Bug 437405 - ipa-server-install fails - password not handled correctly
ipa-server-install fails - password not handled correctly
Status: CLOSED WONTFIX
Product: Fedora
Classification: Fedora
Component: ipa (Show other bugs)
9
All Linux
low Severity low
: ---
: ---
Assigned To: Rob Crittenden
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-03-13 17:23 EDT by Rich Megginson
Modified: 2009-07-14 12:13 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-07-14 12:13:14 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
rawhide-system: /tmp/ipaserver-install.log (6.84 KB, text/plain)
2008-03-15 04:16 EDT, Thorsten Scherf
no flags Details
f8-system: /tmp/ipaserver-install.log (17.64 KB, text/plain)
2008-03-15 04:17 EDT, Thorsten Scherf
no flags Details
error log from rawhide system (1.81 KB, application/octet-stream)
2008-03-18 03:51 EDT, Thorsten Scherf
no flags Details
error log from rhel5 system (22.49 KB, application/octet-stream)
2008-03-18 03:56 EDT, Thorsten Scherf
no flags Details
ipaserver-install.log (6.95 KB, text/plain)
2008-03-20 12:24 EDT, Thorsten Scherf
no flags Details
errors (47.04 KB, application/octet-stream)
2008-03-20 12:25 EDT, Thorsten Scherf
no flags Details

  None (edit)
Description Rich Megginson 2008-03-13 17:23:28 EDT
+++ This bug was initially created as a clone of Bug #437342 +++

Description of problem:
I called ipa-server-install with -N option since it is running inside of a xen
box. then the following error happened:

The following operations may take some minutes to complete.
Please wait until the prompt is returned.
Configuring directory server:
  [1/16]: creating directory server user
  [2/16]: creating directory server instance
root        : CRITICAL failed to restart ds instance Command
'/usr/sbin/setup-ds.pl --silent --logfile - -f /tmp/tmpjk-IZC' returned non-zero
exit status 2
  [3/16]: adding default schema
Unexpected error - see ipaserver-install.log for details:
 [Errno 2] No such file or directory:
'/etc/dirsrv/slapd-EXAMPLE-COM//schema/60kerberos.ldif'

all software have been installed using "yum install ipa-server"

Version-Release number of selected component (if applicable):
ipa-server-0.99-11.fc9.i386

How reproducible:
ipa-server-install

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

-- Additional comment from tscherf@redhat.com on 2008-03-13 13:14 EST --
get this when trying to call /usr/sbin/setup-ds.pl manually:

[root@fedora ~]# /usr/sbin/setup-ds.pl
Can't locate Mozilla/LDAP/Conn.pm in @INC (@INC contains: /usr/lib/dirsrv/perl
/usr/lib/perl5/5.10.0/i386-linux-thread-multi /usr/lib/perl5/5.10.0
/usr/lib/perl5/site_perl/5.10.0/i386-linux-thread-multi
/usr/lib/perl5/site_perl/5.10.0 /usr/lib/perl5/site_perl/5.8.8
/usr/lib/perl5/site_perl/5.8.7 /usr/lib/perl5/site_perl/5.8.6
/usr/lib/perl5/site_perl/5.8.5 /usr/lib/perl5/site_perl
/usr/lib/perl5/vendor_perl/5.10.0/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.10.0 /usr/lib/perl5/vendor_perl/5.8.8
/usr/lib/perl5/vendor_perl/5.8.7 /usr/lib/perl5/vendor_perl/5.8.6
/usr/lib/perl5/vendor_perl/5.8.5 /usr/lib/perl5/vendor_perl .) at
/usr/lib/dirsrv/perl/Setup.pm line 62.
BEGIN failed--compilation aborted at /usr/lib/dirsrv/perl/Setup.pm line 62.
Compilation failed in require at /usr/sbin/setup-ds.pl line 44.
BEGIN failed--compilation aborted at /usr/sbin/setup-ds.pl line 44.


-- Additional comment from rcritten@redhat.com on 2008-03-13 13:28 EST --
Try updating perl-Mozilla-LDAP-1.5.2-4.fc9.1

-- Additional comment from tscherf@redhat.com on 2008-03-13 16:00 EST --
that fixed it.

but here is another one after calling ipa-server-install I now got this:

[4/16]: enabling memberof plugin
root        : CRITICAL Failed to load memberof-conf.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w redhat--- -f
/usr/share/ipa/memberof-conf.ldif' returned non-zero exit status 49
  [5/16]: enabling referential integrity plugin
root        : CRITICAL Failed to load referint-conf.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w redhat--- -f
/usr/share/ipa/referint-conf.ldif' returned non-zero exit status 49
  [6/16]: enabling distributed numeric assignment plugin
root        : CRITICAL Failed to load dna-conf.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w redhat--- -f
/usr/share/ipa/dna-conf.ldif' returned non-zero exit status 49
  [7/16]: configuring uniqueness plugin
root        : CRITICAL Failed to load unique-attributes.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w redhat--- -f
/tmp/tmp1SuSax' returned non-zero exit status 49
  [8/16]: creating indices
root        : CRITICAL Failed to load indices.ldif: Command '/usr/bin/ldapmodify
-h 127.0.0.1 -xv -D cn=Directory Manager -w redhat--- -f
/usr/share/ipa/indices.ldif' returned non-zero exit status 49
  [9/16]: configuring ssl for ds instance
Unexpected error - see ipaserver-install.log for details:
 {'desc': 'Invalid credentials'}



-- Additional comment from tscherf@redhat.com on 2008-03-13 16:24 EST --
using "Directory Manager" as cn instead of Directory Manager shows up "invalid
credentials". looks like the account hasn't been created correctly?


-- Additional comment from tscherf@redhat.com on 2008-03-13 17:14 EST --
the ldapmodify above worked when manually setting the directory manager pw to a
CLEAR pw in dse.ldif. looks like the password is not handled correctly by
ipa-server-install.


The original bug has been closed (fixed by new version of perl-Mozilla-LDAP). 
Opening a new bug for the incorrect password issue.
Comment 1 Thorsten Scherf 2008-03-14 07:37:06 EDT
passing the passwords as an option to ipa-server-install also doesn't help here:

[root@fedora ~]# ipa-server-install -N -p redhat123 -a redhat123

will result in the same error code 49
Comment 2 Rob Crittenden 2008-03-14 12:34:57 EDT
Can you attach /var/log/ipaserver.log?
Comment 3 Thorsten Scherf 2008-03-14 18:52:00 EDT
there is no ipsserver.log, the only ipa related log is /var/log/ipa_error.log
and this one is empty.
Comment 4 Thorsten Scherf 2008-03-14 19:28:21 EDT
tried to install the server on f8 with enabled testing repo, got this error:

Configuring directory server:
  [1/16]: creating directory server user
  [2/16]: creating directory server instance
  [3/16]: adding default schema
  [4/16]: enabling memberof plugin
  [5/16]: enabling referential integrity plugin
  [6/16]: enabling distributed numeric assignment plugin
  [7/16]: configuring uniqueness plugin
  [8/16]: creating indices
  [9/16]: configuring ssl for ds instance
  [10/16]: configuring certmap.conf
  [11/16]: restarting directory server
  [12/16]: adding default layout
  [13/16]: configuring Posix uid/gid generation as first master
  [14/16]: adding master entry as first master
  [15/16]: initializing group membership
  [16/16]: configuring directory to start on boot
done configuring dirsrv.
Unexpected error - see ipaserver-install.log for details:
 {'desc': "Can't contact LDAP server"}
[root@tiffy ~]# ll /var/log/ipaserver-install.log
ls: cannot access /var/log/ipaserver-install.log: No such file or directory
[root@tiffy ~]# 
Comment 5 Rob Crittenden 2008-03-14 22:35:07 EDT
Well htat is some progress anyway. I think in the version you have the install
log goes into the current working directory.
Comment 6 Thorsten Scherf 2008-03-15 04:16:34 EDT
Created attachment 298136 [details]
rawhide-system: /tmp/ipaserver-install.log
Comment 7 Thorsten Scherf 2008-03-15 04:17:55 EDT
Created attachment 298137 [details]
f8-system: /tmp/ipaserver-install.log
Comment 8 Thorsten Scherf 2008-03-15 04:27:41 EDT
on both stations ipa-server-0.99-11 is used. on the rawhide box it looks like
the directory manager password is not coded correctly. as I said, when I use the
ldapmodify tool manually with the password I created during the setup, I get the
49 error as well. reseting the password fixes the problem. 

no idea what's going on on the f8 system where the ldapmodify works, but the
ldap server is not available.
 
Comment 9 Rob Crittenden 2008-03-15 23:12:01 EDT
What is your locale set to? Can you try setting to en_US.UTF-8 if it isn't already?
Comment 10 Thorsten Scherf 2008-03-16 09:20:01 EDT
on rhel5 and f8 this doesn't help to fix it, still the same issue with new locale:

[16/16]: configuring directory to start on boot
done configuring dirsrv.
Unexpected error - see ipaserver-install.log for details:
 {'desc': "Can't contact LDAP server"}
[root@rhel5 ~]# echo $LANG
en_US.UTF-8

will try to change the locale on the rawhide box as well, will do that tomorrow.
actually I don't have access to the box.


Comment 11 Rob Crittenden 2008-03-17 10:40:50 EDT
Ok, can you attach the directory server error log for a failed installation? It
can be found in /var/log/dirsrv/slapd-INSTANCE/errors
Comment 12 Thorsten Scherf 2008-03-18 03:51:55 EDT
Created attachment 298343 [details]
error log from rawhide system
Comment 13 Thorsten Scherf 2008-03-18 03:56:39 EDT
Created attachment 298344 [details]
error log from rhel5 system
Comment 14 Rob Crittenden 2008-03-19 11:44:46 EDT
That connect to LDAP thing sounds familiar. I worked on something similar where
it was trying to contact the wrong server. Can you try with an updated package
in rawhide: ipa-0.99-12.fc9

Similar updates are also in F-7 and F-8.
Comment 15 Thorsten Scherf 2008-03-20 12:24:11 EDT
on rawhide where I had this credential problem I still get the same error code
49 when running ipa-server-install with latest rawhide packages:

[root@fedora ~]# echo $LANG
en_US.UTF-8
[root@fedora ~]# rpm -q ipa-server
ipa-server-0.99-12.fc9.i386
[root@fedora ~]# 

install-log and error-log (dirsrv) attached.
Comment 16 Thorsten Scherf 2008-03-20 12:25:01 EDT
Created attachment 298712 [details]
ipaserver-install.log
Comment 17 Thorsten Scherf 2008-03-20 12:25:47 EDT
Created attachment 298713 [details]
errors
Comment 18 Thorsten Scherf 2008-03-20 12:26:57 EDT
keep in mind, this error is different than the one described on a f8/rhel5
system where the ldap connect error appears. on rawhide we have the problem that
the generated "directory manager" password is not accepted.
Comment 19 Simo Sorce 2008-03-20 13:34:01 EDT
What is your locale?
Are you using something different from utf-8 and using non ASCII characters in
your password ?
Comment 20 Thorsten Scherf 2008-03-20 14:09:06 EDT
LANG="en_US.UTF-8"

test password was "redhat123"
Comment 21 Thorsten Scherf 2008-03-20 14:59:39 EDT
additional info:

[root@fedora ~]# /usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn="Directory Manager"
-w redhat123 -f /usr/share/ipa/memberof-conf.ldif
ldap_initialize( ldap://127.0.0.1 )
ldap_bind: Invalid credentials (49)

machine is a kvm running on f8.
 
Comment 22 Rob Crittenden 2008-03-20 16:20:53 EDT
Ok, let's try to simplify the problem and try setting up DS by hand. I think I
have all this syntax correct:

Put this into /var/lib/dirsrv/boot.ldif:

dn: dc=virt,dc=tuxgeek,dc=de
objectClass: top
objectClass: domain
objectClass: pilotObject
dc: virt
info: IPA V1.0

Put this into a file named setup.inf

[General]
FullMachineName=   fedora.virt.tuxgeek.de
SuiteSpotUserID=   dirsrv
ServerRoot=    /usr/lib/dirsrv
[slapd]
ServerPort=   389
ServerIdentifier=   VIRT-TUXGEEK-DE
Suffix=   dc=virt,dc=tuxgeek,dc=de
RootDN=   cn=Directory Manager
InstallLdifFile= /var/lib/dirsrv/boot.ldif
RootDNPwd= redhat123

Run:
/usr/sbin/setup-ds.pl --silent --logfile - -f setup.inf

Then see if you can authenticate to that. You may need to remove an existing
instance if there already is one. An easy way is to run
/usr/sbin/ipa-server-install and let it remove the instance for you, then ^C to
quit out of the installer.
Comment 23 Thorsten Scherf 2008-03-27 14:35:04 EDT
looks good:

[root@fedora ~]# /usr/sbin/setup-ds.pl --silent --logfile - -f setup.inf
[08/03/27:19:33:49] - [Setup] Info Your new DS instance 'VIRT-TUXGEEK-DE' was
successfully created.
Your new DS instance 'VIRT-TUXGEEK-DE' was successfully created.
[08/03/27:19:33:49] - [Setup] Success Exiting . . .
Log file is '-'

Exiting . . .
Log file is '-'

[root@fedora ~]# 
Comment 24 Thorsten Scherf 2008-03-27 14:36:33 EDT
when I call ipa-server-install I again got this:

The following operations may take some minutes to complete.
Please wait until the prompt is returned.
Configuring ntpd
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
  [4/4]: starting ntpd
done configuring ntpd.
Configuring directory server:
  [1/16]: creating directory server user
  [2/16]: creating directory server instance
  [3/16]: adding default schema
  [4/16]: enabling memberof plugin
root        : CRITICAL Failed to load memberof-conf.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w redhat123 -f
/usr/share/ipa/memberof-conf.ldif' returned non-zero exit status 49
  [5/16]: enabling referential integrity plugin
root        : CRITICAL Failed to load referint-conf.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w redhat123 -f
/usr/share/ipa/referint-conf.ldif' returned non-zero exit status 49
  [6/16]: enabling distributed numeric assignment plugin
root        : CRITICAL Failed to load dna-conf.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w redhat123 -f
/usr/share/ipa/dna-conf.ldif' returned non-zero exit status 49
  [7/16]: configuring uniqueness plugin
root        : CRITICAL Failed to load unique-attributes.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w redhat123 -f
/tmp/tmpOPOdA3' returned non-zero exit status 49
  [8/16]: creating indices
root        : CRITICAL Failed to load indices.ldif: Command '/usr/bin/ldapmodify
-h 127.0.0.1 -xv -D cn=Directory Manager -w redhat123 -f
/usr/share/ipa/indices.ldif' returned non-zero exit status 49
  [9/16]: configuring ssl for ds instance
Unexpected error - see ipaserver-install.log for details:
 {'desc': 'Invalid credentials'}
Comment 25 Masato Taruishi 2008-04-16 02:43:44 EDT
It seems that the latest version of nss library rejects children to
use the security context. Therefore, ns-slapd can't use SHA  which breaks
authentication by rootdn created by setup-ds.pl even though authenticating by
pwdhash works. It's not the problem of ipa but fedora-ds.

See the following thread for more detail.
  
https://bugzilla.mozilla.org/show_bug.cgi?id=331096
Comment 26 Rich Megginson 2008-04-16 09:47:32 EDT
(In reply to comment #25)
> It seems that the latest version of nss library rejects children to
> use the security context. Therefore, ns-slapd can't use SHA  which breaks
> authentication by rootdn created by setup-ds.pl even though authenticating by
> pwdhash works. It's not the problem of ipa but fedora-ds.
> 
> See the following thread for more detail.
>   
> https://bugzilla.mozilla.org/show_bug.cgi?id=331096
> 

This has been fixed in fedora-ds-base in rawhide.
Comment 27 Masato Taruishi 2008-04-16 23:15:38 EDT
(In reply to comment #26)
> (In reply to comment #25)
> > It seems that the latest version of nss library rejects children to
> > use the security context. Therefore, ns-slapd can't use SHA  which breaks
> > authentication by rootdn created by setup-ds.pl even though authenticating by
> > pwdhash works. It's not the problem of ipa but fedora-ds.
> > 
> > See the following thread for more detail.
> >   
> > https://bugzilla.mozilla.org/show_bug.cgi?id=331096
> > 
> 
> This has been fixed in fedora-ds-base in rawhide.
> 

I could reproduce the problem as of the release fedora-ds-base-1.1.0-1.3.fc9.
Maybe you forget to apply the patch in this release. I'm goning
to check the latest upload which the patch is applied correctly today.
Comment 28 Thorsten Scherf 2008-04-25 10:34:04 EDT
same for me, usinf fedora-ds-base from todays rawhide, error is still the same.
Comment 29 Rich Megginson 2008-04-25 11:08:23 EDT
(In reply to comment #28)
> same for me, usinf fedora-ds-base from todays rawhide, error is still the same.

F-9 or rawhide?  Note that fedora-ds-base-1.1.0.1-4 was just recently approved
for F-9 and doesn't appear to be in yet.
Comment 30 Thorsten Scherf 2008-04-25 11:27:22 EDT
rawhide

using fedora-ds-base-1.1.0.1-4 from koji fixed the problem. 
Comment 31 Bug Zapper 2008-05-14 02:02:37 EDT
Changing version to '9' as part of upcoming Fedora 9 GA.
More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 32 Bug Zapper 2009-06-09 19:45:45 EDT
This message is a reminder that Fedora 9 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 9.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '9'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 9's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 9 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 33 Bug Zapper 2009-07-14 12:13:14 EDT
Fedora 9 changed to end-of-life (EOL) status on 2009-07-10. Fedora 9 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.

Note You need to log in before you can comment on or make changes to this bug.