Bug 1254038
| Summary: | ipa-replica-install pk12util error returns exit status 10 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Scott Poore <spoore> |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.2 | CC: | jcholast, mkosek, pvoborni, rcritten |
| Target Milestone: | rc | Keywords: | Regression |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.2.0-5.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-19 12:05:31 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Upstream ticket: https://fedorahosted.org/freeipa/ticket/5226 Fixed upstream master: https://fedorahosted.org/freeipa/changeset/ff1e66375c8fd7ac036220b0f6d5cf206fa36a6a ipa-4-2: https://fedorahosted.org/freeipa/changeset/bfe937715236e71037f05885293afb3d1c8d2227 Verified. Version :: ipa-server-4.2.0-5.el7.x86_64 Results :: [root@master ~]# ipa-replica-prepare -p Secret123 replica.testrelm.test Preparing replica for replica.testrelm.test from master.testrelm.test Creating SSL certificate for the Directory Server Creating SSL certificate for the dogtag Directory Server Saving dogtag Directory Server port Creating SSL certificate for the Web Server Exporting RA certificate Copying additional files Finalizing configuration Packaging replica information into /var/lib/ipa/replica-info-replica.testrelm.test.gpg Waiting for replica.testrelm.test. A or AAAA record to be resolvable This can be safely interrupted (Ctrl+C) ^CInterrupted The ipa-replica-prepare command was successful [root@master ~]# echo Secret123 | gpg --batch --passphrase-fd 0 -d /var/lib/ipa/replica-info-replica.testrelm.test.gpg |tar xvf - gpg: directory `/root/.gnupg' created gpg: new configuration file `/root/.gnupg/gpg.conf' created gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run gpg: keyring `/root/.gnupg/secring.gpg' created gpg: keyring `/root/.gnupg/pubring.gpg' created gpg: CAST5 encrypted data gpg: encrypted with 1 passphrase gpg: WARNING: message was not integrity protected realm_info/ realm_info/dirsrv_pin.txt realm_info/cacert.p12 realm_info/pwdfile.txt.orig realm_info/dscert.p12 realm_info/dogtagcert.p12 realm_info/dogtag_directory_port.txt realm_info/http_pin.txt realm_info/pwdfile.txt realm_info/httpcert.p12 realm_info/ra.p12 realm_info/ca.crt realm_info/preferences.html realm_info/configure.jar realm_info/default.conf realm_info/realm_info [root@master ~]# rm -rf /var/lib/ipa/replica-info-* [root@master ~]# ipa-replica-prepare -p Secret123 --ip-address=192.168.122.74 --reverse-zone=122.168.192.in-addr.arpa. replica.testrelm.test --dirsrv_pkcs12=realm_info/dscert.p12 --dirsrv_pin='' --http_pkcs12=realm_info/httpcert.p12 --http_pin='' Preparing replica for replica.testrelm.test from master.testrelm.test Copying SSL certificate for the Directory Server Copying SSL certificate for the Web Server Copying additional files Finalizing configuration Packaging replica information into /var/lib/ipa/replica-info-replica.testrelm.test.gpg Adding DNS records for replica.testrelm.test Adding reverse zone 122.168.192.in-addr.arpa. Waiting for replica.testrelm.test. A or AAAA record to be resolvable This can be safely interrupted (Ctrl+C) The ipa-replica-prepare command was successful [root@master ~]# [root@replica ~]# scp root.122.71:/var/lib/ipa/replica-info-replica.testrelm.test.gpg . The authenticity of host '192.168.122.71 (192.168.122.71)' can't be established. ECDSA key fingerprint is ec:03:36:24:38:67:5a:21:6c:72:03:ee:a7:91:6b:0d. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.122.71' (ECDSA) to the list of known hosts. root.122.71's password: replica-info-replica.testrelm.test.gpg 100% 14KB 13.7KB/s 00:00 [root@replica ~]# ipa-replica-install -w Secret123 -p Secret123 ./replica-info-replica.testrelm.test.gpg Run connection check to master Check connection from replica to remote master 'master.testrelm.test': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos Kpasswd: TCP (464): OK HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK The following list of ports use UDP protocol and would need to be checked manually: Kerberos KDC: UDP (88): SKIPPED Kerberos Kpasswd: UDP (464): SKIPPED Connection from replica to master is OK. Start listening on required ports for remote master check Get credentials to log in to remote master Check SSH connection to remote master Execute check on remote master Check connection from master to remote replica 'replica.testrelm.test': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos KDC: UDP (88): OK Kerberos Kpasswd: TCP (464): OK Kerberos Kpasswd: UDP (464): OK HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK Connection from master to replica is OK. Connection check OK Configuring NTP daemon (ntpd) [1/4]: stopping ntpd [2/4]: writing configuration [3/4]: configuring ntpd to start on boot [4/4]: starting ntpd Done configuring NTP daemon (ntpd). Configuring directory server (dirsrv). Estimated time: 1 minute [1/38]: creating directory server user [2/38]: creating directory server instance [3/38]: adding default schema [4/38]: enabling memberof plugin [5/38]: enabling winsync plugin [6/38]: configuring replication version plugin [7/38]: enabling IPA enrollment plugin [8/38]: enabling ldapi [9/38]: configuring uniqueness plugin [10/38]: configuring uuid plugin [11/38]: configuring modrdn plugin [12/38]: configuring DNS plugin [13/38]: enabling entryUSN plugin [14/38]: configuring lockout plugin [15/38]: creating indices [16/38]: enabling referential integrity plugin [17/38]: configuring ssl for ds instance [18/38]: configuring certmap.conf [19/38]: configure autobind for root [20/38]: configure new location for managed entries [21/38]: configure dirsrv ccache [22/38]: enable SASL mapping fallback [23/38]: restarting directory server [24/38]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 3 seconds elapsed Update succeeded [25/38]: updating schema [26/38]: setting Auto Member configuration [27/38]: enabling S4U2Proxy delegation [28/38]: importing CA certificates from LDAP [29/38]: initializing group membership [30/38]: adding master entry [31/38]: initializing domain level [32/38]: configuring Posix uid/gid generation [33/38]: adding replication acis [34/38]: enabling compatibility plugin [35/38]: activating sidgen plugin [36/38]: activating extdom plugin [37/38]: tuning directory server [38/38]: configuring directory to start on boot Done configuring directory server (dirsrv). Configuring Kerberos KDC (krb5kdc). Estimated time: 30 seconds [1/8]: adding sasl mappings to the directory [2/8]: configuring KDC [3/8]: creating a keytab for the directory [4/8]: creating a keytab for the machine [5/8]: adding the password extension to the directory [6/8]: enable GSSAPI for replication [7/8]: starting the KDC [8/8]: configuring KDC to start on boot Done configuring Kerberos KDC (krb5kdc). Configuring kadmin [1/2]: starting kadmin [2/2]: configuring kadmin to start on boot Done configuring kadmin. Configuring ipa_memcached [1/2]: starting ipa_memcached [2/2]: configuring ipa_memcached to start on boot Done configuring ipa_memcached. Configuring the web interface (httpd). Estimated time: 1 minute [1/16]: setting mod_nss port to 443 [2/16]: setting mod_nss protocol list to TLSv1.0 - TLSv1.2 [3/16]: setting mod_nss password file [4/16]: enabling mod_nss renegotiate [5/16]: adding URL rewriting rules [6/16]: configuring httpd [7/16]: setting up ssl [8/16]: importing CA certificates from LDAP [9/16]: publish CA cert [10/16]: creating a keytab for httpd [11/16]: clean up any existing httpd ccache [12/16]: configuring SELinux for httpd [13/16]: create KDC proxy config [14/16]: enable KDC proxy [15/16]: restarting httpd [16/16]: configuring httpd to start on boot Done configuring the web interface (httpd). Configuring ipa-otpd [1/2]: starting ipa-otpd [2/2]: configuring ipa-otpd to start on boot Done configuring ipa-otpd. Applying LDAP updates Upgrading IPA: [1/9]: stopping directory server [2/9]: saving configuration [3/9]: disabling listeners [4/9]: enabling DS global lock [5/9]: starting directory server [6/9]: upgrading server [7/9]: stopping directory server [8/9]: restoring configuration [9/9]: starting directory server Done. Restarting the directory server Restarting the KDC Restarting the web server Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2362.html |
Description of problem: attempting a test ipa-replica-install with a replica info file generated using pkcs12 files is erroring after OTP setup: Configuring ipa-otpd [1/2]: starting ipa-otpd [2/2]: configuring ipa-otpd to start on boot Done configuring ipa-otpd. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipa.ipapython.install.cli.install_tool(Replica): ERROR Command ''/usr/bin/pk12util' '-d' '/etc/httpd/alias' '-i' '/tmp/tmp_RtEI_ipa/realm_info/ra.p12' '-k' '/etc/httpd/alias/pwdfile.txt' '-w' '/tmp/tmpYIVF03'' returned non-zero exit status 10 Version-Release number of selected component (if applicable): ipa-server-4.2.0-4.el7.x86_64 How reproducible: always Steps to Reproduce: 1. Install IPA Server: ipa-server-install --setup-dns --forwarder=192.168.122.1 -r TESTRELM.TEST -n testrelm.test -a Secret123 -p Secret123 -U [root@rhel7-1 ~]# cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 192.168.122.71 master.testrelm.test master 192.168.122.72 replica.testrelm.test 2. Create Replica info file to use to get pkcs12 certs for http and ds: ipa-replica-prepare -p Secret123 replica.testrelm.test 3. Unarchive replica info file: echo Secret123 | gpg --batch --passphrase-fd 0 -d /var/lib/ipa/replica-info-replica.testrelm.test.gpg |tar xvf - 4. Remove of info file rm -rf /var/lib/ipa/replica-info-* 5. Generate new info file with the pkcs12 certs: ipa-replica-prepare -p Secret123 --ip-address=192.168.122.72 --reverse-zone=122.168.192.in-addr.arpa. replica.testrelm.test --dirsrv_pkcs12=realm_info/dscert.p12 --dirsrv_pin='' --http_pkcs12=realm_info/httpcert.p12 --http_pin='' 6. Install on replica using new replica info file scp root.122.71:/var/lib/ipa/replica-info-replica.testrelm.test.gpg . ipa-replica-install -w Secret123 -p Secret123 ./replica-info-replica.testrelm.test.gpg Actual results: Errors out with pk12util error 10. Expected results: Installs without errors. Additional info: ipareplica-install.log: 2015-08-17T00:52:38Z DEBUG Starting external process 2015-08-17T00:52:38Z DEBUG args='/usr/bin/pk12util' '-d' '/etc/httpd/alias' '-i' '/tmp/tmp_RtEI_ipa/realm_info/ra.p12' '-k' '/etc/httpd/alias/pwdfile.txt' '-w' '/tmp/tmpYIVF03' 2015-08-17T00:52:38Z DEBUG Process finished, return code=10 2015-08-17T00:52:38Z DEBUG stdout= 2015-08-17T00:52:38Z DEBUG stderr=pk12util: File Open failed: /tmp/tmp_RtEI_ipa/realm_info/ra.p12: PR_FILE_NOT_FOUND_ERROR: File not found 2015-08-17T00:52:38Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 308, in run cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 280, in run self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 302, in execute for nothing in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 342, in __runner self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in _handle_exception util.raise_exc_info(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 332, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 87, in run_generator_with_yield_from raise_exc_info(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 65, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 523, in _configure executor.next() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 342, in __runner self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 420, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in _handle_exception util.raise_exc_info(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 417, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in _handle_exception util.raise_exc_info(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 332, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 87, in run_generator_with_yield_from raise_exc_info(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 65, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install for nothing in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 887, in main install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 295, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 587, in install CA.import_ra_cert(config.dir + "/ra.p12") File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 900, in import_ra_cert import_pkcs12(rafile, agent_name, self.ra_agent_db, self.ra_agent_pwd) File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 134, in import_pkcs12 "-w", input_passwd]) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 373, in run raise CalledProcessError(p.returncode, arg_string, stdout) 2015-08-17T00:52:38Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command ''/usr/bin/pk12util' '-d' '/etc/httpd/alias' '-i' '/tmp/tmp_RtEI_ipa/realm_info/ra.p12' '-k' '/etc/httpd/alias/pwdfile.txt' '-w' '/tmp/tmpYIVF03'' returned non-zero exit status 10 2015-08-17T00:52:38Z ERROR Command ''/usr/bin/pk12util' '-d' '/etc/httpd/alias' '-i' '/tmp/tmp_RtEI_ipa/realm_info/ra.p12' '-k' '/etc/httpd/alias/pwdfile.txt' '-w' '/tmp/tmpYIVF03'' returned non-zero exit status 10