Bug 1788718 - ipa-server-install incorrectly setting slew mode (-x) when setting up ntpd
Summary: ipa-server-install incorrectly setting slew mode (-x) when setting up ntpd
Keywords:
Status: VERIFIED
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.8
Hardware: All
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Florence Blanc-Renaud
QA Contact: ipa-qe
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-01-07 22:09 UTC by Eugene Keck
Modified: 2020-04-24 14:28 UTC (History)
7 users (show)

Fixed In Version: ipa-4.6.8-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:


Attachments (Terms of Use)

Description Eugene Keck 2020-01-07 22:09:02 UTC
Description of problem:
slew mode (-x) added to ntpd during the ipa-server-install may break ntpd from starting if time screw is too great between system and hardware clock. Slew mode is a unstable configuration choice and has many known drawbacks. 

Version-Release number of selected component (if applicable):
All

How reproducible:
always

Steps to Reproduce:
# ipa-server-install

Actual results:
# cat /etc/sysconfig/ntpd
# Command line options for ntpd
OPTIONS="-g -x"

Expected results:
# Command line options for ntpd
OPTIONS="-q"

Comment 2 Eugene Keck 2020-01-07 22:14:54 UTC
Sorry the expected should be

OPTIONS="-g -q"

Comment 4 Rob Crittenden 2020-01-08 14:53:20 UTC
-q "exits just after setting the clock for the first time" so I don't think that is valid.

Is the concern that slew mode is not announced or that it is set at all?

This has been set since 2010.

Comment 9 Florence Blanc-Renaud 2020-02-14 15:31:55 UTC
Decision was made to fix in new installations only

Comment 10 Rob Crittenden 2020-03-18 15:51:52 UTC
The requested expected configuration goes beyond just dropping -x. It also suggests dropping -g (allow big time gaps) and adds -q (quit after sync).

-g is there to do the best possible to bring the machine into sync with current time in order to increase the chance that it can communicate with other machines over Kerberos and TLS. I guess it is normally used in conjunction with -x. What would the impact be if time is quite off without -g and -x? I assume the server will quite with a non-zero return code? We could catch that and quit installation if time can't be brought into sync.

Adding -q seems like something we don't want since we want ntpd to continue running, right?

Note to self: -x is also used in the client installer and also needs to be dropped.

Comment 11 Rob Crittenden 2020-03-24 20:07:11 UTC
Upstream ticket:
https://pagure.io/freeipa/issue/8242

Comment 12 Rob Crittenden 2020-03-25 16:34:52 UTC
Upstream PR https://github.com/freeipa/freeipa/pull/4454

Clearing needinfo, only removing -x.

Comment 13 Christian Heimes 2020-03-26 09:18:03 UTC
Fixed upstream
ipa-4-6:
https://pagure.io/freeipa/c/2c1495460fcb0d58d27579bfbd6aba63b91bf985

Comment 14 Rob Crittenden 2020-03-31 13:11:30 UTC
Test added upstream
ipa-4-6:
https://pagure.io/freeipa/c/81b859795c72f6c96b27137cc24d6df327ca8471

Comment 17 Mohammad Rizwan 2020-04-16 12:26:46 UTC
version : ipa-server-4.6.8-1.el7


api.env: 
{'api_version': u'2.237',
 'bin': u'/bin',
 'ca_agent_install_port': None,
 'ca_agent_port': 443,
 'ca_ee_install_port': None,
 'ca_ee_port': 443,
 'ca_host': u'runner.testrelm.test',
 'ca_install_port': None,
 'ca_port': 80,
 'conf': u'/root/.ipa/cli.conf',
 'conf_default': u'/root/.ipa/default.conf',
 'confdir': u'/root/.ipa',
 'container_accounts': ipapython.dn.DN('cn=accounts'),
 'container_adtrusts': ipapython.dn.DN('cn=ad,cn=trusts'),
 'container_applications': ipapython.dn.DN('cn=applications,cn=configs,cn=policies'),
 'container_automember': ipapython.dn.DN('cn=automember,cn=etc'),
 'container_automount': ipapython.dn.DN('cn=automount'),
 'container_ca': ipapython.dn.DN('cn=cas,cn=ca'),
 'container_ca_renewal': ipapython.dn.DN('cn=ca_renewal,cn=ipa,cn=etc'),
 'container_caacl': ipapython.dn.DN('cn=caacls,cn=ca'),
 'container_certmap': ipapython.dn.DN('cn=certmap'),
 'container_certmaprules': ipapython.dn.DN('cn=certmaprules,cn=certmap'),
 'container_certprofile': ipapython.dn.DN('cn=certprofiles,cn=ca'),
 'container_cifsdomains': ipapython.dn.DN('cn=ad,cn=etc'),
 'container_configs': ipapython.dn.DN('cn=configs,cn=policies'),
 'container_custodia': ipapython.dn.DN('cn=custodia,cn=ipa,cn=etc'),
 'container_deleteuser': ipapython.dn.DN('cn=deleted users,cn=accounts,cn=provisioning'),
 'container_dna': ipapython.dn.DN('cn=dna,cn=ipa,cn=etc'),
 'container_dna_posix_ids': ipapython.dn.DN('cn=posix-ids,cn=dna,cn=ipa,cn=etc'),
 'container_dns': ipapython.dn.DN('cn=dns'),
 'container_dnsservers': ipapython.dn.DN('cn=servers,cn=dns'),
 'container_group': ipapython.dn.DN('cn=groups,cn=accounts'),
 'container_hbac': ipapython.dn.DN('cn=hbac'),
 'container_hbacservice': ipapython.dn.DN('cn=hbacservices,cn=hbac'),
 'container_hbacservicegroup': ipapython.dn.DN('cn=hbacservicegroups,cn=hbac'),
 'container_host': ipapython.dn.DN('cn=computers,cn=accounts'),
 'container_hostgroup': ipapython.dn.DN('cn=hostgroups,cn=accounts'),
 'container_locations': ipapython.dn.DN('cn=locations,cn=etc'),
 'container_masters': ipapython.dn.DN('cn=masters,cn=ipa,cn=etc'),
 'container_netgroup': ipapython.dn.DN('cn=ng,cn=alt'),
 'container_otp': ipapython.dn.DN('cn=otp'),
 'container_permission': ipapython.dn.DN('cn=permissions,cn=pbac'),
 'container_policies': ipapython.dn.DN('cn=policies'),
 'container_policygroups': ipapython.dn.DN('cn=policygroups,cn=configs,cn=policies'),
 'container_policylinks': ipapython.dn.DN('cn=policylinks,cn=configs,cn=policies'),
 'container_privilege': ipapython.dn.DN('cn=privileges,cn=pbac'),
 'container_radiusproxy': ipapython.dn.DN('cn=radiusproxy'),
 'container_ranges': ipapython.dn.DN('cn=ranges,cn=etc'),
 'container_realm_domains': ipapython.dn.DN('cn=Realm Domains,cn=ipa,cn=etc'),
 'container_rolegroup': ipapython.dn.DN('cn=roles,cn=accounts'),
 'container_roles': ipapython.dn.DN('cn=roles,cn=policies'),
 'container_s4u2proxy': ipapython.dn.DN('cn=s4u2proxy,cn=etc'),
 'container_selinux': ipapython.dn.DN('cn=usermap,cn=selinux'),
 'container_service': ipapython.dn.DN('cn=services,cn=accounts'),
 'container_stageuser': ipapython.dn.DN('cn=staged users,cn=accounts,cn=provisioning'),
 'container_sudocmd': ipapython.dn.DN('cn=sudocmds,cn=sudo'),
 'container_sudocmdgroup': ipapython.dn.DN('cn=sudocmdgroups,cn=sudo'),
 'container_sudorule': ipapython.dn.DN('cn=sudorules,cn=sudo'),
 'container_sysaccounts': ipapython.dn.DN('cn=sysaccounts,cn=etc'),
 'container_topology': ipapython.dn.DN('cn=topology,cn=ipa,cn=etc'),
 'container_trusts': ipapython.dn.DN('cn=trusts'),
 'container_user': ipapython.dn.DN('cn=users,cn=accounts'),
 'container_vault': ipapython.dn.DN('cn=vaults,cn=kra'),
 'container_views': ipapython.dn.DN('cn=views,cn=accounts'),
 'container_virtual': ipapython.dn.DN('cn=virtual operations,cn=etc'),
 'context': u'cli',
 'debug': False,
 'delegate': False,
 'dogtag_version': 9,
 'dot_ipa': u'/root/.ipa',
 'enable_ra': False,
 'env_confdir': None,
 'fallback': False,
 'fips_mode': False,
 'force_schema_check': False,
 'home': u'/root',
 'host': u'runner.testrelm.test',
 'http_timeout': 30,
 'in_server': False,
 'in_tree': True,
 'interactive': True,
 'ipalib': u'/usr/lib/python2.7/site-packages/ipalib',
 'kinit_lifetime': None,
 'log': u'/root/.ipa/log/cli.log',
 'logdir': u'/root/.ipa/log',
 'mode': u'developer',
 'mount_ipa': u'/ipa/',
 'nss_dir': u'/root/.ipa/nssdb',
 'plugins_on_demand': True,
 'prompt_all': False,
 'ra_plugin': u'selfsign',
 'recommended_max_agmts': 4,
 'replication_wait_timeout': 300,
 'rpc_protocol': u'jsonrpc',
 'script': u'/bin/ipa-run-tests',
 'site_packages': u'/usr/lib/python2.7/site-packages',
 'skip_version_check': False,
 'startup_timeout': 300,
 'startup_traceback': False,
 'tls_ca_cert': u'/root/.ipa/ca.crt',
 'tls_version_max': u'tls1.2',
 'tls_version_min': u'tls1.2',
 'validate_api': False,
 'verbose': 0,
 'version': u'4.6.8',
 'wait_for_dns': 0,
 'webui_prod': True}
uname: ('Linux', 'runner.testrelm.test', '3.10.0-1133.el7.x86_64', '#1 SMP Fri Apr 3 04:18:59 EDT 2020', 'x86_64')
euid: 0, egid: 0
working dir: /usr/lib/python2.7/site-packages/ipatests
sys.version: 2.7.5 (default, Mar 20 2020, 17:08:22) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-39)]
============================= test session starts ==============================
platform linux2 -- Python 2.7.5, pytest-3.10.1, py-1.8.1, pluggy-0.13.1 -- /usr/bin/python2
cachedir: .pytest_cache
metadata: {'Python': '2.7.5', 'Platform': 'Linux-3.10.0-1133.el7.x86_64-x86_64-with-redhat-7.9-Maipo', 'Packages': {'py': '1.8.1', 'pytest': '3.10.1', 'pluggy': '0.13.1'}, 'Plugins': {u'html': u'1.22.1', u'multihost': u'1.1', u'sourceorder': u'0.5', u'metadata': u'1.8.0'}}
rootdir: /usr/lib/python2.7/site-packages/ipatests, inifile:
plugins: metadata-1.8.0, html-1.22.1, multihost-1.1, sourceorder-0.5
collecting ... collected 10 items

test_integration/test_installation.py::TestInstallMaster::test_install_master PASSED [ 10%]
test_integration/test_installation.py::TestInstallMaster::test_slew_mode_not_configured PASSED [ 20%]   <<<<<<
test_integration/test_installation.py::TestInstallMaster::test_schema_compat_attribute_and_tree_disable PASSED [ 30%]


Automation passed. Hence marking the bug as verified.


Note You need to log in before you can comment on or make changes to this bug.