Bug 1563080
| Summary: | libldap tlsmc continue even after it fails to extract CA certificate [rhel-7.5.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Oneata Mircea Teodor <toneata> |
| Component: | openldap | Assignee: | Matus Honek <mhonek> |
| Status: | CLOSED ERRATA | QA Contact: | Patrik Kis <pkis> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.5 | CC: | atolani, enewland, fhanzelk, mhonek, mkosek, nkinder, pkis |
| Target Milestone: | rc | Keywords: | ZStream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | openldap-2.4.44-15.el7_5 | Doc Type: | If docs needed, set a value |
| Doc Text: |
Previously, during an OpenLDAP server upgrade, CA certificates were sometimes not extracted correctly due to SELinux policies not having been upgraded yet at the time. Consequently, the OpenLDAP server did not start after the upgrade as expected, and the administrator had to remove the /tmp/openldap-tlsmc* directories manually for the server to start. This update ensures that slapd correctly recreates the CA certificates. As a result, the OpenLDAP server starts correctly in the described scenario.
|
Story Points: | --- |
| Clone Of: | 1547922 | Environment: | |
| Last Closed: | 2018-05-14 16:10:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1547922 | ||
| Bug Blocks: | |||
|
Description
Oneata Mircea Teodor
2018-04-03 07:01:12 UTC
The test with upgrade from RHEL-7.3 proved that the issue was mitigated. During the upgrade the server certificate files in tmp directory could not been created, but the temporary certificate directory was not lefty in inconsistent state so manual restart of the slapd daemon restored the service. # rpm -q openldap openldap-2.4.40-13.el7.x86_64 # yum update ... %< ... ---> Package openldap.x86_64 0:2.4.40-13.el7 will be updated ---> Package openldap.x86_64 0:2.4.44-16.el7 will be an update ---> Package openldap-clients.x86_64 0:2.4.40-13.el7 will be updated ---> Package openldap-clients.x86_64 0:2.4.44-16.el7 will be an update ---> Package openldap-servers.x86_64 0:2.4.40-13.el7 will be updated ---> Package openldap-servers.x86_64 0:2.4.44-16.el7 will be an update ... %< ... Complete! # rpm -q openldap openldap-2.4.44-16.el7.x86_64 # # # ll /tmp/openldap-tlsmc-certs--2DFC65D7E76F2B10A5D1B751E42AB3C7A11D1DD635A2F8AF767FCF5AD8EDA4EB/cacerts/ total 4 -r--------. 1 ldap ldap 1522 Apr 12 02:29 cert0.pem # ldapsearch -ZZ -H ldap://my-domain.com -x '*'ldap_start_tls: Can't contact LDAP server (-1) # # ps -ef |grep slapd root 25352 17318 0 03:08 pts/0 00:00:00 grep --color=auto slapd # service slapd restart Redirecting to /bin/systemctl restart slapd.service # ll /tmp/openldap-tlsmc-certs--2DFC65D7E76F2B10A5D1B751E42AB3C7A11D1DD635A2F8AF767FCF5AD8EDA4EB/cacerts/ total 12 lrwxrwxrwx. 1 ldap ldap 9 Apr 12 03:08 1c3035cc.0 -> cert2.pem lrwxrwxrwx. 1 ldap ldap 9 Apr 12 03:08 82204446.0 -> cert0.pem lrwxrwxrwx. 1 ldap ldap 9 Apr 12 03:08 be4aa8c4.0 -> cert1.pem -r--------. 1 ldap ldap 1522 Apr 12 03:08 cert0.pem -r--------. 1 ldap ldap 1559 Apr 12 03:08 cert1.pem -r--------. 1 ldap ldap 1578 Apr 12 03:08 cert2.pem # # ldapsearch -LLL -ZZ -H ldap://my-domain.com -x dn: dc=my-domain,dc=com objectClass: dcObject objectClass: organization dc: my-domain o: my-domain description: my-domain Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:1389 |