Bug 1598117

Summary:	client uninstall fails when installed using non-existing hostname
Product:	Red Hat Enterprise Linux 7	Reporter:	Mohammad Rizwan <myusuf>
Component:	ipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED ERRATA	QA Contact:	Michal Reznik <mreznik>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.6	CC:	cheimes, frenaud, mreznik, ndehadra, pasik, pvoborni, rcritten, tscherf
Target Milestone:	rc	Keywords:	Regression
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-4.6.4-5.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-10-30 10:58:44 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mohammad Rizwan 2018-07-04 12:02:32 UTC

Description of problem:
client install fails when installed using non-existing hostname

Version-Release number of selected component (if applicable):
ipa-client-4.6.4-2.el7.x86_64
ipa-client-common-4.6.4-2.el7.noarch

[root@machine ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.6 Beta (Maipo)

How reproducible:
always

Steps to Reproduce:
1. install IPA master
2. ipa-client-install --hostname=`hostname`.nonexistent --server=<server-name> --domain=<domain> -p admin -w <passwd> -U
3. ipa-client-install -U --uninstall

Actual results:
client uninstall fails

Expected results:
client uninstall success

Additional info:
After uninstall fails, subsequent client installation passes but uninsntallation fails

Comment 4 Florence Blanc-Renaud 2018-07-06 10:37:40 UTC

Upstream ticket:
https://pagure.io/freeipa/issue/7620

Comment 5 Christian Heimes 2018-07-06 15:41:29 UTC

Fixed upstream
master:
https://pagure.io/freeipa/c/e32cfd14a9559a126e29f8c0215e3e80bf3924f6

Comment 6 Christian Heimes 2018-07-06 17:11:09 UTC

Fixed upstream
ipa-4-6:
https://pagure.io/freeipa/c/8151b69ba40277fe54370f53b05fcf2a55988cab

Comment 8 Michal Reznik 2018-08-14 07:55:33 UTC

Failing on ipa-client-4.6.4-3.el7.x86_64:

[root@kvm-02-guest02 ~]# ipa-client-install -p admin -w Secret123 --server master.ipa.test --domain ipa.test --hostname $(hostname).nonexistent -U
WARNING: ntpd time&date synchronization service will not be configured as
conflicting service (chronyd) is enabled
Use --force-ntpd option to disable it and force configuration of ntpd

Client hostname: client.ipa.test.nonexistent
Realm: IPA.TEST
DNS Domain: ipa.test
IPA Server: master.ipa.test
BaseDN: dc=ipa,dc=test

Skipping synchronizing time with NTP server.
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=IPA.TEST
    Issuer:      CN=Certificate Authority,O=IPA.TEST
    Valid From:  2018-08-13 14:23:30
    Valid Until: 2038-08-13 14:23:30

Enrolled in IPA realm IPA.TEST
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm IPA.TEST
trying https://master.ipa.test/ipa/json
[try 1]: Forwarding 'schema' to json server 'https://master.ipa.test/ipa/json'
trying https://master.ipa.test/ipa/session/json
[try 1]: Forwarding 'ping' to json server 'https://master.ipa.test/ipa/session/json'
[try 1]: Forwarding 'ca_is_enabled' to json server 'https://master.ipa.test/ipa/session/json'
Systemwide CA database updated.
Hostname (client.ipa.test.nonexistent) does not have A/AAAA record.
Failed to update DNS records.
Missing A/AAAA record(s) for host client.ipa.test.nonexistent: 10.16.68.108, 2620:52:0:1040:5054:ff:fe41:90ef.
Missing reverse record(s) for address(es): 2620:52:0:1040:5054:ff:fe41:90ef.
Incorrect reverse record(s):
10.16.68.108 is pointing to kvm-02-guest02.rhts.eng.bos.redhat.com. instead of client.ipa.test.nonexistent.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
[try 1]: Forwarding 'host_mod' to json server 'https://master.ipa.test/ipa/session/json'
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring ipa.test as NIS domain.
Client configuration complete.
The ipa-client-install command was successful
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# ipa-client-install --uninstall -U
Unenrolling client from IPA server
Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
Unconfiguring the NIS domain.
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Some installation state for network has not been restored, see /var/lib/ipa/sysrestore/sysrestore.state
Some installation state has not been restored.
This may cause re-installation to fail.
It should be safe to remove /var/lib/ipa-client/sysrestore.state but it may
 mean your system hasn't been restored to its pre-installation state.
Systemwide CA database updated.
Client uninstall complete.
The ipa-client-install command failed. See /var/log/ipaclient-uninstall.log for more information
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# tail /var/log/ipaclient-uninstall.log
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 73, in _uninstall
    for unused in self._uninstaller(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3624, in main
    uninstall(self)
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3346, in uninstall
    raise ScriptError(rval=rv)

2018-08-13T14:36:58Z DEBUG The ipa-client-install command failed, exception: ScriptError: 
2018-08-13T14:36:58Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-uninstall.log for more information
[root@kvm-02-guest02 ~]# 


Verified on ipa-client-4.6.4-5.el7.x86_64.

[root@kvm-02-guest02 ~]# ipa-client-install -p admin -w Secret123 --server master.ipa.test --domain ipa.test --hostname $(hostname).nonexistent -U
WARNING: ntpd time&date synchronization service will not be configured as
conflicting service (chronyd) is enabled
Use --force-ntpd option to disable it and force configuration of ntpd

Client hostname: client.ipa.test.nonexistent
Realm: IPA.TEST
DNS Domain: ipa.test
IPA Server: master.ipa.test
BaseDN: dc=ipa,dc=test

Skipping synchronizing time with NTP server.
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=IPA.TEST
    Issuer:      CN=Certificate Authority,O=IPA.TEST
    Valid From:  2018-08-13 14:23:30
    Valid Until: 2038-08-13 14:23:30

Enrolled in IPA realm IPA.TEST
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm IPA.TEST
trying https://master.ipa.test/ipa/json
[try 1]: Forwarding 'ping' to json server 'https://master.ipa.test/ipa/json'
[try 1]: Forwarding 'ca_is_enabled' to json server 'https://master.ipa.test/ipa/json'
Systemwide CA database updated.
Hostname (client.ipa.test.nonexistent) does not have A/AAAA record.
Failed to update DNS records.
Missing A/AAAA record(s) for host client.ipa.test.nonexistent: 10.16.68.108, 2620:52:0:1040:5054:ff:fe41:90ef.
Missing reverse record(s) for address(es): 2620:52:0:1040:5054:ff:fe41:90ef.
Incorrect reverse record(s):
10.16.68.108 is pointing to kvm-02-guest02.rhts.eng.bos.redhat.com. instead of client.ipa.test.nonexistent.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
[try 1]: Forwarding 'host_mod' to json server 'https://master.ipa.test/ipa/json'
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring ipa.test as NIS domain.
Client configuration complete.
The ipa-client-install command was successful
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# ipa-client-install --uninstall -U
Unenrolling client from IPA server
Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
Unconfiguring the NIS domain.
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Systemwide CA database updated.
Client uninstall complete.
The ipa-client-install command was successful
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# tail /var/log/ipaclient-uninstall.log
2018-08-13T14:38:26Z DEBUG stderr=
2018-08-13T14:38:26Z DEBUG Restart of sshd.service complete
2018-08-13T14:38:26Z DEBUG Starting external process
2018-08-13T14:38:26Z DEBUG args=/usr/bin/update-ca-trust
2018-08-13T14:38:27Z DEBUG Process finished, return code=0
2018-08-13T14:38:27Z DEBUG stdout=
2018-08-13T14:38:27Z DEBUG stderr=
2018-08-13T14:38:27Z INFO Systemwide CA database updated.
2018-08-13T14:38:27Z INFO Client uninstall complete.
2018-08-13T14:38:27Z INFO The ipa-client-install command was successful
[root@kvm-02-guest02 ~]#

Comment 12 errata-xmlrpc 2018-10-30 10:58:44 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3187