freeipa team mailing list archive

[Harry Coin <hgcoin@xxxxxxxxx>]

Timo,

You might take a look at /etc/sssd/sssd.conf

Consider changing

services =  ifp
#services = nss, pam, ifp, ssh, sudo

The reason is that unless you change this, systemctl is-system-running 
reports degraded instead of running, with messages akin to

Dec  9 17:59:25 registry1 sssd_check_socket_activated_responders[1672]: 
(Mon Dec  9 17:59:25:697972 2019) [sssd] [main] (0x0010): 
Misconfiguration found for the pam responder.
Dec  9 17:59:25 registry1 sssd_check_socket_activated_responders[1672]: 
The pam responder has been configured to be socket-activated but it's 
still mentioned in the services' line in /etc/sssd/sssd.conf.
Dec  9 17:59:25 registry1 sssd_check_socket_activated_responders[1672]: 
Please, consider either adjusting your services' line in 
/etc/sssd/sssd.conf or disabling the pam's socket by calling:
Dec  9 17:59:25 registry1 sssd_check_socket_activated_responders[1672]: 
"systemctl disable sssd-pam.socket"

On 11/28/19 8:17 AM, Timo Aaltonen wrote:
> I'm just going to assume things are all fixed with 19.10 and up, which
> have freeipa 4.8.x and dogtag 10.7.3, and they both depend on systemd
> features now which should resolve all race conditions
>
> ** Changed in: freeipa (Ubuntu)
>         Status: Confirmed => Fix Released
>
> ** Changed in: dogtag-pki (Ubuntu)
>         Status: Confirmed => Fix Released
>

-- 
You received this bug notification because you are a member of FreeIPA,
which is subscribed to freeipa in Ubuntu.
https://bugs.launchpad.net/bugs/1627371

Title:
  Timing problems with FreeIPA installation

Status in dogtag-pki package in Ubuntu:
  Fix Released
Status in freeipa package in Ubuntu:
  Fix Released

Bug description:
  While installing FreeIPA I came accross two situations that turned out
  to be timing problems. In both cases, the installation procedure was
  attempting to access the certificate server immediately after a
  restart, and the server was not listening.

  The first one is at step 10 of "Configuring certificate server
  (pki_tomcatd)":

    [10/28]: importing CA chain to RA certificate database
    [error] RuntimeError: Unable to retrieve CA chain: [Errno 111] Connection refused
  ipa.ipapython.install.cli.install_tool(Server): ERROR Unable to retrieve CA chain: [Errno 111] Connection refused

  The second is at step 25:

    [25/28]: migrating certificate profiles to LDAP
    [error] NetworkError: cannot connect to 'https://server.name:8443/ca/rest/account/login': Could not connect to server.name using any address: (PR_ADDRESS_NOT_SUPPORTED_ERROR) Network address type not supported.

  My solution was to add a delay at the top of the functions for those
  steps.

  def __import_ca_chain(self):
      + ##======================
      + # Add wait time to allow certificate server to start up
      + # 
      + time.sleep(10)

      chain = self.__get_ca_chain()

  ...

  def migrate_profiles_to_ldap():
      """Migrate profiles from filesystem to LDAP.

      This must be run *after* switching to the LDAPProfileSubsystem
      and restarting the CA.

      The profile might already exist, e.g. if a replica was already
      upgraded, so this case is ignored.

      """
      + ##======================
      + # Add wait time to allow certificate server to start up
      + # 
      + time.sleep(20)

      ensure_ldap_profiles_container()

  It might be necessary to adjust the sleep time.

  These bugs are intermittent and they may not appear at all. In my
  case, one KVM machine had no problems whatsoever while another had
  problems at the "migrate profiles ..." step. Both problems showed up
  on one Raspberry Pi. There were also time differences between runs.
  So, one needs to be _very_ patient.

  This is all on Ubuntu Xenial. freeipa-server 4.3.1-0ubuntu1.
  The RaspberryPi is a pi 2B

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/dogtag-pki/+bug/1627371/+subscriptions