Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
IPA install fails when openldap-servers package is already installed. Openldap-servers adds /etc/portreserve/slapd that is used by portreserver to reserve UDP port 636. So, IPA install runs, it finds port 636 being used and fails.
Version-Release number of selected component (if applicable):
389-ds-base-1.2.11.15-11.el6.x86_64
389-ds-base-libs-1.2.11.15-11.el6.x86_64
ipa-server-3.0.0-26.el6_4.2.x86_64
How reproducible:
Always
Steps to Reproduce:
1. Install openldap-servers package
2. Make sure portreserve service is running
3. Insall IPA
Actual results:
IPA install fails
Expected results:
IPA install succeeds
Additional info:
[root@dell-pe1800-01 ~]# rpm -qa | grep ipa-server
ipa-server-trust-ad-3.0.0-26.el6_4.2.x86_64
ipa-server-3.0.0-26.el6_4.2.x86_64
ipa-server-selinux-3.0.0-26.el6_4.2.x86_64
[root@dell-pe1800-01 ~]# service portreserve status
portreserve (pid 26075) is running...
[root@dell-pe1800-01 ~]# netstat -ntulp | grep portreserve
udp 0 0 0.0.0.0:750 0.0.0.0:* 26075/portreserve
udp 0 0 0.0.0.0:636 0.0.0.0:* 26075/portreserve
[root@dell-pe1800-01 ~]# cat /etc/portreserve/slapd
ldaps
[root@dell-pe1800-01 ~]# rpm -ql openldap-servers | grep port
/etc/portreserve/slapd
[root@dell-pe1800-01 ~]# ipa-server-install --setup-dns --no-forwarder -p Secret123 -a Secret123 -r RHTS.ENG.BOS.REDHAT.COM -n rhts.eng.bos.redhat.com --hostname=dell-pe1800-01.rhts.eng.bos.redhat.com --ip-address=10.16.65.248 -U
The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.
This includes:
* Configure a stand-alone CA (dogtag) for certificate management
* Configure the Network Time Daemon (ntpd)
* Create and configure an instance of Directory Server
* Create and configure a Kerberos Key Distribution Center (KDC)
* Configure Apache (httpd)
* Configure DNS (bind)
To accept the default shown in brackets, press the Enter key.
Warning: skipping DNS resolution of host dell-pe1800-01.rhts.eng.bos.redhat.com
Using reverse zone 65.16.10.in-addr.arpa.
The IPA Master Server will be configured with:
Hostname: dell-pe1800-01.rhts.eng.bos.redhat.com
IP address: 10.16.65.248
Domain name: rhts.eng.bos.redhat.com
Realm name: RHTS.ENG.BOS.REDHAT.COM
BIND DNS server will be configured to serve IPA domain with:
Forwarders: No forwarders
Reverse zone: 65.16.10.in-addr.arpa.
Configuring NTP daemon (ntpd)
[1/4]: stopping ntpd
[2/4]: writing configuration
[3/4]: configuring ntpd to start on boot
[4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server for the CA (pkids): Estimated time 30 seconds
[1/3]: creating directory server user
[2/3]: creating directory server instance
[3/3]: restarting directory server
Done configuring directory server for the CA (pkids).
Configuring certificate server (pki-cad): Estimated time 3 minutes 30 seconds
[1/21]: creating certificate server user
[2/21]: creating pki-ca instance
[3/21]: configuring certificate server instance
[4/21]: disabling nonces
[5/21]: creating CA agent PKCS#12 file in /root
[6/21]: creating RA agent certificate database
[7/21]: importing CA chain to RA certificate database
[8/21]: fixing RA database permissions
[9/21]: setting up signing cert profile
[10/21]: set up CRL publishing
[11/21]: set certificate subject base
[12/21]: enabling Subject Key Identifier
[13/21]: setting audit signing renewal to 2 years
[14/21]: configuring certificate server to start on boot
[15/21]: restarting certificate server
[16/21]: requesting RA certificate from CA
[17/21]: issuing RA agent certificate
[18/21]: adding RA agent as a trusted user
[19/21]: configure certificate renewals
[20/21]: configure Server-Cert certificate renewal
[21/21]: Configure HTTP to proxy connections
Done configuring certificate server (pki-cad).
Configuring directory server (dirsrv): Estimated time 1 minute
[1/38]: creating directory server user
[2/38]: creating directory server instance
[3/38]: adding default schema
[4/38]: enabling memberof plugin
[5/38]: enabling winsync plugin
[6/38]: configuring replication version plugin
[7/38]: enabling IPA enrollment plugin
[8/38]: enabling ldapi
[9/38]: disabling betxn plugins
[10/38]: configuring uniqueness plugin
[11/38]: configuring uuid plugin
[12/38]: configuring modrdn plugin
[13/38]: enabling entryUSN plugin
[14/38]: configuring lockout plugin
[15/38]: creating indices
[16/38]: enabling referential integrity plugin
[17/38]: configuring ssl for ds instance
[18/38]: configuring certmap.conf
[19/38]: configure autobind for root
[20/38]: configure new location for managed entries
[21/38]: restarting directory server
ipa : CRITICAL Failed to restart the directory server (Command '/sbin/service dirsrv restart RHTS-ENG-BOS-REDHAT-COM' returned non-zero exit status 1). See the installation log for details.
[22/38]: adding default layout
ipa : CRITICAL Failed to load bootstrap-template.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpktz2jw -H ldap://dell-pe1800-01.rhts.eng.bos.redhat.com:389 -x -D cn=Directory Manager -y /tmp/tmpWHQb9O' returned non-zero exit status 255
[23/38]: adding delegation layout
ipa : CRITICAL Failed to load delegation.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpPLUexn -H ldap://dell-pe1800-01.rhts.eng.bos.redhat.com:389 -x -D cn=Directory Manager -y /tmp/tmpq6SmU9' returned non-zero exit status 255
[24/38]: adding replication acis
ipa : CRITICAL Failed to load replica-acis.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpdICBzT -H ldap://dell-pe1800-01.rhts.eng.bos.redhat.com:389 -x -D cn=Directory Manager -y /tmp/tmpLkoeFd' returned non-zero exit status 255
[25/38]: creating container for managed entries
ipa : CRITICAL Failed to load managed-entries.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpPzllJC -H ldap://dell-pe1800-01.rhts.eng.bos.redhat.com:389 -x -D cn=Directory Manager -y /tmp/tmpPRRZlP' returned non-zero exit status 255
[26/38]: configuring user private groups
ipa : CRITICAL Failed to load user_private_groups.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmp6wzMHO -H ldap://dell-pe1800-01.rhts.eng.bos.redhat.com:389 -x -D cn=Directory Manager -y /tmp/tmpvN7OQd' returned non-zero exit status 255
[27/38]: configuring netgroups from hostgroups
ipa : CRITICAL Failed to load host_nis_groups.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmp3iQ6I2 -H ldap://dell-pe1800-01.rhts.eng.bos.redhat.com:389 -x -D cn=Directory Manager -y /tmp/tmpR8r5G1' returned non-zero exit status 255
[28/38]: creating default Sudo bind user
ipa : CRITICAL Failed to load sudobind.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmp586S5M -H ldap://dell-pe1800-01.rhts.eng.bos.redhat.com:389 -x -D cn=Directory Manager -y /tmp/tmpSBORkm' returned non-zero exit status 255
[29/38]: creating default Auto Member layout
ipa : CRITICAL Failed to load automember.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpjcpYqs -H ldap://dell-pe1800-01.rhts.eng.bos.redhat.com:389 -x -D cn=Directory Manager -y /tmp/tmp20vZuL' returned non-zero exit status 255
[30/38]: adding range check plugin
ipa : CRITICAL Failed to load range-check-conf.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpXLLKrD -H ldap://dell-pe1800-01.rhts.eng.bos.redhat.com:389 -x -D cn=Directory Manager -y /tmp/tmpALEEJB' returned non-zero exit status 255
[31/38]: creating default HBAC rule allow_all
ipa : CRITICAL Failed to load default-hbac.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmp8RE0sA -H ldap://dell-pe1800-01.rhts.eng.bos.redhat.com:389 -x -D cn=Directory Manager -y /tmp/tmpYAxfwu' returned non-zero exit status 255
[32/38]: Upload CA cert to the directory
ipa : CRITICAL Failed to load upload-cacert.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpJnpT5h -H ldap://dell-pe1800-01.rhts.eng.bos.redhat.com:389 -x -D cn=Directory Manager -y /tmp/tmpmU8Vd6' returned non-zero exit status 255
[33/38]: initializing group membership
ipa : CRITICAL Failed to load memberof-task.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpthHvOu -H ldap://dell-pe1800-01.rhts.eng.bos.redhat.com:389 -x -D cn=Directory Manager -y /tmp/tmpX8U4pi' returned non-zero exit status 255
Can't contact LDAP server
[root@dell-pe1800-01 log]# grep 636 ipaserver-install.log
2013-03-06T13:08:33Z DEBUG stderr=[06/Mar/2013:08:08:33 -0500] createprlistensockets - PR_Bind() on All Interfaces port 636 failed: Netscape Portable Runtime error -5982 (Local Network address is in use.)
I did some investigation of how portreserve is supposed to be used. The short summary is that current Fedora distributions don't use it since systemd handles port conflict resolution. I checked the OpenLDAP source RPM on F18, and it doesn't use portreserve. I also checked the RHEL7 OpenLDAP source, and portreserve is not used there either (since systemd is used). This means we don't have to fix anything here.
Platforms that use SysV init scripts (such as RHEL6) need to use portreserve in order to prevent well-known ports in the 600-1023 range from being randomly grabbed by RPC services. We don't plan to fix this in 389-ds-base 1.2.11 though.
For more background on portreserve, please see the following bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=103401https://bugzilla.redhat.com/show_bug.cgi?id=790687
Closing this as NOTABUG since it doesn't affect RHEL7.x.