Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
After the customer upgrade to the latest version of ipa-healthcheck the error "keyctl_search: Required key not available" below started to show up when they run ipa-healthcheck:
# ipa-healthcheck --debug --source pki.server.healthcheck.clones.connectivity_and_data
Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
keyctl_search: Required key not available
Enter password for :
...
...
...
Version-Release number of selected component (if applicable):
kernel-4.18.0-305.3.1.el8_4.x86_64
ipa-healthcheck-0.7-3.module+el8.4.0+9007+5084bdd8.noarch
How reproducible:
always
Hi,
Checking to see if we have an update on this. I have a customer experiencing the same issue after patching. They use this module to forward results to an upstream SIEM:
ipa-healthcheck-0.7-3.module+el8.4.0+9007+5084bdd8.noarch Mon Oct 25 17:04:14 2021
kernel-4.18.0-305.19.1.el8_4.x86_64 Mon Oct 25 17:04:16 2021
uname -a
4.18.0-305.19.1.el8_4.x86_64 #1 SMP Tue Sep 7 07:07:31 EDT 2021 x86_64 x86_64 x86_64 GNU/Linux
[root@<obfuscated ~]# ipa-healthcheck --failures-only
keyctl_search: Required key not available
Enter password for Internal Key Storage Token:
At this prompt if I do not enter a value and just hit enter at this promoted message I get this:
[root@<obfuscated> ~]# ipa-healthcheck --failures-only
keyctl_search: Required key not available
Enter password for Internal Key Storage Token:
[]
Comment 9Endi Sukma Dewata
2021-10-27 01:21:18 UTC
Marking the bug as FailedQA based on observation
pki-ca-10.12.0-0.1.module+el8.6.0+13291+248751b1.noarch
pki-server-10.12.0-0.1.module+el8.6.0+13291+248751b1.noarch
ipa-healthcheck-0.7-8.module+el8.6.0+13764+6ba37dc8.noarch
ipa-server-4.9.8-2.module+el8.6.0+13621+937b8cd9.x86_64
[root@server ~]# ipa-healthcheck --debug --source pki.server.healthcheck.clones.connectivity_and_data
Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
Source 'pki.server.healthcheck.clones.connectivity_and_data' not found
Comment 22Endi Sukma Dewata
2022-01-25 17:30:54 UTC
Just an update, it looks like the problem reported in the original
bug description (i.e. password prompt) was fixed, but apparently
there's a different issue affecting the healthcheck tool for KRA
clones. It's still being investigated.
My apologies, I thought I had already restored the state. The healthcheck failure is being tracked in a separate BZ, https://bugzilla.redhat.com/show_bug.cgi?id=2041995 , and is unrelated to your change. You can continue the bug cycle on this one.
Removing the FailedQA and moving back to ON_QA.
This change didn't fail. A different bug in ipa-healthcheck prevented the pki healthchecks from being run.
Comment 25Endi Sukma Dewata
2022-01-28 20:04:59 UTC
Just FYI the other pki-healthcheck issue (i.e. not the password prompt) is being addressed in bug #2027470.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (Moderate: pki-core:10.6 security and bug fix update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHSA-2022:1851