Bug 1254038 - ipa-replica-install pk12util error returns exit status 10
ipa-replica-install pk12util error returns exit status 10
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa (Show other bugs)
7.2
Unspecified Unspecified
medium Severity unspecified
: rc
: ---
Assigned To: IPA Maintainers
Namita Soman
: Regression
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-08-16 21:13 EDT by Scott Poore
Modified: 2015-11-19 07:05 EST (History)
4 users (show)

See Also:
Fixed In Version: ipa-4.2.0-5.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-11-19 07:05:31 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Scott Poore 2015-08-16 21:13:10 EDT
Description of problem:

attempting a test ipa-replica-install with a replica info file generated using pkcs12 files is erroring after OTP setup:

Configuring ipa-otpd
  [1/2]: starting ipa-otpd 
  [2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

ipa.ipapython.install.cli.install_tool(Replica): ERROR    Command ''/usr/bin/pk12util' '-d' '/etc/httpd/alias' '-i' '/tmp/tmp_RtEI_ipa/realm_info/ra.p12' '-k' '/etc/httpd/alias/pwdfile.txt' '-w' '/tmp/tmpYIVF03'' returned non-zero exit status 10


Version-Release number of selected component (if applicable):
ipa-server-4.2.0-4.el7.x86_64


How reproducible:
always

Steps to Reproduce:
1.  Install IPA Server:

ipa-server-install --setup-dns --forwarder=192.168.122.1 -r TESTRELM.TEST -n testrelm.test -a Secret123 -p Secret123 -U
[root@rhel7-1 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.122.71	master.testrelm.test master
192.168.122.72 replica.testrelm.test

2.  Create Replica info file to use to get pkcs12 certs for http and ds:

ipa-replica-prepare -p Secret123 replica.testrelm.test

3.  Unarchive replica info file:

echo Secret123 | gpg --batch --passphrase-fd 0 -d /var/lib/ipa/replica-info-replica.testrelm.test.gpg |tar xvf -

4.  Remove of info file

rm -rf /var/lib/ipa/replica-info-*

5.  Generate new info file with the pkcs12 certs:

ipa-replica-prepare -p Secret123 --ip-address=192.168.122.72 --reverse-zone=122.168.192.in-addr.arpa. replica.testrelm.test --dirsrv_pkcs12=realm_info/dscert.p12 --dirsrv_pin='' --http_pkcs12=realm_info/httpcert.p12 --http_pin=''

6.  Install on replica using new replica info file

scp root@192.168.122.71:/var/lib/ipa/replica-info-replica.testrelm.test.gpg .
ipa-replica-install -w Secret123 -p Secret123 ./replica-info-replica.testrelm.test.gpg 


Actual results:
Errors out with pk12util error 10.

Expected results:
Installs without errors.

Additional info:

ipareplica-install.log:

2015-08-17T00:52:38Z DEBUG Starting external process
2015-08-17T00:52:38Z DEBUG args='/usr/bin/pk12util' '-d' '/etc/httpd/alias' '-i' '/tmp/tmp_RtEI_ipa/realm_info/ra.p12' '-k' '/etc/httpd/alias/pwdfile.txt' '-w' '/tmp/tmpYIVF03'
2015-08-17T00:52:38Z DEBUG Process finished, return code=10
2015-08-17T00:52:38Z DEBUG stdout=
2015-08-17T00:52:38Z DEBUG stderr=pk12util: File Open failed: /tmp/tmp_RtEI_ipa/realm_info/ra.p12: PR_FILE_NOT_FOUND_ERROR: File not found

2015-08-17T00:52:38Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 308, in run
    cfgr.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 280, in run
    self.execute()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 302, in execute
    for nothing in self._executor():
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 342, in __runner
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in _handle_exception
    util.raise_exc_info(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 332, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 87, in run_generator_with_yield_from
    raise_exc_info(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 65, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 523, in _configure
    executor.next()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 342, in __runner
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 420, in _handle_exception
    self.__parent._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in _handle_exception
    util.raise_exc_info(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 417, in _handle_exception
    super(ComponentBase, self)._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in _handle_exception
    util.raise_exc_info(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 332, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 87, in run_generator_with_yield_from
    raise_exc_info(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 65, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install
    for nothing in self._installer(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 887, in main
    install(self)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 295, in decorated
    func(installer)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 587, in install
    CA.import_ra_cert(config.dir + "/ra.p12")
  File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 900, in import_ra_cert
    import_pkcs12(rafile, agent_name, self.ra_agent_db, self.ra_agent_pwd)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 134, in import_pkcs12
    "-w", input_passwd])
  File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 373, in run
    raise CalledProcessError(p.returncode, arg_string, stdout)

2015-08-17T00:52:38Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command ''/usr/bin/pk12util' '-d' '/etc/httpd/alias' '-i' '/tmp/tmp_RtEI_ipa/realm_info/ra.p12' '-k' '/etc/httpd/alias/pwdfile.txt' '-w' '/tmp/tmpYIVF03'' returned non-zero exit status 10
2015-08-17T00:52:38Z ERROR Command ''/usr/bin/pk12util' '-d' '/etc/httpd/alias' '-i' '/tmp/tmp_RtEI_ipa/realm_info/ra.p12' '-k' '/etc/httpd/alias/pwdfile.txt' '-w' '/tmp/tmpYIVF03'' returned non-zero exit status 10
Comment 3 Petr Vobornik 2015-08-17 03:52:42 EDT
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5226
Comment 7 Scott Poore 2015-08-21 15:42:52 EDT
Verified.

Version ::

ipa-server-4.2.0-5.el7.x86_64

Results ::

[root@master ~]# ipa-replica-prepare -p Secret123 replica.testrelm.test
Preparing replica for replica.testrelm.test from master.testrelm.test
Creating SSL certificate for the Directory Server
Creating SSL certificate for the dogtag Directory Server
Saving dogtag Directory Server port
Creating SSL certificate for the Web Server
Exporting RA certificate
Copying additional files
Finalizing configuration
Packaging replica information into /var/lib/ipa/replica-info-replica.testrelm.test.gpg
Waiting for replica.testrelm.test. A or AAAA record to be resolvable
This can be safely interrupted (Ctrl+C)
^CInterrupted
The ipa-replica-prepare command was successful

[root@master ~]# echo Secret123 | gpg --batch --passphrase-fd 0 -d /var/lib/ipa/replica-info-replica.testrelm.test.gpg |tar xvf -
gpg: directory `/root/.gnupg' created
gpg: new configuration file `/root/.gnupg/gpg.conf' created
gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/root/.gnupg/secring.gpg' created
gpg: keyring `/root/.gnupg/pubring.gpg' created
gpg: CAST5 encrypted data
gpg: encrypted with 1 passphrase
gpg: WARNING: message was not integrity protected
realm_info/
realm_info/dirsrv_pin.txt
realm_info/cacert.p12
realm_info/pwdfile.txt.orig
realm_info/dscert.p12
realm_info/dogtagcert.p12
realm_info/dogtag_directory_port.txt
realm_info/http_pin.txt
realm_info/pwdfile.txt
realm_info/httpcert.p12
realm_info/ra.p12
realm_info/ca.crt
realm_info/preferences.html
realm_info/configure.jar
realm_info/default.conf
realm_info/realm_info

[root@master ~]# rm -rf /var/lib/ipa/replica-info-*

[root@master ~]# ipa-replica-prepare -p Secret123 --ip-address=192.168.122.74 --reverse-zone=122.168.192.in-addr.arpa. replica.testrelm.test --dirsrv_pkcs12=realm_info/dscert.p12 --dirsrv_pin='' --http_pkcs12=realm_info/httpcert.p12 --http_pin=''
Preparing replica for replica.testrelm.test from master.testrelm.test
Copying SSL certificate for the Directory Server
Copying SSL certificate for the Web Server
Copying additional files
Finalizing configuration
Packaging replica information into /var/lib/ipa/replica-info-replica.testrelm.test.gpg
Adding DNS records for replica.testrelm.test
Adding reverse zone 122.168.192.in-addr.arpa.
Waiting for replica.testrelm.test. A or AAAA record to be resolvable
This can be safely interrupted (Ctrl+C)
The ipa-replica-prepare command was successful
[root@master ~]# 

[root@replica ~]# scp root@192.168.122.71:/var/lib/ipa/replica-info-replica.testrelm.test.gpg .
The authenticity of host '192.168.122.71 (192.168.122.71)' can't be established.
ECDSA key fingerprint is ec:03:36:24:38:67:5a:21:6c:72:03:ee:a7:91:6b:0d.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.122.71' (ECDSA) to the list of known hosts.
root@192.168.122.71's password: 
replica-info-replica.testrelm.test.gpg                               100%   14KB  13.7KB/s   00:00    

[root@replica ~]# ipa-replica-install -w Secret123 -p Secret123 ./replica-info-replica.testrelm.test.gpg 
Run connection check to master
Check connection from replica to remote master 'master.testrelm.test':
   Directory Service: Unsecure port (389): OK
   Directory Service: Secure port (636): OK
   Kerberos KDC: TCP (88): OK
   Kerberos Kpasswd: TCP (464): OK
   HTTP Server: Unsecure port (80): OK
   HTTP Server: Secure port (443): OK

The following list of ports use UDP protocol and would need to be
checked manually:
   Kerberos KDC: UDP (88): SKIPPED
   Kerberos Kpasswd: UDP (464): SKIPPED

Connection from replica to master is OK.
Start listening on required ports for remote master check
Get credentials to log in to remote master
Check SSH connection to remote master
Execute check on remote master
Check connection from master to remote replica 'replica.testrelm.test':
   Directory Service: Unsecure port (389): OK
   Directory Service: Secure port (636): OK
   Kerberos KDC: TCP (88): OK
   Kerberos KDC: UDP (88): OK
   Kerberos Kpasswd: TCP (464): OK
   Kerberos Kpasswd: UDP (464): OK
   HTTP Server: Unsecure port (80): OK
   HTTP Server: Secure port (443): OK

Connection from master to replica is OK.

Connection check OK
Configuring NTP daemon (ntpd)
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
  [4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server (dirsrv). Estimated time: 1 minute
  [1/38]: creating directory server user
  [2/38]: creating directory server instance
  [3/38]: adding default schema
  [4/38]: enabling memberof plugin
  [5/38]: enabling winsync plugin
  [6/38]: configuring replication version plugin
  [7/38]: enabling IPA enrollment plugin
  [8/38]: enabling ldapi
  [9/38]: configuring uniqueness plugin
  [10/38]: configuring uuid plugin
  [11/38]: configuring modrdn plugin
  [12/38]: configuring DNS plugin
  [13/38]: enabling entryUSN plugin
  [14/38]: configuring lockout plugin
  [15/38]: creating indices
  [16/38]: enabling referential integrity plugin
  [17/38]: configuring ssl for ds instance
  [18/38]: configuring certmap.conf
  [19/38]: configure autobind for root
  [20/38]: configure new location for managed entries
  [21/38]: configure dirsrv ccache
  [22/38]: enable SASL mapping fallback
  [23/38]: restarting directory server
  [24/38]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 3 seconds elapsed
Update succeeded

  [25/38]: updating schema
  [26/38]: setting Auto Member configuration
  [27/38]: enabling S4U2Proxy delegation
  [28/38]: importing CA certificates from LDAP
  [29/38]: initializing group membership
  [30/38]: adding master entry
  [31/38]: initializing domain level
  [32/38]: configuring Posix uid/gid generation
  [33/38]: adding replication acis
  [34/38]: enabling compatibility plugin
  [35/38]: activating sidgen plugin
  [36/38]: activating extdom plugin
  [37/38]: tuning directory server
  [38/38]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc). Estimated time: 30 seconds
  [1/8]: adding sasl mappings to the directory
  [2/8]: configuring KDC
  [3/8]: creating a keytab for the directory
  [4/8]: creating a keytab for the machine
  [5/8]: adding the password extension to the directory
  [6/8]: enable GSSAPI for replication
  [7/8]: starting the KDC
  [8/8]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
  [1/2]: starting kadmin 
  [2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa_memcached
  [1/2]: starting ipa_memcached 
  [2/2]: configuring ipa_memcached to start on boot
Done configuring ipa_memcached.
Configuring the web interface (httpd). Estimated time: 1 minute
  [1/16]: setting mod_nss port to 443
  [2/16]: setting mod_nss protocol list to TLSv1.0 - TLSv1.2
  [3/16]: setting mod_nss password file
  [4/16]: enabling mod_nss renegotiate
  [5/16]: adding URL rewriting rules
  [6/16]: configuring httpd
  [7/16]: setting up ssl
  [8/16]: importing CA certificates from LDAP
  [9/16]: publish CA cert
  [10/16]: creating a keytab for httpd
  [11/16]: clean up any existing httpd ccache
  [12/16]: configuring SELinux for httpd
  [13/16]: create KDC proxy config
  [14/16]: enable KDC proxy
  [15/16]: restarting httpd
  [16/16]: configuring httpd to start on boot
Done configuring the web interface (httpd).
Configuring ipa-otpd
  [1/2]: starting ipa-otpd 
  [2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Applying LDAP updates
Upgrading IPA:
  [1/9]: stopping directory server
  [2/9]: saving configuration
  [3/9]: disabling listeners
  [4/9]: enabling DS global lock
  [5/9]: starting directory server
  [6/9]: upgrading server
  [7/9]: stopping directory server
  [8/9]: restoring configuration
  [9/9]: starting directory server
Done.
Restarting the directory server
Restarting the KDC
Restarting the web server
Comment 8 errata-xmlrpc 2015-11-19 07:05:31 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2362.html

Note You need to log in before you can comment on or make changes to this bug.