Bug 1379029 - conncheck failing intermittently during single step replica installs
Summary: conncheck failing intermittently during single step replica installs
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Pavel Picka
QA Contact: Pavel Picka
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-09-24 01:15 UTC by Scott Poore
Modified: 2017-08-01 09:42 UTC (History)
6 users (show)

Fixed In Version: ipa-4.5.0-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-08-01 09:42:02 UTC
Target Upstream Version:


Attachments (Terms of Use)
ipa-replica-install output with --debug option (33.32 KB, text/plain)
2016-09-24 01:18 UTC, Scott Poore
no flags Details
output (8.41 KB, text/plain)
2017-06-06 15:26 UTC, Pavel Picka
no flags Details


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2304 normal SHIPPED_LIVE ipa bug fix and enhancement update 2017-08-01 12:41:35 UTC

Description Scott Poore 2016-09-24 01:15:48 UTC
Description of problem:

In some test environments we are seeing ipa-replica-install fail occasionally during ipa-replica-conncheck.

2016-09-24T00:43:55Z DEBUG args=/usr/sbin/ipa-replica-conncheck --master master.testrelm.test --auto-master-check --realm TESTRELM.TEST --hostname replica.testrelm.test --principal admin --password XXXXXXXX --ca-cert-file /etc/ipa/ca.crt
2016-09-24T00:44:00Z DEBUG Process finished, return code=1
2016-09-24T00:44:00Z DEBUG stdout=Check connection from replica to remote master 'master.testrelm.test':
   Directory Service: Unsecure port (389): OK
   Directory Service: Secure port (636): OK
   Kerberos KDC: TCP (88): OK
   Kerberos Kpasswd: TCP (464): OK
   HTTP Server: Unsecure port (80): OK
   HTTP Server: Secure port (443): OK

The following list of ports use UDP protocol and would need to be
checked manually:
   Kerberos KDC: UDP (88): SKIPPED
   Kerberos Kpasswd: UDP (464): SKIPPED

Connection from replica to master is OK.
Start listening on required ports for remote master check
Get credentials to log in to remote master
Check RPC connection to remote master
Execute check on remote master
Check connection from master to remote replica 'replica.testrelm.test':
   Directory Service: Unsecure port (389): FAILED
   Directory Service: Secure port (636): FAILED
   Kerberos KDC: TCP (88): FAILED
   Kerberos KDC: UDP (88): WARNING
   Kerberos Kpasswd: TCP (464): FAILED
   Kerberos Kpasswd: UDP (464): WARNING
   HTTP Server: Unsecure port (80): FAILED
   HTTP Server: Secure port (443): FAILED
The following UDP ports could not be verified as open: 88, 464
This can happen if they are already bound to an application
and ipa-replica-conncheck cannot attach own UDP responder.
Port check failed! Inaccessible port(s): 389 (TCP), 636 (TCP), 88 (TCP), 464 (TCP), 80 (TCP), 443 (TCP)

2016-09-24T00:44:00Z DEBUG stderr=Remote master check failed with following error message(s):
ipa-replica-conncheck returned non-zero exit code


Version-Release number of selected component (if applicable):
ipa-server-4.4.0-12.el7.x86_64


How reproducible:
unknown but seen multiple times in test environments.  Mostly in OSP test environments but, I believe we may have seen this earlier in testing in local VM type tests as well.  That we thought had gone away after some release.

Steps to Reproduce:
1.  Install IPA master with DNS
2.  Point resolv.conf on replica to IPA master
3.  Set hostname on replica to match domain of master
4.  on master add DNS record for replica (with a-rec and a-create-reverse)
5.  Install replica with DNS and CA in one step process

Exact command failing:
ipa-replica-install -U --setup-dns --forwarder <DNSFORWARDERIP> --setup-ca --ip-address <REPLICAIP> --server master.testrelm.test --domain testrelm.test --admin-password Secret123 --principal admin


Actual results:

Fails during conncheck


Expected results:

Installs cleanly.

Additional info:

Comment 1 Scott Poore 2016-09-24 01:18:40 UTC
Created attachment 1204317 [details]
ipa-replica-install output with --debug option

Comment 2 Scott Poore 2016-09-24 01:24:05 UTC
Also, note that if I manually run client install and then conncheck, it works.  But, I can uninstall the client and re-run replica-install and it fails.  Some kind of timing issue possibly?

Comment 10 Petr Vobornik 2016-11-04 13:17:22 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/6456

Comment 11 Petr Vobornik 2016-11-25 14:06:53 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/6487

Comment 12 Martin Bašti 2016-12-01 14:22:14 UTC
Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/af0ba661889c2e2c9a35d4cff9681c2abab73649

Comment 13 Martin Bašti 2016-12-06 11:48:34 UTC
Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/a44974cdf8a6c53f2e86dac92aa579ba45f666e4

Comment 15 Pavel Picka 2017-06-06 15:26:34 UTC
Created attachment 1285457 [details]
output

Verified on ipa-server-4.5.0-14.el7.x86_64

Comment 16 errata-xmlrpc 2017-08-01 09:42:02 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2304


Note You need to log in before you can comment on or make changes to this bug.