freeipa team mailing list archive

[gianluca <amato@xxxxxxxxxxxx>]

A new bind has been pushed to bionic (1:9.11.3+dfsg-1ubuntu1.2). This is
newer than bind9 in ppa:freeipa/ppa, but does not contain the fix for
this bug. Therefore, bind9 upgrade should be prevented by helding the
ppa package, or bind9-pkcs11 will stop working.

-- 
You received this bug notification because you are a member of FreeIPA,
which is subscribed to freeipa in Ubuntu.
https://bugs.launchpad.net/bugs/1769440

Title:
  freeipa server install fails - named-pkcs11 fails to run

Status in bind9 package in Ubuntu:
  Fix Released
Status in freeipa package in Ubuntu:
  Invalid
Status in bind9 source package in Bionic:
  Confirmed

Bug description:
  [Impact]

  Using RTLD_DEEPBIND in bind9 causes the FreeIPA serve install to fail.

  This patch, also applied in fedora and debian, disables use of RTLD_DEEPBIND.
  https://src.fedoraproject.org/rpms/bind/c/3d5ea105bd877f0069452e450320f8877b01cb52?branch=master
  https://salsa.debian.org/dns-team/bind9/commit/afc6b5fe2e359e4e7eadc256cd94481965418b4b

  [Test Case]

  # uvt-kvm create --memory 2048 cosmic-freeipa release=cosmic label=daily
  # uvt-kvm wait cosmic-freeipa
  # uvt-kvm ssh cosmic-freeipa

  Inside vm:

  # sudo su
  # apt purge -y cloud-init
  # echo "cosmic-freeipa.example.com" >/etc/hostname
  # sed -i 's/127.0.1.1.*cosmic.*//g' /etc/hosts
  # echo "$(ip addr | grep 'state UP' -A2 | tail -n1 | awk '{print $2}' | cut -f1 -d'/')  cosmic-freeipa.example.com" >>/etc/hosts
  # apt update
  # apt dist-upgrade -y
  # reboot
  # apt install -y freeipa-server

  * Default Kerberos realm: EXAMPLE.COM
  * Kerberos servers: cosmic-freeipa.example.com
  * Administrative server: cosmic-freeipa.example.com

  Get machine's ip address. You'll be using the x.x.x.1 address for the DNS forwarder
  # ip addr

  # ipa-server-install --allow-zone-overlap

  * Do you want to configure integrated DNS (BIND): YES
  * Server host name: cosmic-freeipa.example.com
  * Please confirm the domain name: example.com
  * Please provide a realm name: EXAMPLE.COM
  * Directory Manager password: (anything)
  * IPA admin password: (anything)
  * Do you want to configure DNS forwarders: yes
  * Do you want to configure these servers as DNS forwarders?: no
  * Enter an IP address for a DNS forwarder, or press Enter to skip: (x.x.x.1 address from before)
  * Do you want to search for missing reverse zones?: yes

  Installation should fail.

  [Regression Potential]

  In theory, if another library with the exact same symbol is loaded,
  bind9 may end up calling the wrong function. This is, however, a
  potential problem with any program that loads shared libraries.

  [Original Description]

  Setting up FreeIPA server fails at "Configuring the web interface",
  step 12/21

  It's in a cleanly started LXC Ubuntu Bionic container. The
  ppa:freeipa/ppa is also used to get tomcat 8.5.30-1ubuntu1.2

  Configuring the web interface (httpd)
    [1/21]: stopping httpd
    [2/21]: backing up ssl.conf
    [3/21]: disabling nss.conf
    [4/21]: configuring mod_ssl certificate paths
    [5/21]: setting mod_ssl protocol list to TLSv1.0 - TLSv1.2
    [6/21]: configuring mod_ssl log directory
    [7/21]: disabling mod_ssl OCSP
    [8/21]: adding URL rewriting rules
    [9/21]: configuring httpd
    [10/21]: setting up httpd keytab
    [11/21]: configuring Gssproxy
    [12/21]: setting up ssl
    [error] RuntimeError: Certificate issuance failed (CA_REJECTED)
  ipapython.admintool: ERROR    Certificate issuance failed (CA_REJECTED)
  ipapython.admintool: ERROR    The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

  and in the log there is

  2018-05-05T20:37:29Z DEBUG stderr=
  2018-05-05T20:37:29Z DEBUG step duration: httpd configure_gssproxy 1.09 sec
  2018-05-05T20:37:29Z DEBUG   [12/21]: setting up ssl
  2018-05-05T20:37:33Z DEBUG certmonger request is in state dbus.String(u'GENERATING_KEY_PAIR', variant_level=1)
  2018-05-05T20:37:38Z DEBUG certmonger request is in state dbus.String(u'CA_REJECTED', variant_level=1)
  2018-05-05T20:37:42Z DEBUG Traceback (most recent call last):
    File "/usr/lib/python2.7/dist-packages/ipaserver/install/service.py", line 555, in start_creation
      run_step(full_msg, method)
    File "/usr/lib/python2.7/dist-packages/ipaserver/install/service.py", line 541, in run_step
      method()
    File "/usr/lib/python2.7/dist-packages/ipaserver/install/httpinstance.py", line 376, in __setup_ssl
      passwd_fname=key_passwd_file
    File "/usr/lib/python2.7/dist-packages/ipalib/install/certmonger.py", line 320, in request_and_wait_for_cert
      raise RuntimeError("Certificate issuance failed ({})".format(state))
  RuntimeError: Certificate issuance failed (CA_REJECTED)

  2018-05-05T20:37:42Z DEBUG   [error] RuntimeError: Certificate issuance failed (CA_REJECTED)
  2018-05-05T20:37:42Z DEBUG   File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line 174, in exec
  ute
  ...

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/1769440/+subscriptions