Bug 742875
| Summary: | named fails to start after installing ipa server when short hostname preceeds fqdn in /etc/hosts. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Gowrishankar Rajaiyan <grajaiya> |
| Component: | ipa | Assignee: | Rob Crittenden <rcritten> |
| Status: | CLOSED ERRATA | QA Contact: | IDM QE LIST <seceng-idm-qe-list> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.2 | CC: | berrange, dpal, fradisel, grajaiya, jhrozek, jwakely, laetoto.live, mkosek, prc |
| Target Milestone: | rc | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-2.1.3-1.el6 | Doc Type: | Bug Fix |
| Doc Text: |
Cause: When IPA server is installed, it does not check properly system's static lookup table (/etc/hosts) for records that may interfere with its IP address or hostname.
Consequence: If /etc/hosts contains records with IP address or hostname matching the one configured for IPA, the IPA server installation may crash later during the installation process as forward or reverse DNS queries resolves to different values than expected.
Fix: ipa-server-install now always checks if there is a conflicting record in /etc/hosts and reports a clean error if there is any
Result: ipa-server-install won't crash because of conflicting records in /etc/hosts
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-12-06 18:33:07 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 748554 | ||
|
Description
Gowrishankar Rajaiyan
2011-10-03 08:13:30 UTC
I don't think this is a bug (and definitely not SSSD bug). If I recall correctly, IPA requires that the IPA server hostname is a FQDN and reverse DNS resolutions works correctly. Shanks, what does "getent hosts 2620:52:0:41c9:5054:ff:fea8:b669" say? Martin, can you confirm? Yes, IPA requires a hostname to be a FQDN. This is setting of /etc/hosts is invalid. IPA server shouldn't even configure successfully if you configure /etc/hosts this way before calling ipa-server-install. Thank you, Martin. Closing as NOTABUG as per comment #3. Per comment #3, shouldn't the actual bug be that ipa-server-install should detect this configuration and should fail to install. I understood that Shanks changed /etc/hosts post-install, but if IPA actually installed with /etc/hosts that list short host name first..that is a bug. (In reply to comment #5) > Per comment #3, shouldn't the actual bug be that ipa-server-install should > detect this configuration and should fail to install. Yes, ipa-server-install will fail if the /etc/hosts is configured this way. I was under the same impression as Jakub that Shanks did the change post-install. /etc/hosts was set before ipa-server-install. I just tried it again. # cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost6 localhost6.localdomain6 2620:52:0:41c9:5054:ff:fea8:b669 jetfire jetfire.lab.eng.pnq.redhat.com # ipa-server-install --setup-dns --no-forwarders --hostname=jetfire.lab.eng.pnq.redhat.com -r LAB.ENG.PNQ.REDHAT.COM -n lab.eng.pnq.redhat.com -p Secret123 -P Secret123 -a Secret123 -U <snip> done configuring httpd. Applying LDAP updates Restarting the directory server Restarting the KDC Restarting the web server Configuring named: [1/9]: adding DNS container [2/9]: setting up our zone [3/9]: setting up reverse zone [4/9]: setting up our own record [5/9]: setting up kerberos principal [6/9]: setting up named.conf [7/9]: restarting named named service failed to start [8/9]: configuring named to start on boot [9/9]: changing resolv.conf to point to ourselves done configuring named. ============================================================================== Setup complete </snip> Ah, yes, I see the bug picture now. When ipa-server-install is run with --setup-dns or --no-host-dns, no DNS check is run by design and a warning is reported by ipa-server-install. Upstream ticket: https://fedorahosted.org/freeipa/ticket/1923 master: 363c23a37c3631a0fb16df6b88bd5138677b818a 9bff6cb8a955c3f4b167e05856b40f6e2ee5dca8 ipa-2-1: 58918c4593fed9d546368483d4509798fbaa9322 93feb5293236a5d0e22ae15eee35e7b9eb93e6e4 [root@jetfire ~]# cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 10.65.201.71 jetfire jetfire.lab.eng.pnq.redhat.com [root@jetfire ~]# [root@jetfire ~]# ipa-server-install --setup-dns --no-forwarders --hostname=jetfire.lab.eng.pnq.redhat.com -r LAB.ENG.PNQ.REDHAT.COM -n lab.eng.pnq.redhat.com -p Secret123 -P Secret123 -a Secret123 -U The log file for this installation can be found in /var/log/ipaserver-install.log ============================================================================== This program will set up the IPA Server. This includes: * Configure a stand-alone CA (dogtag) for certificate management * Configure the Network Time Daemon (ntpd) * Create and configure an instance of Directory Server * Create and configure a Kerberos Key Distribution Center (KDC) * Configure Apache (httpd) * Configure DNS (bind) To accept the default shown in brackets, press the Enter key. The host name jetfire.lab.eng.pnq.redhat.com does not match the primary host name jetfire. Please check /etc/hosts or DNS name resolution [root@jetfire ~]# Verified. Version: ipa-server-2.1.3-3.el6.x86_64
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
Cause: When IPA server is installed, it does not check properly system's static lookup table (/etc/hosts) for records that may interfere with its IP address or hostname.
Consequence: If /etc/hosts contains records with IP address or hostname matching the one configured for IPA, the IPA server installation may crash later during the installation process as forward or reverse DNS queries resolves to different values than expected.
Fix: ipa-server-install now always checks if there is a conflicting record in /etc/hosts and reports a clean error if there is any
Result: ipa-server-install won't crash because of conflicting records in /etc/hosts
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1533.html The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days |