
15
No, this AD runs Port 389 and ldap (wihout s).
1 Like
yummiweb
February 13, 2025, 5:18pm
16
BUT my external Nexcloud connects with:
mrmarkuz
February 13, 2025, 5:21pm
17
I’m afraid that the migration tool uses the NS7 settings to connect and can’t connect because port 389 isn’t allowed from external.
Andy_Wismer
February 13, 2025, 5:21pm
18
Yes, the “Cluster” network
yummiweb
February 13, 2025, 5:23pm
19
But the “Standard” Network 10.5.4.0/24 is not here also…
In the Manual is no hint to this - but seems logical.
Andy_Wismer
February 13, 2025, 5:25pm
20
yummiweb:
10.5.4.0/24
Whatever you using for the so called “Cluster Network” on NS8, which runs over Wireguard VPN…
In my case, it’s:
10.98.90.1 for the master node…
