815226 – IPA server configuration fails with permission errors while accessing the file /var/log/dirsrv/slapd-PKI-IPA/errors

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 815226 - IPA server configuration fails with permission errors while accessing the file /var/log/dirsrv/slapd-PKI-IPA/errors

Summary: IPA server configuration fails with permission errors while accessing the fil...

Keywords:
Status:	CLOSED NOTABUG
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	ipa
Sub Component:
Version:	6.3
Hardware:	Unspecified
OS:	Linux
Priority:	unspecified
Severity:	high
Target Milestone:	rc
Target Release:	---
Assignee:	Rob Crittenden
QA Contact:	IDM QE LIST
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2012-04-23 07:34 UTC by Kashyap Chamarthy
Modified:	2012-04-23 09:26 UTC (History)
CC List:	1 user (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2012-04-23 09:26:08 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Description Kashyap Chamarthy 2012-04-23 07:34:48 UTC

Upstream ticket: https://fedorahosted.org/freeipa/ticket/2662

Description of problem:
IPA server configuration fails with permission errors while accessing the file /var/log/dirsrv/slapd-PKI-IPA/errors

================================================================
ipa-server-install --setup-dns --forwarder=w.x.y.z -r FOO.BAR.REDHAT.COM -p testpwd -P testpwd -a testpwd -U
.
.
.
Configuring ntpd
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
  [4/4]: starting ntpd
done configuring ntpd.
Configuring directory server for the CA: Estimated time 30 minutes 30 seconds
  [1/3]: creating directory server user
  [2/3]: creating directory server instance
  [3/3]: restarting directory server
ipa         : CRITICAL Failed to restart the directory server. See the installation log for details.
[root@neptune ~]#
================================================================
=> /var/log/dirsrv/slapd-PKI-IPA/errors <==
[05/Apr/2012:08:37:50 +051800] - 389-Directory/1.2.10.2 B2012.081.1716 starting up
[05/Apr/2012:08:37:50 +051800] attrcrypt - No symmetric key found for cipher AES in backend userRoot, attempting to create one...
[05/Apr/2012:08:37:50 +051800] attrcrypt - Key for cipher AES successfully generated and stored
[05/Apr/2012:08:37:51 +051800] attrcrypt - No symmetric key found for cipher 3DES in backend userRoot, attempting to create one...
[05/Apr/2012:08:37:51 +051800] attrcrypt - Key for cipher 3DES successfully generated and stored
[05/Apr/2012:08:37:51 +051800] attrcrypt - No symmetric key found for cipher AES in backend ipaca, attempting to create one...
[05/Apr/2012:08:37:51 +051800] attrcrypt - Key for cipher AES successfully generated and stored
[05/Apr/2012:08:37:51 +051800] attrcrypt - No symmetric key found for cipher 3DES in backend ipaca, attempting to create one...
[05/Apr/2012:08:37:51 +051800] attrcrypt - Key for cipher 3DES successfully generated and stored
[05/Apr/2012:08:37:51 +051800] - slapd started.  Listening on All Interfaces port 7389 for LDAP requests
[05/Apr/2012:08:37:51 +051800] - Listening on All Interfaces port 7390 for LDAPS requests
[05/Apr/2012:08:40:20 +051800] - LOGINFO: Unable to open access file:/var/log/dirsrv/slapd-PKI-IPA/access
(END) 
================================================================
[root@neptune ~]# tail /var/log/messages
Apr 23 06:24:27 neptune ns-slapd: Failed to reopen errors log file, Netscape Portable Runtime error -5966 (Access Denied.)
Apr 23 06:24:27 neptune ns-slapd: Failed to open errors log file /var/log/dirsrv/slapd-PKI-IPA/errors: error 13 (Permission denied); Exiting...
Apr 23 06:24:27 neptune ns-slapd: Failed to reopen errors log file, Netscape Portable Runtime error -5966 (Access Denied.)
Apr 23 06:24:27 neptune ns-slapd: Failed to open errors log file /var/log/dirsrv/slapd-PKI-IPA/errors: error 13 (Permission denied); Exiting...
Apr 23 06:24:27 neptune ns-slapd: Failed to reopen errors log file, Netscape Portable Runtime error -5966 (Access Denied.)
Apr 23 06:24:28 neptune ns-slapd: Failed to open errors log file /var/log/dirsrv/slapd-PKI-IPA/errors: error 13 (Permission denied); Exiting...
Apr 23 06:24:28 neptune ns-slapd: Failed to reopen errors log file, Netscape Portable Runtime error -5966 (Access Denied.)
Apr 23 06:24:28 neptune ns-slapd: Failed to open errors log file /var/log/dirsrv/slapd-PKI-IPA/errors: error 13 (Permission denied); Exiting...
Apr 23 06:24:28 neptune ns-slapd: Failed to reopen errors log file, Netscape Portable Runtime error -5966 (Access Denied.)
Apr 23 06:27:32 neptune ntpd[4790]: synchronized to LOCAL(0), stratum 10
[root@neptune ~]# 
================================================================
[root@neptune ~]# ls -lZ /var/log/dirsrv/slapd-PKI-IPA/
-rw-------. pkisrv dirsrv system_u:object_r:dirsrv_var_log_t:s0 access
-rw-------. pkisrv dirsrv system_u:object_r:dirsrv_var_log_t:s0 access.20120325-100847
-rw-------. pkisrv dirsrv system_u:object_r:dirsrv_var_log_t:s0 access.20120326-101101
-rw-------. pkisrv dirsrv system_u:object_r:dirsrv_var_log_t:s0 access.20120327-101346
-rw-------. pkisrv dirsrv system_u:object_r:dirsrv_var_log_t:s0 access.20120328-101832
-rw-------. pkisrv dirsrv system_u:object_r:dirsrv_var_log_t:s0 access.20120329-101847
-rw-------. pkisrv dirsrv system_u:object_r:dirsrv_var_log_t:s0 access.20120330-102101
-rw-------. pkisrv dirsrv system_u:object_r:dirsrv_var_log_t:s0 access.20120331-102115
-rw-------. pkisrv dirsrv system_u:object_r:dirsrv_var_log_t:s0 access.20120401-102328
-rw-------. pkisrv dirsrv system_u:object_r:dirsrv_var_log_t:s0 access.20120402-102342
-rw-------. pkisrv dirsrv unconfined_u:object_r:dirsrv_var_log_t:s0 access.rotationinfo
-rw-------. pkisrv dirsrv unconfined_u:object_r:dirsrv_var_log_t:s0 audit
-rw-------. pkisrv dirsrv unconfined_u:object_r:dirsrv_var_log_t:s0 audit.rotationinfo
-rw-------. pkisrv dirsrv system_u:object_r:dirsrv_var_log_t:s0 errors
-rw-------. pkisrv dirsrv unconfined_u:object_r:dirsrv_var_log_t:s0 errors.20111212-113946
-rw-------. pkisrv dirsrv unconfined_u:object_r:dirsrv_var_log_t:s0 errors.rotationinfo
================================================================
[root@neptune ~]# getenforce 
Enforcing
[root@neptune ~]# 
================================================================

Version-Release number of selected component (if applicable):

# rpm -q ipa-server
ipa-server-2.2.0-10.el6.x86_64



Steps to Reproduce:
1. Update to latest RHEL 6.3 and 

2. # ipa-server-install --setup-dns --forwarder=w.x.y.z -r FOO.BAR.REDHAT.COM -p testpwd -P testpwd -a testpwd -U


  


Additional info:

Note from ab: nslapd is launched with different uid/gid/selinux context than what's configured on the files

Comment 2 Martin Kosek 2012-04-23 08:40:55 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/2662

Comment 3 Kashyap Chamarthy 2012-04-23 09:26:08 UTC

I had a bad ownership of /var/log/dirsrv/slapd-PKI-IPA directory. This was a previously fixed bug ( https://fedorahosted.org/freeipa/ticket/2423) 

[root@neptune ~]# ll /var/log/dirsrv/
total 8
drwxrwx---. 2 pkiuser   memcached 4096 Apr  4 08:40 slapd-LAB-ENG-PNQ-REDHAT-COM
drwxrwx---. 2 memcached memcached 4096 Apr 23 08:14 slapd-PKI-IPA


With correct permissions, the server configuration proceeds fine. 

[root@neptune ~]# ll /var/log/dirsrv/
total 8
drwxrwx---. 2 dirsrv dirsrv 4096 Apr 23 08:36 slapd-LAB-ENG-PNQ-REDHAT-COM
drwxrwx---. 2 pkisrv dirsrv 4096 Apr 23 08:35 slapd-PKI-IPA
[root@neptune ~]# 


[root@neptune ~]# ipactl status
Directory Service: RUNNING
KDC Service: RUNNING
KPASSWD Service: RUNNING
DNS Service: RUNNING
MEMCACHE Service: RUNNING
HTTP Service: RUNNING
CA Service: RUNNING
[root@neptune ~]# 

Closing this as NOTABUG

Note You need to log in before you can comment on or make changes to this bug.