Bug 1600525

What does /var/lib/ipa-client/sysrestore.state contain after the first uninstall?

Be sure this file does NOT exist prior to testing.

Hi Rob,
On client after first uninstall /var/lib/ipa-client/sysrestore.state does not exist.

# tail /var/log/ipaclient-uninstall.log 
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 73, in _uninstall
    for unused in self._uninstaller(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3624, in main
    uninstall(self)
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3346, in uninstall
    raise ScriptError(rval=rv)

2018-07-24T07:51:46Z DEBUG The ipa-client-install command failed, exception: ScriptError: 
2018-07-24T07:51:46Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-uninstall.log for more information


# cat /var/lib/ipa-client/sysrestore.state
cat: /var/lib/ipa-client/sysrestore.state: No such file or directory

Hi Rob,
On client there is sysrestore.state file exist.

# cat /var/lib/ipa-client/sysrestore/sysrestore.state 
[network]
hostname = x.y.z

Uh, so it does exist or it doesn't? Comments 6/7 and 8 seem to be in conflict.

If it exists post ipa-client-install --uninstall, particularly with this exact content, then this explains the hostname issue and why behavior is different between the first and subsequent installations.

Yes it exist in path /var/lib/ipa-client/sysrestore/sysrestore.state

Upstream ticket:
https://pagure.io/freeipa/issue/7648

Fixed upstream:

master: e32cfd14a9559a126e29f8c0215e3e80bf3924f6
ipa-4-6: 8151b69ba40277fe54370f53b05fcf2a55988cab

Verifying using non-existent hostname.

Failing on ipa-client-4.6.4-3.el7.x86_64:

[root@kvm-02-guest02 ~]# ipa-client-install -p admin -w Secret123 --server master.ipa.test --domain ipa.test --hostname $(hostname).nonexistent -U
WARNING: ntpd time&date synchronization service will not be configured as
conflicting service (chronyd) is enabled
Use --force-ntpd option to disable it and force configuration of ntpd

Client hostname: client.ipa.test.nonexistent
Realm: IPA.TEST
DNS Domain: ipa.test
IPA Server: master.ipa.test
BaseDN: dc=ipa,dc=test

Skipping synchronizing time with NTP server.
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=IPA.TEST
    Issuer:      CN=Certificate Authority,O=IPA.TEST
    Valid From:  2018-08-13 14:23:30
    Valid Until: 2038-08-13 14:23:30

Enrolled in IPA realm IPA.TEST
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm IPA.TEST
trying https://master.ipa.test/ipa/json
[try 1]: Forwarding 'schema' to json server 'https://master.ipa.test/ipa/json'
trying https://master.ipa.test/ipa/session/json
[try 1]: Forwarding 'ping' to json server 'https://master.ipa.test/ipa/session/json'
[try 1]: Forwarding 'ca_is_enabled' to json server 'https://master.ipa.test/ipa/session/json'
Systemwide CA database updated.
Hostname (client.ipa.test.nonexistent) does not have A/AAAA record.
Failed to update DNS records.
Missing A/AAAA record(s) for host client.ipa.test.nonexistent: 10.16.68.108, 2620:52:0:1040:5054:ff:fe41:90ef.
Missing reverse record(s) for address(es): 2620:52:0:1040:5054:ff:fe41:90ef.
Incorrect reverse record(s):
10.16.68.108 is pointing to kvm-02-guest02.rhts.eng.bos.redhat.com. instead of client.ipa.test.nonexistent.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
[try 1]: Forwarding 'host_mod' to json server 'https://master.ipa.test/ipa/session/json'
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring ipa.test as NIS domain.
Client configuration complete.
The ipa-client-install command was successful
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# ipa-client-install --uninstall -U
Unenrolling client from IPA server
Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
Unconfiguring the NIS domain.
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Some installation state for network has not been restored, see /var/lib/ipa/sysrestore/sysrestore.state
Some installation state has not been restored.
This may cause re-installation to fail.
It should be safe to remove /var/lib/ipa-client/sysrestore.state but it may
 mean your system hasn't been restored to its pre-installation state.
Systemwide CA database updated.
Client uninstall complete.
The ipa-client-install command failed. See /var/log/ipaclient-uninstall.log for more information
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# tail /var/log/ipaclient-uninstall.log
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 73, in _uninstall
    for unused in self._uninstaller(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3624, in main
    uninstall(self)
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3346, in uninstall
    raise ScriptError(rval=rv)

2018-08-13T14:36:58Z DEBUG The ipa-client-install command failed, exception: ScriptError: 
2018-08-13T14:36:58Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-uninstall.log for more information
[root@kvm-02-guest02 ~]# 


Verified on ipa-client-4.6.4-5.el7.x86_64.

[root@kvm-02-guest02 ~]# ipa-client-install -p admin -w Secret123 --server master.ipa.test --domain ipa.test --hostname $(hostname).nonexistent -U
WARNING: ntpd time&date synchronization service will not be configured as
conflicting service (chronyd) is enabled
Use --force-ntpd option to disable it and force configuration of ntpd

Client hostname: client.ipa.test.nonexistent
Realm: IPA.TEST
DNS Domain: ipa.test
IPA Server: master.ipa.test
BaseDN: dc=ipa,dc=test

Skipping synchronizing time with NTP server.
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=IPA.TEST
    Issuer:      CN=Certificate Authority,O=IPA.TEST
    Valid From:  2018-08-13 14:23:30
    Valid Until: 2038-08-13 14:23:30

Enrolled in IPA realm IPA.TEST
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm IPA.TEST
trying https://master.ipa.test/ipa/json
[try 1]: Forwarding 'ping' to json server 'https://master.ipa.test/ipa/json'
[try 1]: Forwarding 'ca_is_enabled' to json server 'https://master.ipa.test/ipa/json'
Systemwide CA database updated.
Hostname (client.ipa.test.nonexistent) does not have A/AAAA record.
Failed to update DNS records.
Missing A/AAAA record(s) for host client.ipa.test.nonexistent: 10.16.68.108, 2620:52:0:1040:5054:ff:fe41:90ef.
Missing reverse record(s) for address(es): 2620:52:0:1040:5054:ff:fe41:90ef.
Incorrect reverse record(s):
10.16.68.108 is pointing to kvm-02-guest02.rhts.eng.bos.redhat.com. instead of client.ipa.test.nonexistent.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
[try 1]: Forwarding 'host_mod' to json server 'https://master.ipa.test/ipa/json'
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring ipa.test as NIS domain.
Client configuration complete.
The ipa-client-install command was successful
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# ipa-client-install --uninstall -U
Unenrolling client from IPA server
Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
Unconfiguring the NIS domain.
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Systemwide CA database updated.
Client uninstall complete.
The ipa-client-install command was successful
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# tail /var/log/ipaclient-uninstall.log
2018-08-13T14:38:26Z DEBUG stderr=
2018-08-13T14:38:26Z DEBUG Restart of sshd.service complete
2018-08-13T14:38:26Z DEBUG Starting external process
2018-08-13T14:38:26Z DEBUG args=/usr/bin/update-ca-trust
2018-08-13T14:38:27Z DEBUG Process finished, return code=0
2018-08-13T14:38:27Z DEBUG stdout=
2018-08-13T14:38:27Z DEBUG stderr=
2018-08-13T14:38:27Z INFO Systemwide CA database updated.
2018-08-13T14:38:27Z INFO Client uninstall complete.
2018-08-13T14:38:27Z INFO The ipa-client-install command was successful
[root@kvm-02-guest02 ~]#

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3187