Hide Forgot
Description of problem: ipa-client-install fails on a pristine system, it tries to wget the ca.crt from the ipa server to /etc/ipa and the directory is not created before the wget operation which causes the failure. Version-Release number of selected component (if applicable): ipa-server-2.1.3-8.el6.x86_64 ipa-client-2.1.3-8.el6.x86_64 How reproducible: Steps to Reproduce: 1. Server: install ipa-server 2. Client: On a pristine system "ipa-client-install" Actual results: ipa-client-install fails. Expected results: ipa-client-install is successful. Additional info: Provide the domain name of your IPA server (ex: example.com): rhts.eng.bos.redhat.com root : DEBUG will use domain: rhts.eng.bos.redhat.com root : DEBUG [ipadnssearchldap] root : DEBUG IPA Server not found DNS discovery failed to find the IPA Server Provide your IPA server name (ex: ipa.example.com): hp-dl580g5-01.rhts.eng.bos.redhat.com root : DEBUG will use server: hp-dl580g5-01.rhts.eng.bos.redhat.com root : DEBUG [ipadnssearchkrb] root : DEBUG [ipacheckldap] root : DEBUG args=/usr/bin/wget -O /tmp/tmpFr1aWH/ca.crt -T 15 -t 2 http://hp-dl580g5-01.rhts.eng.bos.redhat.com/ipa/config/ca.crt root : DEBUG stdout= root : DEBUG stderr=--2011-11-07 03:17:20-- http://hp-dl580g5-01.rhts.eng.bos.redhat.com/ipa/config/ca.crt Resolving hp-dl580g5-01.rhts.eng.bos.redhat.com... 10.16.65.72 Connecting to hp-dl580g5-01.rhts.eng.bos.redhat.com|10.16.65.72|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 1369 (1.3K) [application/x-x509-ca-cert] Saving to: ￢ﾀﾜ/tmp/tmpFr1aWH/ca.crt￢ﾀﾝ 0K . 100% 75.9M=0s 2011-11-07 03:17:20 (75.9 MB/s) - ￢ﾀﾜ/tmp/tmpFr1aWH/ca.crt￢ﾀﾝ saved [1369/1369] root : DEBUG Init ldap with: ldap://hp-dl580g5-01.rhts.eng.bos.redhat.com:389 root : DEBUG Search LDAP server for IPA base DN root : DEBUG Check if naming context 'dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com' is for IPA root : DEBUG Naming context 'dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com' is a valid IPA context root : DEBUG Search for (objectClass=krbRealmContainer) in dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com(sub) root : DEBUG Found: [('cn=RHTS.ENG.BOS.REDHAT.COM,cn=kerberos,dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com', {'krbSubTrees': ['dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com'], 'cn': ['RHTS.ENG.BOS.REDHAT.COM'], 'krbDefaultEncSaltTypes': ['aes256-cts:special', 'aes128-cts:special', 'des3-hmac-sha1:special', 'arcfour-hmac:special'], 'objectClass': ['top', 'krbrealmcontainer', 'krbticketpolicyaux'], 'krbSearchScope': ['2'], 'krbSupportedEncSaltTypes': ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'des3-hmac-sha1:normal', 'des3-hmac-sha1:special', 'arcfour-hmac:normal', 'arcfour-hmac:special', 'des-hmac-sha1:normal', 'des-cbc-md5:normal', 'des-cbc-crc:normal', 'des-cbc-crc:v4', 'des-cbc-crc:afs3'], 'krbMaxTicketLife': ['86400'], 'krbMaxRenewableAge': ['604800']})] The failure to use DNS to find your IPA server indicates that your resolv.conf file is not properly configured. Autodiscovery of servers for failover cannot work with this configuration. If you proceed with the installation, services will be configured to always access the discovered server for all operation and will not fail over to other servers in case of failure. Proceed with fixed values and no DNS discovery? [no]: yes root : DEBUG will use cli_realm: RHTS.ENG.BOS.REDHAT.COM root : DEBUG will use cli_basedn: dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com Hostname: ipaqa64vmc.idm.lab.bos.redhat.com Realm: RHTS.ENG.BOS.REDHAT.COM DNS Domain: rhts.eng.bos.redhat.com IPA Server: hp-dl580g5-01.rhts.eng.bos.redhat.com BaseDN: dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com Continue to configure the system with these values? [no]: yes User authorized to enroll computers: admin root : DEBUG will use principal: admin root : DEBUG args=/usr/bin/wget -O /etc/ipa/ca.crt http://hp-dl580g5-01.rhts.eng.bos.redhat.com/ipa/config/ca.crt root : DEBUG stdout= root : DEBUG stderr=/etc/ipa/ca.crt: No such file or directory Retrieving CA from hp-dl580g5-01.rhts.eng.bos.redhat.com failed. Command '/usr/bin/wget -O /etc/ipa/ca.crt http://hp-dl580g5-01.rhts.eng.bos.redhat.com/ipa/config/ca.crt' returned non-zero exit status 1 Installation failed. Rolling back changes. IPA client is not configured on this system. [root@ipaqa64vmc ~]# Provide the domain name of your IPA server (ex: example.com): rhts.eng.bos.redhat.com root : DEBUG will use domain: rhts.eng.bos.redhat.com root : DEBUG [ipadnssearchldap] root : DEBUG IPA Server not found DNS discovery failed to find the IPA Server Provide your IPA server name (ex: ipa.example.com): hp-dl580g5-01.rhts.eng.bos.redhat.com root : DEBUG will use server: hp-dl580g5-01.rhts.eng.bos.redhat.com root : DEBUG [ipadnssearchkrb] root : DEBUG [ipacheckldap] root : DEBUG args=/usr/bin/wget -O /tmp/tmpFr1aWH/ca.crt -T 15 -t 2 http://hp-dl580g5-01.rhts.eng.bos.redhat.com/ipa/config/ca.crt root : DEBUG stdout= root : DEBUG stderr=--2011-11-07 03:17:20-- http://hp-dl580g5-01.rhts.eng.bos.redhat.com/ipa/config/ca.crt Resolving hp-dl580g5-01.rhts.eng.bos.redhat.com... 10.16.65.72 Connecting to hp-dl580g5-01.rhts.eng.bos.redhat.com|10.16.65.72|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 1369 (1.3K) [application/x-x509-ca-cert] Saving to: ￢ﾀﾜ/tmp/tmpFr1aWH/ca.crt￢ﾀﾝ 0K . 100% 75.9M=0s 2011-11-07 03:17:20 (75.9 MB/s) - ￢ﾀﾜ/tmp/tmpFr1aWH/ca.crt￢ﾀﾝ saved [1369/1369] root : DEBUG Init ldap with: ldap://hp-dl580g5-01.rhts.eng.bos.redhat.com:389 root : DEBUG Search LDAP server for IPA base DN root : DEBUG Check if naming context 'dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com' is for IPA root : DEBUG Naming context 'dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com' is a valid IPA context root : DEBUG Search for (objectClass=krbRealmContainer) in dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com(sub) root : DEBUG Found: [('cn=RHTS.ENG.BOS.REDHAT.COM,cn=kerberos,dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com', {'krbSubTrees': ['dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com'], 'cn': ['RHTS.ENG.BOS.REDHAT.COM'], 'krbDefaultEncSaltTypes': ['aes256-cts:special', 'aes128-cts:special', 'des3-hmac-sha1:special', 'arcfour-hmac:special'], 'objectClass': ['top', 'krbrealmcontainer', 'krbticketpolicyaux'], 'krbSearchScope': ['2'], 'krbSupportedEncSaltTypes': ['aes256-cts:normal', 'aes256-cts:special', 'aes128-cts:normal', 'aes128-cts:special', 'des3-hmac-sha1:normal', 'des3-hmac-sha1:special', 'arcfour-hmac:normal', 'arcfour-hmac:special', 'des-hmac-sha1:normal', 'des-cbc-md5:normal', 'des-cbc-crc:normal', 'des-cbc-crc:v4', 'des-cbc-crc:afs3'], 'krbMaxTicketLife': ['86400'], 'krbMaxRenewableAge': ['604800']})] The failure to use DNS to find your IPA server indicates that your resolv.conf file is not properly configured. Autodiscovery of servers for failover cannot work with this configuration. If you proceed with the installation, services will be configured to always access the discovered server for all operation and will not fail over to other servers in case of failure. Proceed with fixed values and no DNS discovery? [no]: yes root : DEBUG will use cli_realm: RHTS.ENG.BOS.REDHAT.COM root : DEBUG will use cli_basedn: dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com Hostname: ipaqa64vmc.idm.lab.bos.redhat.com Realm: RHTS.ENG.BOS.REDHAT.COM DNS Domain: rhts.eng.bos.redhat.com IPA Server: hp-dl580g5-01.rhts.eng.bos.redhat.com BaseDN: dc=rhts,dc=eng,dc=bos,dc=redhat,dc=com Continue to configure the system with these values? [no]: yes User authorized to enroll computers: admin root : DEBUG will use principal: admin root : DEBUG args=/usr/bin/wget -O /etc/ipa/ca.crt http://hp-dl580g5-01.rhts.eng.bos.redhat.com/ipa/config/ca.crt root : DEBUG stdout= root : DEBUG stderr=/etc/ipa/ca.crt: No such file or directory Retrieving CA from hp-dl580g5-01.rhts.eng.bos.redhat.com failed. Command '/usr/bin/wget -O /etc/ipa/ca.crt http://hp-dl580g5-01.rhts.eng.bos.redhat.com/ipa/config/ca.crt' returned non-zero exit status 1 Installation failed. Rolling back changes. IPA client is not configured on this system. [root@ipaqa64vmc ~]#
Shanks, can you please attach the output of how you installed ipa server package? It is highly relevant. This issue does not occur for standard installation and /etc/ipa is created # ls /etc/ipa/ ls: cannot access /etc/pipa/: No such file or directory # yum install ipa-client Loaded plugins: product-id, subscription-manager Updating certificate-based repositories. Setting up Install Process Resolving Dependencies --> Running transaction check ---> Package ipa-client.x86_64 0:2.1.3-8.el6 will be installed --> Processing Dependency: ipa-python = 2.1.3-8.el6 for package: ipa-client-2.1.3-8.el6.x86_64 --> Running transaction check ---> Package ipa-python.x86_64 0:2.1.3-8.el6 will be installed --> Finished Dependency Resolution Dependencies Resolved ======================================================================================================= Package Arch Version Repository Size ======================================================================================================= Installing: ipa-client x86_64 2.1.3-8.el6 RHEL6-nightly-x86_64 97 k Installing for dependencies: ipa-python x86_64 2.1.3-8.el6 RHEL6-nightly-x86_64 630 k Transaction Summary ======================================================================================================= Install 2 Package(s) Total download size: 727 k Installed size: 3.3 M Is this ok [y/N]: y Downloading Packages: (1/2): ipa-client-2.1.3-8.el6.x86_64.rpm | 97 kB 00:00 (2/2): ipa-python-2.1.3-8.el6.x86_64.rpm | 630 kB 00:00 ------------------------------------------------------------------------------------------------------- Total 8.8 MB/s | 727 kB 00:00 Running rpm_check_debug Running Transaction Test Transaction Test Succeeded Running Transaction Installing : ipa-python-2.1.3-8.el6.x86_64 1/2 Installing : ipa-client-2.1.3-8.el6.x86_64 2/2 Installed products updated. Installed: ipa-client.x86_64 0:2.1.3-8.el6 Dependency Installed: ipa-python.x86_64 0:2.1.3-8.el6 Complete! # ls /etc/ipa/; echo $? 0
Shanks, please attach the steps you taken and the output of how you installed/updated ipa server package. IIRC, there were some errors during yum update. I think we should try this again when relevant yum Bug 746190 is resolved. It may have caused this problem.
Martin, can you explain why you think this is related to the referenced yum bug? I can't see the connection :-) thanks!
Ok, I tried to reproduce this on multiple setups and I couldn't reproduce this and neither Bug 751711. We may go ahead and mark it as NOTABUG.
Closing as NOTABUG.