Bug 736617

Summary:	ipa-client-install mishandles ntp service configuration
Product:	Red Hat Enterprise Linux 6	Reporter:	Marko Myllynen <myllynen>
Component:	ipa	Assignee:	Alexander Bokovoy <abokovoy>
Status:	CLOSED ERRATA	QA Contact:	Chandrasekar Kannan <ckannan>
Severity:	low	Docs Contact:
Priority:	low
Version:	6.1	CC:	benl, dpal, jgalipea, mkosek, nsoman
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-2.1.2-1.el6	Doc Type:	Bug Fix
Doc Text:	Cause: ipa-client-install does not configure /usr/sbin/ntpdate to use a correct NTP servers in /etc/ntp/step-tickers. Additionally, the the ipa-client-install does not store the state of the ntpd service before installation Consequence: When IPA client is installed, ntpdate may use incorrect servers to synchronize with. When the IPA client is uninstalled, ntpd may be set to incorrect state. Fix: ipa-client-install configures /usr/sbin/ntpdate to use the IPA NTP server for synchronization. When IPA client is uninstalled, both ntpdate configuration and ntpd status is restored Result: ntpdate run on IPA client machine synchronizes with correct NTP server and ntpdate and ntpd configuration is correctly restored after uninstallation	Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-12-06 18:30:53 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Marko Myllynen 2011-09-08 09:22:42 UTC

Description of problem:
After running ipa-client-install on a system when ntpdate has already been configured using /etc/ntp/step-tickers, both ntpd and ntpdate are enabled after enrollment. This means that during system boot first ntpdate is run (using the non-IPA servers from step-tickers) and the ntpd is started which is using the configuration from ntp.conf with IPA settings.

Also, after running ipa-client-install --uninstall, ntpd is left enabled even though it was not enabled before enrolling the system.

Version-Release number of selected component (if applicable):
RHEL 6.1 / IPA 2.1

Comment 2 Martin Kosek 2011-09-08 09:28:56 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/1770

Comment 3 Martin Kosek 2011-10-05 10:53:45 UTC

Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/f93d71409aa78c4e5c860405cdcc3bc6ffc49280
ipa-2-1: https://fedorahosted.org/freeipa/changeset/12ac2bd20ac1ca810e566afa2e94a2452739040c

Comment 5 Namita Soman 2011-10-17 17:34:34 UTC

Verified using ipa-client-2.1.2-2.el6.x86_64

before installing:
# service ntpd status
ntpd is stopped

# cat /etc/ntp/step-tickers 
# List of servers used for initial synchronization.
clock.corp.redhat.com
clock2.corp.redhat.com
clock.redhat.com
clock2.redhat.com


after installing:
# service ntpd status
ntpd (pid  25162) is running...

# cat /etc/ntp/step-tickers 
# Use IPA-provided NTP server for initial time
rhel62-server1.testrelm

after uninstalling:
ntpd is stopped, and step-tickers is restored back

Comment 6 Martin Kosek 2011-11-01 12:50:29 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: ipa-client-install does not configure /usr/sbin/ntpdate to use a correct NTP servers in /etc/ntp/step-tickers. Additionally, the the ipa-client-install does not store the state of the ntpd service before installation
Consequence: When IPA client is installed, ntpdate may use incorrect servers to synchronize with. When the IPA client is uninstalled, ntpd may be set to incorrect state.
Fix: ipa-client-install configures /usr/sbin/ntpdate to use the IPA NTP server for synchronization. When IPA client is uninstalled, both ntpdate configuration and ntpd status is restored
Result: ntpdate run on IPA client machine synchronizes with correct NTP server and ntpdate and ntpd configuration is correctly restored after uninstallation

Comment 7 errata-xmlrpc 2011-12-06 18:30:53 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1533.html