RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1254038 - ipa-replica-install pk12util error returns exit status 10
Summary: ipa-replica-install pk12util error returns exit status 10
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.2
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-08-17 01:13 UTC by Scott Poore
Modified: 2015-11-19 12:05 UTC (History)
4 users (show)

Fixed In Version: ipa-4.2.0-5.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-11-19 12:05:31 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:2362 0 normal SHIPPED_LIVE ipa bug fix and enhancement update 2015-11-19 10:40:46 UTC

Description Scott Poore 2015-08-17 01:13:10 UTC 
Description of problem:

attempting a test ipa-replica-install with a replica info file generated using pkcs12 files is erroring after OTP setup:

Configuring ipa-otpd
  [1/2]: starting ipa-otpd 
  [2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

ipa.ipapython.install.cli.install_tool(Replica): ERROR    Command ''/usr/bin/pk12util' '-d' '/etc/httpd/alias' '-i' '/tmp/tmp_RtEI_ipa/realm_info/ra.p12' '-k' '/etc/httpd/alias/pwdfile.txt' '-w' '/tmp/tmpYIVF03'' returned non-zero exit status 10


Version-Release number of selected component (if applicable):
ipa-server-4.2.0-4.el7.x86_64


How reproducible:
always

Steps to Reproduce:
1.  Install IPA Server:

ipa-server-install --setup-dns --forwarder=192.168.122.1 -r TESTRELM.TEST -n testrelm.test -a Secret123 -p Secret123 -U
[root@rhel7-1 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.122.71	master.testrelm.test master
192.168.122.72 replica.testrelm.test

2.  Create Replica info file to use to get pkcs12 certs for http and ds:

ipa-replica-prepare -p Secret123 replica.testrelm.test

3.  Unarchive replica info file:

echo Secret123 | gpg --batch --passphrase-fd 0 -d /var/lib/ipa/replica-info-replica.testrelm.test.gpg |tar xvf -

4.  Remove of info file

rm -rf /var/lib/ipa/replica-info-*

5.  Generate new info file with the pkcs12 certs:

ipa-replica-prepare -p Secret123 --ip-address=192.168.122.72 --reverse-zone=122.168.192.in-addr.arpa. replica.testrelm.test --dirsrv_pkcs12=realm_info/dscert.p12 --dirsrv_pin='' --http_pkcs12=realm_info/httpcert.p12 --http_pin=''

6.  Install on replica using new replica info file

scp root.122.71:/var/lib/ipa/replica-info-replica.testrelm.test.gpg .
ipa-replica-install -w Secret123 -p Secret123 ./replica-info-replica.testrelm.test.gpg 


Actual results:
Errors out with pk12util error 10.

Expected results:
Installs without errors.

Additional info:

ipareplica-install.log:

2015-08-17T00:52:38Z DEBUG Starting external process
2015-08-17T00:52:38Z DEBUG args='/usr/bin/pk12util' '-d' '/etc/httpd/alias' '-i' '/tmp/tmp_RtEI_ipa/realm_info/ra.p12' '-k' '/etc/httpd/alias/pwdfile.txt' '-w' '/tmp/tmpYIVF03'
2015-08-17T00:52:38Z DEBUG Process finished, return code=10
2015-08-17T00:52:38Z DEBUG stdout=
2015-08-17T00:52:38Z DEBUG stderr=pk12util: File Open failed: /tmp/tmp_RtEI_ipa/realm_info/ra.p12: PR_FILE_NOT_FOUND_ERROR: File not found

2015-08-17T00:52:38Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 308, in run
    cfgr.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 280, in run
    self.execute()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 302, in execute
    for nothing in self._executor():
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 342, in __runner
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in _handle_exception
    util.raise_exc_info(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 332, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 87, in run_generator_with_yield_from
    raise_exc_info(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 65, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 523, in _configure
    executor.next()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 342, in __runner
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 420, in _handle_exception
    self.__parent._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in _handle_exception
    util.raise_exc_info(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 417, in _handle_exception
    super(ComponentBase, self)._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in _handle_exception
    util.raise_exc_info(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 332, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 87, in run_generator_with_yield_from
    raise_exc_info(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 65, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install
    for nothing in self._installer(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 887, in main
    install(self)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 295, in decorated
    func(installer)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 587, in install
    CA.import_ra_cert(config.dir + "/ra.p12")
  File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 900, in import_ra_cert
    import_pkcs12(rafile, agent_name, self.ra_agent_db, self.ra_agent_pwd)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 134, in import_pkcs12
    "-w", input_passwd])
  File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 373, in run
    raise CalledProcessError(p.returncode, arg_string, stdout)

2015-08-17T00:52:38Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command ''/usr/bin/pk12util' '-d' '/etc/httpd/alias' '-i' '/tmp/tmp_RtEI_ipa/realm_info/ra.p12' '-k' '/etc/httpd/alias/pwdfile.txt' '-w' '/tmp/tmpYIVF03'' returned non-zero exit status 10
2015-08-17T00:52:38Z ERROR Command ''/usr/bin/pk12util' '-d' '/etc/httpd/alias' '-i' '/tmp/tmp_RtEI_ipa/realm_info/ra.p12' '-k' '/etc/httpd/alias/pwdfile.txt' '-w' '/tmp/tmpYIVF03'' returned non-zero exit status 10
Comment 3 Petr Vobornik 2015-08-17 07:52:42 UTC 
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5226
Comment 5 Jan Cholasta 2015-08-18 14:25:27 UTC 
Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/ff1e66375c8fd7ac036220b0f6d5cf206fa36a6a
ipa-4-2:
https://fedorahosted.org/freeipa/changeset/bfe937715236e71037f05885293afb3d1c8d2227
Comment 7 Scott Poore 2015-08-21 19:42:52 UTC 
Verified.

Version ::

ipa-server-4.2.0-5.el7.x86_64

Results ::

[root@master ~]# ipa-replica-prepare -p Secret123 replica.testrelm.test
Preparing replica for replica.testrelm.test from master.testrelm.test
Creating SSL certificate for the Directory Server
Creating SSL certificate for the dogtag Directory Server
Saving dogtag Directory Server port
Creating SSL certificate for the Web Server
Exporting RA certificate
Copying additional files
Finalizing configuration
Packaging replica information into /var/lib/ipa/replica-info-replica.testrelm.test.gpg
Waiting for replica.testrelm.test. A or AAAA record to be resolvable
This can be safely interrupted (Ctrl+C)
^CInterrupted
The ipa-replica-prepare command was successful

[root@master ~]# echo Secret123 | gpg --batch --passphrase-fd 0 -d /var/lib/ipa/replica-info-replica.testrelm.test.gpg |tar xvf -
gpg: directory `/root/.gnupg' created
gpg: new configuration file `/root/.gnupg/gpg.conf' created
gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/root/.gnupg/secring.gpg' created
gpg: keyring `/root/.gnupg/pubring.gpg' created
gpg: CAST5 encrypted data
gpg: encrypted with 1 passphrase
gpg: WARNING: message was not integrity protected
realm_info/
realm_info/dirsrv_pin.txt
realm_info/cacert.p12
realm_info/pwdfile.txt.orig
realm_info/dscert.p12
realm_info/dogtagcert.p12
realm_info/dogtag_directory_port.txt
realm_info/http_pin.txt
realm_info/pwdfile.txt
realm_info/httpcert.p12
realm_info/ra.p12
realm_info/ca.crt
realm_info/preferences.html
realm_info/configure.jar
realm_info/default.conf
realm_info/realm_info

[root@master ~]# rm -rf /var/lib/ipa/replica-info-*

[root@master ~]# ipa-replica-prepare -p Secret123 --ip-address=192.168.122.74 --reverse-zone=122.168.192.in-addr.arpa. replica.testrelm.test --dirsrv_pkcs12=realm_info/dscert.p12 --dirsrv_pin='' --http_pkcs12=realm_info/httpcert.p12 --http_pin=''
Preparing replica for replica.testrelm.test from master.testrelm.test
Copying SSL certificate for the Directory Server
Copying SSL certificate for the Web Server
Copying additional files
Finalizing configuration
Packaging replica information into /var/lib/ipa/replica-info-replica.testrelm.test.gpg
Adding DNS records for replica.testrelm.test
Adding reverse zone 122.168.192.in-addr.arpa.
Waiting for replica.testrelm.test. A or AAAA record to be resolvable
This can be safely interrupted (Ctrl+C)
The ipa-replica-prepare command was successful
[root@master ~]# 

[root@replica ~]# scp root.122.71:/var/lib/ipa/replica-info-replica.testrelm.test.gpg .
The authenticity of host '192.168.122.71 (192.168.122.71)' can't be established.
ECDSA key fingerprint is ec:03:36:24:38:67:5a:21:6c:72:03:ee:a7:91:6b:0d.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.122.71' (ECDSA) to the list of known hosts.
root.122.71's password: 
replica-info-replica.testrelm.test.gpg                               100%   14KB  13.7KB/s   00:00    

[root@replica ~]# ipa-replica-install -w Secret123 -p Secret123 ./replica-info-replica.testrelm.test.gpg 
Run connection check to master
Check connection from replica to remote master 'master.testrelm.test':
   Directory Service: Unsecure port (389): OK
   Directory Service: Secure port (636): OK
   Kerberos KDC: TCP (88): OK
   Kerberos Kpasswd: TCP (464): OK
   HTTP Server: Unsecure port (80): OK
   HTTP Server: Secure port (443): OK

The following list of ports use UDP protocol and would need to be
checked manually:
   Kerberos KDC: UDP (88): SKIPPED
   Kerberos Kpasswd: UDP (464): SKIPPED

Connection from replica to master is OK.
Start listening on required ports for remote master check
Get credentials to log in to remote master
Check SSH connection to remote master
Execute check on remote master
Check connection from master to remote replica 'replica.testrelm.test':
   Directory Service: Unsecure port (389): OK
   Directory Service: Secure port (636): OK
   Kerberos KDC: TCP (88): OK
   Kerberos KDC: UDP (88): OK
   Kerberos Kpasswd: TCP (464): OK
   Kerberos Kpasswd: UDP (464): OK
   HTTP Server: Unsecure port (80): OK
   HTTP Server: Secure port (443): OK

Connection from master to replica is OK.

Connection check OK
Configuring NTP daemon (ntpd)
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
  [4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server (dirsrv). Estimated time: 1 minute
  [1/38]: creating directory server user
  [2/38]: creating directory server instance
  [3/38]: adding default schema
  [4/38]: enabling memberof plugin
  [5/38]: enabling winsync plugin
  [6/38]: configuring replication version plugin
  [7/38]: enabling IPA enrollment plugin
  [8/38]: enabling ldapi
  [9/38]: configuring uniqueness plugin
  [10/38]: configuring uuid plugin
  [11/38]: configuring modrdn plugin
  [12/38]: configuring DNS plugin
  [13/38]: enabling entryUSN plugin
  [14/38]: configuring lockout plugin
  [15/38]: creating indices
  [16/38]: enabling referential integrity plugin
  [17/38]: configuring ssl for ds instance
  [18/38]: configuring certmap.conf
  [19/38]: configure autobind for root
  [20/38]: configure new location for managed entries
  [21/38]: configure dirsrv ccache
  [22/38]: enable SASL mapping fallback
  [23/38]: restarting directory server
  [24/38]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 3 seconds elapsed
Update succeeded

  [25/38]: updating schema
  [26/38]: setting Auto Member configuration
  [27/38]: enabling S4U2Proxy delegation
  [28/38]: importing CA certificates from LDAP
  [29/38]: initializing group membership
  [30/38]: adding master entry
  [31/38]: initializing domain level
  [32/38]: configuring Posix uid/gid generation
  [33/38]: adding replication acis
  [34/38]: enabling compatibility plugin
  [35/38]: activating sidgen plugin
  [36/38]: activating extdom plugin
  [37/38]: tuning directory server
  [38/38]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc). Estimated time: 30 seconds
  [1/8]: adding sasl mappings to the directory
  [2/8]: configuring KDC
  [3/8]: creating a keytab for the directory
  [4/8]: creating a keytab for the machine
  [5/8]: adding the password extension to the directory
  [6/8]: enable GSSAPI for replication
  [7/8]: starting the KDC
  [8/8]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
  [1/2]: starting kadmin 
  [2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa_memcached
  [1/2]: starting ipa_memcached 
  [2/2]: configuring ipa_memcached to start on boot
Done configuring ipa_memcached.
Configuring the web interface (httpd). Estimated time: 1 minute
  [1/16]: setting mod_nss port to 443
  [2/16]: setting mod_nss protocol list to TLSv1.0 - TLSv1.2
  [3/16]: setting mod_nss password file
  [4/16]: enabling mod_nss renegotiate
  [5/16]: adding URL rewriting rules
  [6/16]: configuring httpd
  [7/16]: setting up ssl
  [8/16]: importing CA certificates from LDAP
  [9/16]: publish CA cert
  [10/16]: creating a keytab for httpd
  [11/16]: clean up any existing httpd ccache
  [12/16]: configuring SELinux for httpd
  [13/16]: create KDC proxy config
  [14/16]: enable KDC proxy
  [15/16]: restarting httpd
  [16/16]: configuring httpd to start on boot
Done configuring the web interface (httpd).
Configuring ipa-otpd
  [1/2]: starting ipa-otpd 
  [2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Applying LDAP updates
Upgrading IPA:
  [1/9]: stopping directory server
  [2/9]: saving configuration
  [3/9]: disabling listeners
  [4/9]: enabling DS global lock
  [5/9]: starting directory server
  [6/9]: upgrading server
  [7/9]: stopping directory server
  [8/9]: restoring configuration
  [9/9]: starting directory server
Done.
Restarting the directory server
Restarting the KDC
Restarting the web server
Comment 8 errata-xmlrpc 2015-11-19 12:05:31 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2362.html
Note You need to log in before you can comment on or make changes to this bug.