Red Hat Bugzilla – Bug 1108214
ipa-replica-install: DNS check is between "host already exists" message and exit
Last modified: 2015-03-05 05:11:41 EST
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/3889 In ipa-replica-install, when a host entry already exists on the master ''and'' the DNS resolution check fails, the script: * displays message about existing host entry * displays message about failed DNS check, prompt whether to continue * if user wants to continue, fails because of the existing host entry This is confusing. The DNS check+message+prompt should be done after fully handling the existing host entry.
This request is already fixed in upstream FreeIPA project. Please refer to the linked ticket for additional details and related commits.
Verified: Version :: Results :: ipa-server-4.1.0-15.el7.x86_64 ON MASTER: [root@rhel7-1 ~]# vi /etc/hosts ... I added replica info here so replica-prepare didn't ask for it. [root@rhel7-1 ~]# ipa-replica-prepare -p Secret123 rhel7-2.testrelm.test Preparing replica for rhel7-2.testrelm.test from rhel7-1.testrelm.test Creating SSL certificate for the Directory Server Creating SSL certificate for the dogtag Directory Server Saving dogtag Directory Server port Creating SSL certificate for the Web Server Exporting RA certificate Copying additional files Finalizing configuration Packaging replica information into /var/lib/ipa/replica-info-rhel7-2.testrelm.test.gpg Waiting for rhel7-2.testrelm.test. A or AAAA record to be resolvable This can be safely interrupted (Ctrl+C) ^CInterrupted The ipa-replica-prepare command was successful [root@rhel7-1 ~]# ipa host-add rhel7-2.testrelm.test --force --no-reverse ---------------------------------- Added host "rhel7-2.testrelm.test" ---------------------------------- Host name: rhel7-2.testrelm.test Principal name: host/rhel7-2.testrelm.test@TESTRELM.TEST Password: False Keytab: False Managed by: rhel7-2.testrelm.test [root@rhel7-1 ~]# dig +short @localhost rhel7-2.testrelm.test [root@rhel7-1 ~]# ON REPLICA: [root@rhel7-2 ~]# scp root@192.168.122.71:/var/lib/ipa/replica-info-rhel7-2.testrelm.test.gpg /var/lib/ipa/replica-info-rhel7-2.testrelm.test.gpg root@192.168.122.71's password: replica-info-rhel7-2.testrelm.test.gpg 100% 30KB 30.4KB/s 00:00 [root@rhel7-2 ~]# ipa-replica-install --setup-dns --forwarder=192.168.122.1 -w Secret123 -p Secret123 /var/lib/ipa/replica-info-rhel7-2.testrelm.test.gpg Checking forwarders, please wait ... WARNING: DNS forwarder 192.168.122.1 does not return DNSSEC signatures in answers Please fix forwarder configuration to enable DNSSEC support. (For BIND 9 add directive "dnssec-enable yes;" to "options {}") WARNING: DNSSEC validation will be disabled Run connection check to master Check connection from replica to remote master 'rhel7-1.testrelm.test': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos Kpasswd: TCP (464): OK HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK The following list of ports use UDP protocol and would need to be checked manually: Kerberos KDC: UDP (88): SKIPPED Kerberos Kpasswd: UDP (464): SKIPPED Connection from replica to master is OK. Start listening on required ports for remote master check Get credentials to log in to remote master Check SSH connection to remote master Execute check on remote master Check connection from master to remote replica 'rhel7-2.testrelm.test': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos KDC: UDP (88): OK Kerberos Kpasswd: TCP (464): OK Kerberos Kpasswd: UDP (464): OK HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK Connection from master to replica is OK. Connection check OK Adding [192.168.122.72 rhel7-2.testrelm.test] to your /etc/hosts file Using reverse zone(s) 122.168.192.in-addr.arpa. The host rhel7-2.testrelm.test already exists on the master server. You should remove it before proceeding: % ipa host-del rhel7-2.testrelm.test
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0442.html