RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1033075 - IPA uninstall on a trust configured server exits with an error for samba
Summary: IPA uninstall on a trust configured server exits with an error for samba
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: Martin Kosek
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-11-21 14:08 UTC by Steeve Goveas
Modified: 2014-06-18 00:13 UTC (History)
4 users (show)

Fixed In Version: ipa-3.3.3-6.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-13 11:38:43 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
IPA Uninstall logs (29.87 KB, text/x-log)
2013-11-21 14:08 UTC, Steeve Goveas 		no flags Details
View All

Description Steeve Goveas 2013-11-21 14:08:31 UTC 
Created attachment 827211 [details]
IPA Uninstall logs

Description of problem:
IPA uninstall on a trust configured server exits with an error as it tries to start Samba after tearing apart its configuration.

Version-Release number of selected component (if applicable):
ipa-server-trust-ad-3.3.3-4.el7.x86_64 

How reproducible:
always

Steps to Reproduce:
1. Run ipa-adtrust-install on IPA server
2. Uninstall IPA


Actual results:
[root@rhel7-b ipa-trust-cli]# ipa-server-install --uninstall -U
Shutting down all IPA services
Removing IPA client configuration
Unconfiguring ntpd
Unconfiguring CA
Unconfiguring named
Unconfiguring web server
Unconfiguring krb5kdc
Unconfiguring kadmin
Unconfiguring directory server
Unconfiguring smb
Unexpected error - see /var/log/ipaserver-uninstall.log for details:
CalledProcessError: Command '/bin/systemctl start smb.service' returned non-zero exit status 1 

Expected results:
No errors on uninstall

Additional info:
Comment 1 Tomas Babej 2013-11-21 14:18:07 UTC 
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/4042
Comment 3 Steeve Goveas 2013-11-22 12:22:57 UTC 
Correction in the the steps to reproduce this bug. Since ipa-adtrust-install needs to find samba service running when its executed, it should be run at least twice to set that samba running state, causing ipa-server uninstall to start it again.

Steps to reproduce this issue.
1. Run ipa-adtrust-install 2 or more times on IPA server
2. Uninstall IPA
Comment 4 Petr Viktorin (pviktori) 2013-11-26 14:25:46 UTC 
Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/d361e12ae55f391a13b613a7220c164f503954cc
ipa-3-3: https://fedorahosted.org/freeipa/changeset/6680572ad5c1419f094335c9f82a0e3763bf883e
Comment 7 Steeve Goveas 2013-12-19 07:33:10 UTC 
[root@tyan-gt24-01 ~]# ipa-adtrust-install -a Secret123 -U ; ipa-adtrust-install -a Secret123 -U

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will setup components needed to establish trust to AD domains for
the IPA Server.

This includes:
  * Configure Samba
  * Add trust related objects to IPA LDAP server

To accept the default shown in brackets, press the Enter key.


WARNING: 3 existing users or groups do not have a SID identifier assigned.
Installer can run a task to have ipa-sidgen Directory Server plugin generate
the SID identifier for all these users. Please note, the in case of a high
number of users and groups, the operation might lead to high replication
traffic and performance degradation. Refer to ipa-adtrust-install(1) man page
for details.

Unattended mode was selected, installer will NOT run ipa-sidgen task!
Configuring CIFS
  [1/19]: stopping smbd
  [2/19]: creating samba domain object
  [3/19]: creating samba config registry
  [4/19]: writing samba config file
  [5/19]: adding cifs Kerberos principal
  [6/19]: check for cifs services defined on other replicas
  [7/19]: adding cifs principal to S4U2Proxy targets
  [8/19]: adding admin(group) SIDs
  [9/19]: adding RID bases
  [10/19]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
  [11/19]: activating CLDAP plugin
  [12/19]: activating sidgen plugin and task
  [13/19]: activating extdom plugin
  [14/19]: configuring smbd to start on boot
  [15/19]: adding special DNS service records
  [16/19]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
  [17/19]: adding fallback group
  [18/19]: setting SELinux booleans
  [19/19]: starting CIFS services
Done configuring CIFS.

=============================================================================
Setup complete

You must make sure these network ports are open:
	TCP Ports:
	  * 138: netbios-dgm
	  * 139: netbios-ssn
	  * 445: microsoft-ds
	UDP Ports:
	  * 138: netbios-dgm
	  * 139: netbios-ssn
	  * 389: (C)LDAP
	  * 445: microsoft-ds

Additionally you have to make sure the IPA LDAP server is not reachable
by any domain controller in the Active Directory domain by closing down
the following ports for these servers:
	TCP Ports:
	  * 389, 636: LDAP/LDAPS

You may want to choose to REJECT the network packets instead of DROPing
them to avoid timeouts on the AD domain controllers.

=============================================================================


The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will setup components needed to establish trust to AD domains for
the IPA Server.

This includes:
  * Configure Samba
  * Add trust related objects to IPA LDAP server

To accept the default shown in brackets, press the Enter key.


WARNING: 1 existing users or groups do not have a SID identifier assigned.
Installer can run a task to have ipa-sidgen Directory Server plugin generate
the SID identifier for all these users. Please note, the in case of a high
number of users and groups, the operation might lead to high replication
traffic and performance degradation. Refer to ipa-adtrust-install(1) man page
for details.

Unattended mode was selected, installer will NOT run ipa-sidgen task!
Configuring CIFS
  [1/19]: stopping smbd
  [2/19]: creating samba domain object
Samba domain object already exists
  [3/19]: creating samba config registry
  [4/19]: writing samba config file
  [5/19]: adding cifs Kerberos principal
  [6/19]: check for cifs services defined on other replicas
  [7/19]: adding cifs principal to S4U2Proxy targets
cifs principal already targeted, nothing to do.
  [8/19]: adding admin(group) SIDs
Admin SID already set, nothing to do
Admin group SID already set, nothing to do
  [9/19]: adding RID bases
RID bases already set, nothing to do
  [10/19]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
  [11/19]: activating CLDAP plugin
CLDAP plugin already configured, nothing to do
  [12/19]: activating sidgen plugin and task
Sidgen plugin already configured, nothing to do
Sidgen task plugin already configured, nothing to do
  [13/19]: activating extdom plugin
Extdom plugin already configured, nothing to do
  [14/19]: configuring smbd to start on boot
  [15/19]: adding special DNS service records
  [16/19]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
  [17/19]: adding fallback group
Fallback group already set, nothing to do
  [18/19]: setting SELinux booleans
  [19/19]: starting CIFS services
Done configuring CIFS.

=============================================================================
Setup complete

You must make sure these network ports are open:
	TCP Ports:
	  * 138: netbios-dgm
	  * 139: netbios-ssn
	  * 445: microsoft-ds
	UDP Ports:
	  * 138: netbios-dgm
	  * 139: netbios-ssn
	  * 389: (C)LDAP
	  * 445: microsoft-ds

Additionally you have to make sure the IPA LDAP server is not reachable
by any domain controller in the Active Directory domain by closing down
the following ports for these servers:
	TCP Ports:
	  * 389, 636: LDAP/LDAPS

You may want to choose to REJECT the network packets instead of DROPing
them to avoid timeouts on the AD domain controllers.

=============================================================================


[root@tyan-gt24-01 ~]# ipa-server-install --uninstall -U
Shutting down all IPA services
Removing IPA client configuration
Unconfiguring ntpd
Unconfiguring CA
Unconfiguring named
Unconfiguring web server
Unconfiguring krb5kdc
Unconfiguring kadmin
Unconfiguring directory server
Unconfiguring smb
Unconfiguring ipa_memcached
Unconfiguring ipa-otpd

[root@tyan-gt24-01 ~]# echo $?
0

Verified in version
[root@tyan-gt24-01 ~]# rpm -q ipa-server
ipa-server-3.3.3-6.el7.x86_64
Comment 8 Ludek Smid 2014-06-13 11:38:43 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.
Note You need to log in before you can comment on or make changes to this bug.