Red Hat Bugzilla – Bug 980148
RHEL7 ipa-replica-prepare gpg error
Last modified: 2014-06-17 20:10:11 EDT
Description of problem: Running ipa-replica-prepare to setup a gpg package file for IPA fails with a gpg error: [root@rhel7-1 quickinstall]# ipa-replica-prepare -p PASSWORD --ip-address=192.168.122.72 rhel7-2.testrelm.com Preparing replica for rhel7-2.testrelm.com from rhel7-1.testrelm.com Creating SSL certificate for the Directory Server Creating SSL certificate for the dogtag Directory Server Saving dogtag Directory Server port Creating SSL certificate for the Web Server Exporting RA certificate Copying additional files Finalizing configuration Packaging replica information into /var/lib/ipa/replica-info-rhel7-2.testrelm.com.gpg Command '/usr/bin/gpg --batch --homedir /tmp/tmpjpuyvfipa/ipa-YIoufT/.gnupg --passphrase-fd 0 --yes --no-tty -o /var/lib/ipa/replica-info-rhel7-2.testrelm.com.gpg -c /var/lib/ipa/replica-info-rhel7-2.testrelm.com' returned non-zero exit status 2 Version-Release number of selected component (if applicable): [root@rhel7-1 ~]# rpm -q ipa-server gnupg2 ipa-server-3.2.1-1.el7.x86_64 gnupg2-2.0.20-1.el7.x86_64 How reproducible: always Steps to Reproduce: 1. Setup RHEL7 IPA master server (with --setup-dns in my tests) 2. ipa-replica-prepare -p <password> --ip-address=<ip_of_replica> <hostname_of_replica> Actual results: Fails with GPG error listed above. Expected results: Finishes and adds DNS entries to IPA Additional info: I re-ran with --debug and in the output I see more info: ipa: DEBUG: args=/usr/bin/gpg --batch --homedir /tmp/tmp44UQJjipa/ipa-_y0LHZ/.gnupg --passphrase-fd 0 --y es --no-tty -o /var/lib/ipa/replica-info-rhel7-2.testrelm.com.gpg -c /var/lib/ipa/replica-info-rhel7-2.te strelm.com ipa: DEBUG: Process finished, return code=2 ipa: DEBUG: stdout= ipa: DEBUG: stderr=gpg: WARNING: unsafe permissions on homedir `/tmp/tmp44UQJjipa/ipa-_y0LHZ/.gnupg' gpg: keyring `/tmp/tmp44UQJjipa/ipa-_y0LHZ/.gnupg/pubring.gpg' created gpg: can't connect to the agent: IPC connect call failed gpg: problem with the agent: No agent running
FYI, I did not see this in F19 and the gnupg2 versions do differ: [root@f19-1 ~]# rpm -q freeipa-server gnupg2 freeipa-server-3.2.1-1.fc19.x86_64 gnupg2-2.0.19-8.fc19.x86_64 2.0.19-8 in F19 vs 2.0.20-1 in RHEL7.
Scott figured out that in F-19 /usr/bin/gpg is provided by the v1 package, gnupg-1.4.13-3. With gnupg2 the encryption is succeeding but because no agent was found you get a 5 second delay and a return code of 2, which ipa-replica-prepare takes as an error. We need a way to be able to encrypt a file without requiring an agent. We want to pass in the password via stdin. Tomas, is that possible?
Upstream ticket: https://fedorahosted.org/freeipa/ticket/3767
So actually this works for me when I put the passphrase into the pass file: exec 3< pass ; gpg2 -c -o foo.gpg --cipher-algo AES --passphrase-fd=3 --batch foo gpg2 will automatically start the gpg-agent in background when it is not running. So there must be something else in play.
(In reply to Tomas Mraz from comment #5) > So actually this works for me when I put the passphrase into the pass file: > > exec 3< pass ; gpg2 -c -o foo.gpg --cipher-algo AES --passphrase-fd=3 > --batch foo > > gpg2 will automatically start the gpg-agent in background when it is not > running. > > So there must be something else in play. The problem occurs when the --homedir option is used: # echo secret > foo # echo pass | gpg2 -c -o foo.gpg --passphrase-fd=0 --batch foo # echo $? 0 # rm -f foo.gpg # mkdir /tmp/abc123 # echo pass | gpg2 -c -o foo.gpg --passphrase-fd=0 --homedir=/tmp/abc123 --batch foo gpg: WARNING: unsafe permissions on homedir `/tmp/abc123' gpg: can't connect to the agent: IPC connect call failed gpg: problem with the agent: No agent running # echo $? 2
Either you can run the agent before the gpg2 or you can fix the homedir permissions so the agent can be spawned by gpg2.
And what permissions might those be? I tried 0700 and it still fails in the same way. We don't want an agent. I should note that this does result in a correctly encrypted file, we just have a several second delay and a non-zero error code. We also end up with a running agent a the end of this. Though re-running the command again still fails because it can't contact the agent.
Unfortunately it is not possible to run gpg2 without agent if it requires any kind of passphrase. Maybe the permissions on parent directory (/tmp) is the problem.
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/b5d008ed5a2ec074bf28ca5835785ee3160d6a9d ipa-3-2: https://fedorahosted.org/freeipa/changeset/aac1c2da1629634469034bbcb58ed52aa46a556c
Verified. Version :: ipa-server-3.3.1-2.el7.x86_64 Automated Test Results: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: BZ980148 - ipa-replica-prepare gpg error :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Running 'ipa-replica-prepare -p Secret123 --ip-address=192.168.144.1 bz980148.testrelm.com > /tmp/tmpout.replicaBugCheck_bz980148 2>&1' (Expected 0, got 0) Preparing replica for bz980148.testrelm.com from rhel7-1.testrelm.com Creating SSL certificate for the Directory Server Creating SSL certificate for the dogtag Directory Server Saving dogtag Directory Server port Creating SSL certificate for the Web Server Exporting RA certificate Copying additional files Finalizing configuration Packaging replica information into /var/lib/ipa/replica-info-bz980148.testrelm.com.gpg Adding DNS records for bz980148.testrelm.com Using reverse zone 144.168.192.in-addr.arpa. The ipa-replica-prepare command was successful :: [ PASS ] :: Running 'cat /tmp/tmpout.replicaBugCheck_bz980148' (Expected 0, got 0) :: [ PASS ] :: File '/tmp/tmpout.replicaBugCheck_bz980148' should not contain 'returned non-zero exit status 2' :: [ PASS ] :: File '/tmp/tmpout.replicaBugCheck_bz980148' should not contain 'Command.*/usr/bin/gpg.*batch' :: [ PASS ] :: BZ980148 not found :: [ 10:23:10 ] :: Now cleaning up test data -------------------------------------------- Deleted DNS zone "144.168.192.in-addr.arpa." -------------------------------------------- :: [ PASS ] :: Running 'ipa dnszone-del 144.168.192.in-addr.arpa.' (Expected 0, got 0) ------------------------- Deleted record "bz980148" ------------------------- :: [ PASS ] :: Running 'ipa dnsrecord-del testrelm.com bz980148 --del-all' (Expected 0, got 0)
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request.