freeipa team mailing list archive

[Timo Aaltonen <tjaalton@xxxxxxxxxx>]

Hello keestux, or anyone else affected,

Accepted bind9 into bionic-proposed. The package will build now and be
available at https://launchpad.net/ubuntu/+source/bind9/1:9.11.3+dfsg-
1ubuntu1.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-bionic to verification-done-bionic. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-bionic. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: bind9 (Ubuntu Bionic)
       Status: In Progress => Fix Committed

** Tags added: verification-needed verification-needed-bionic

-- 
You received this bug notification because you are a member of FreeIPA,
which is subscribed to freeipa in Ubuntu.
https://bugs.launchpad.net/bugs/1769440

Title:
  freeipa server install fails - named-pkcs11 fails to run

Status in bind9 package in Ubuntu:
  Fix Released
Status in freeipa package in Ubuntu:
  Invalid
Status in bind9 source package in Bionic:
  Fix Committed

Bug description:
  [Impact]

  Using RTLD_DEEPBIND in bind9 causes the FreeIPA serve install to fail.

  This patch, also applied in fedora and debian, disables use of RTLD_DEEPBIND.
  https://src.fedoraproject.org/rpms/bind/c/3d5ea105bd877f0069452e450320f8877b01cb52?branch=master
  https://salsa.debian.org/dns-team/bind9/commit/afc6b5fe2e359e4e7eadc256cd94481965418b4b

  [Test Case]

  # uvt-kvm create --memory 2048 cosmic-freeipa release=cosmic label=daily
  # uvt-kvm wait cosmic-freeipa
  # uvt-kvm ssh cosmic-freeipa

  Inside vm:

  # sudo su
  # apt purge -y cloud-init
  # echo "cosmic-freeipa.example.com" >/etc/hostname
  # sed -i 's/127.0.1.1.*cosmic.*//g' /etc/hosts
  # echo "$(ip addr | grep 'state UP' -A2 | tail -n1 | awk '{print $2}' | cut -f1 -d'/')  cosmic-freeipa.example.com" >>/etc/hosts
  # apt update
  # apt dist-upgrade -y
  # reboot
  # apt install -y freeipa-server

  * Default Kerberos realm: EXAMPLE.COM
  * Kerberos servers: cosmic-freeipa.example.com
  * Administrative server: cosmic-freeipa.example.com

  Get machine's ip address. You'll be using the x.x.x.1 address for the DNS forwarder
  # ip addr

  # ipa-server-install --allow-zone-overlap

  * Do you want to configure integrated DNS (BIND): YES
  * Server host name: cosmic-freeipa.example.com
  * Please confirm the domain name: example.com
  * Please provide a realm name: EXAMPLE.COM
  * Directory Manager password: (anything)
  * IPA admin password: (anything)
  * Do you want to configure DNS forwarders: yes
  * Do you want to configure these servers as DNS forwarders?: no
  * Enter an IP address for a DNS forwarder, or press Enter to skip: (x.x.x.1 address from before)
  * Do you want to search for missing reverse zones?: yes

  Installation should fail.

  [Regression Potential]

  In theory, if another library with the exact same symbol is loaded,
  bind9 may end up calling the wrong function. This is, however, a
  potential problem with any program that loads shared libraries.

  [Original Description]

  Setting up FreeIPA server fails at "Configuring the web interface",
  step 12/21

  It's in a cleanly started LXC Ubuntu Bionic container. The
  ppa:freeipa/ppa is also used to get tomcat 8.5.30-1ubuntu1.2

  Configuring the web interface (httpd)
    [1/21]: stopping httpd
    [2/21]: backing up ssl.conf
    [3/21]: disabling nss.conf
    [4/21]: configuring mod_ssl certificate paths
    [5/21]: setting mod_ssl protocol list to TLSv1.0 - TLSv1.2
    [6/21]: configuring mod_ssl log directory
    [7/21]: disabling mod_ssl OCSP
    [8/21]: adding URL rewriting rules
    [9/21]: configuring httpd
    [10/21]: setting up httpd keytab
    [11/21]: configuring Gssproxy
    [12/21]: setting up ssl
    [error] RuntimeError: Certificate issuance failed (CA_REJECTED)
  ipapython.admintool: ERROR    Certificate issuance failed (CA_REJECTED)
  ipapython.admintool: ERROR    The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

  and in the log there is

  2018-05-05T20:37:29Z DEBUG stderr=
  2018-05-05T20:37:29Z DEBUG step duration: httpd configure_gssproxy 1.09 sec
  2018-05-05T20:37:29Z DEBUG   [12/21]: setting up ssl
  2018-05-05T20:37:33Z DEBUG certmonger request is in state dbus.String(u'GENERATING_KEY_PAIR', variant_level=1)
  2018-05-05T20:37:38Z DEBUG certmonger request is in state dbus.String(u'CA_REJECTED', variant_level=1)
  2018-05-05T20:37:42Z DEBUG Traceback (most recent call last):
    File "/usr/lib/python2.7/dist-packages/ipaserver/install/service.py", line 555, in start_creation
      run_step(full_msg, method)
    File "/usr/lib/python2.7/dist-packages/ipaserver/install/service.py", line 541, in run_step
      method()
    File "/usr/lib/python2.7/dist-packages/ipaserver/install/httpinstance.py", line 376, in __setup_ssl
      passwd_fname=key_passwd_file
    File "/usr/lib/python2.7/dist-packages/ipalib/install/certmonger.py", line 320, in request_and_wait_for_cert
      raise RuntimeError("Certificate issuance failed ({})".format(state))
  RuntimeError: Certificate issuance failed (CA_REJECTED)

  2018-05-05T20:37:42Z DEBUG   [error] RuntimeError: Certificate issuance failed (CA_REJECTED)
  2018-05-05T20:37:42Z DEBUG   File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line 174, in exec
  ute
  ...

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/1769440/+subscriptions