Bug 830598 - ipa-server-install --uninstall not stopping sssd and seeing ipa-replica-conncheck kinit errors
ipa-server-install --uninstall not stopping sssd and seeing ipa-replica-connc...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa (Show other bugs)
6.3
Unspecified Unspecified
medium Severity unspecified
: rc
: ---
Assigned To: Rob Crittenden
Namita Soman
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-06-10 16:19 EDT by Scott Poore
Modified: 2013-02-21 04:15 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-02-21 04:15:18 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Scott Poore 2012-06-10 16:19:54 EDT
Description of problem:

occasionally sssd is left running after an ipa-server-install --uninstall.  On an attempted re-install using ipa-replica-install, I am seeing ipa-replica-conncheck errors.

Version-Release number of selected component (if applicable):
ipa-server-2.2.0-16.el6.x86_64

How reproducible:
Very but not always.  I'm seeing this in automated testing.

Steps to Reproduce:
1. <Install IPA on RHEL 6.3 Master>
2. <Create Replica package file>
3. <Install IPA on RHEL 6.3 Replica>
4. ipa-replica-manage del $REPLICA # on master
5. ipa-server-install --uninstall -U # on replica
6. ipa-replica-install -U --setup-dns --no-forwarders -w $ADMINPW -p $ADMINPW /path/to/replica-info-$REPLICA.gpg
  
Actual results:

Error seen at end of ipa-replica-conneck from ipa-replica-install:

# tail ipareplica-conncheck.log
    ticket_lifetime = 36000
    renew_lifetime = 36000
    forwardable = true
    krb4_convert = false
  }

2012-06-10T18:16:32Z DEBUG args=/usr/bin/kinit admin@TESTRELM.COM
2012-06-10T18:16:32Z DEBUG stdout=
2012-06-10T18:16:32Z DEBUG stderr=kinit: Invalid message type while getting initial credentials

Then checking to see what's running:
[root@qe-blade-06 log]# ps -ef|grep sssd
root     12741 12699  0 14:13 pts/0    00:00:00 grep sssd
root     17255     1  0 Jun09 ?        00:00:02 /usr/sbin/sssd -f -D
root     17279 17255  0 Jun09 ?        00:00:03 /usr/libexec/sssd/sssd_be --domain testrelm.com --debug-to-files
root     17288 17255  0 Jun09 ?        00:00:00 /usr/libexec/sssd/sssd_nss --debug-to-files
root     17289 17255  0 Jun09 ?        00:00:00 /usr/libexec/sssd/sssd_pam --debug-to-files
root     17290 17255  0 Jun09 ?        00:00:00 /usr/libexec/sssd/sssd_ssh --debug-to-files


Expected results:

ipa uninstall cleanly stops sssd.

Additional info:

If I stop sssd, ipa-replica-conncheck works though:

# service sssd stop
Stopping sssd: [  OK  ]

# /usr/sbin/ipa-replica-conncheck --master qe-blade-09.testrelm.com --auto-master-check --realm TESTRELM.COM --principal admin --hostname qe-blade-06.testrelm.com --password Secret123
Check connection from replica to remote master 'qe-blade-09.testrelm.com':
   Directory Service: Unsecure port (389): OK
   Directory Service: Secure port (636): OK
   Kerberos KDC: TCP (88): OK
   Kerberos Kpasswd: TCP (464): OK
   HTTP Server: Unsecure port (80): OK
   HTTP Server: Secure port (443): OK

The following list of ports use UDP protocol and would need to be
checked manually:
   Kerberos KDC: UDP (88): SKIPPED
   Kerberos Kpasswd: UDP (464): SKIPPED

Connection from replica to master is OK.
Start listening on required ports for remote master check
Get credentials to log in to remote master
Execute check on remote master
Check connection from master to remote replica 'qe-blade-06.testrelm.com':
   Directory Service: Unsecure port (389): OK
   Directory Service: Secure port (636): OK
   Kerberos KDC: TCP (88): OK
   Kerberos KDC: UDP (88): OK
   Kerberos Kpasswd: TCP (464): OK
   Kerberos Kpasswd: UDP (464): OK
   HTTP Server: Unsecure port (80): OK
   HTTP Server: Secure port (443): OK

Connection from master to replica is OK.

# ps -ef|grep sssd
root     12844 12699  0 15:58 pts/0    00:00:00 grep sssd
Comment 2 Rob Crittenden 2012-06-11 09:36:35 EDT
This may be related to BZs https://bugzilla.redhat.com/show_bug.cgi?id=827162 and https://bugzilla.redhat.com/show_bug.cgi?id=819982
Comment 3 Rob Crittenden 2012-06-12 10:13:40 EDT
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/2831
Comment 4 Jenny Galipeau 2012-09-25 12:05:28 EDT
regression test added to ipa-replica-install test suite
Comment 5 Scott Poore 2012-09-27 09:43:14 EDT
Verified:

Version ::

sssd-1.9.1-0.20120926T2039Zgit1ea72a4.el6.x86_64
ipa-server-3.0.0-2.el6.x86_64

Manual Test Results ::

[root@vm2 ~]# ipa-server-install --uninstall -U
Shutting down all IPA services
Removing IPA client configuration
Unconfiguring ntpd
Unconfiguring named
Unconfiguring web server
Unconfiguring krb5kdc
Unconfiguring kadmin
Unconfiguring directory server
Unconfiguring ipa_memcached
[root@vm2 ~]# ps -ef|grep sssd
root      3672  1308  0 08:39 pts/0    00:00:00 grep sssd
[root@vm2 ~]# 

I ran this test 20+ times with the same results every time.  It appears that the issue has been resolved.
Comment 8 errata-xmlrpc 2013-02-21 04:15:18 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0528.html

Note You need to log in before you can comment on or make changes to this bug.