freeipa

Clone
Source Code
GIT

#4666 CI tests: on F20 fail to start pki-tomcatd
Closed: Invalid None Opened 9 years ago by tbordaz.

Closed: Invalid
Reopen Issue

On F20, while testing ipa-4-0 branch with 389-ds master branch installation of ipa-server fails to start pki-tomcatd

freeipa-server-4.0.4GITc55f153-0
389-ds-base-2014_10_28-1.fc20

...
  [25/26]: configure Server-Cert certificate renewal
  [26/26]: Configure HTTP to proxy connections
Done configuring certificate server (pki-tomcatd).
Configuring directory server (dirsrv): Estimated time 10 seconds
  [1/3]: configuring ssl for ds instance
  [2/3]: restarting directory server
  [3/3]: adding CA certificate entry
Done configuring directory server (dirsrv).
CA did not start in 300.0s

Looking at /var/log/pki/pki-tomcat/ca/debug, there is a problem to access over the secure port of DS

[28/Oct/2014:06:07:01][localhost-startStop-1]: CMS:Caught EBaseException
Internal Database Error encountered: Could not connect to LDAP server host vm-xxx port 636 Error netscape.ldap.LDAPException: IO Error creating JSS SSL Socket (-1)
        at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:658)
        at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:934)
        at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:865)
        at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:362)
        at com.netscape.certsrv.apps.CMS.init(CMS.java:189)
        at com.netscape.certsrv.apps.CMS.start(CMS.java:1585)
        at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114)
        at javax.servlet.GenericServlet.init(GenericServlet.java:158)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:606)
        at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277)
        at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.Subject.doAsPrivileged(Subject.java:536)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:169)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:123)
        at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1267)
        at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1192)
        at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1087)
        at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5210)
        at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5493)
        at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
        at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901)
        at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
        at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156)
        at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145)
        at java.security.AccessController.doPrivileged(Native Method)
        at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:875)
        at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:632)
        at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:670)
        at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1839)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
        at java.util.concurrent.FutureTask.run(FutureTask.java:262)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
        at java.lang.Thread.run(Thread.java:745)
[28/Oct/2014:06:07:01][localhost-startStop-1]: CMSEngine.shutdown()
[28/Oct/2014:06:07:01][localhost-startStop-1]: LogFile:In log shutdown
[28/Oct/2014:06:07:01][localhost-startStop-1]: SignedAuditEventFactory: create() message=[AuditEvent=AUDIT_LOG_SHUTDOWN][SubjectID=$System$][Outcome=Success] audit function shutdown

Although 636 is enabled with

dn: cn=encryption,cn=config
objectClass: top
objectClass: nsEncryptionConfig
cn: encryption
nsSSLSessionTimeout: 0
nsSSLClientAuth: allowed
sslVersionMin: tls1.1
creatorsName: cn=server,cn=plugins,cn=config
modifiersName: cn=directory manager
createTimestamp: 20141028100356Z
modifyTimestamp: 20141028132618Z
nsSSL3Ciphers: +all
allowWeakCipher: off
numSubordinates: 1

The problem appears with the following commit https://fedorahosted.org/389/ticket/47928

c1ecd8b Ticket #47928 - Disable SSL v3, by default.

Disabling SSLv3 and SSLv2 in Tomcat (https://access.redhat.com/solutions/1232233) does not allow CS to start. The setting was 

tomcatjss-7.1.1-1.fc20.noarch
tomcat-7.0.52-2.fc20.noarch

    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLSv1,TLSv1.1,TLSv1.2" />

May be related: #4676.

Changing

dn: cn=encryption,cn=config
sslVersionMin: tls1.1

to

sslVersionMin: tls1

makes dogtag happy to start and use LDAP.

Raising priority. Not starting PKI is obviously a major bug.

These are the tested done on F20 with latest jss and tomcatjss updates.
They do not prevent (by themself) the failure during IPA install.

Those updates were suggested in https://bugzilla.redhat.com/show_bug.cgi?id=1158410

Freeipa version: is ipa-4-0 branch (Nov 4th)
DS version: is master branch (Nov 3rd)

    jss-4.2.6-35.fc20.x86_64
    389-ds-base-2014_11_03-1.fc20.x86_64
    tomcatjss-7.1.1-1.fc20.noarch
    pki-server-10.2.0-3.fc20.noarch
    freeipa-server-4.0.4GITc55f153-0.fc20.x86_64

    ...
      [24/26]: configure RA certificate renewal
      [25/26]: configure Server-Cert certificate renewal
      [26/26]: Configure HTTP to proxy connections
    Done configuring certificate server (pki-tomcatd).
    Configuring directory server (dirsrv): Estimated time 10 seconds
      [1/3]: configuring ssl for ds instance
      [2/3]: restarting directory server
      [3/3]: adding CA certificate entry
    Done configuring directory server (dirsrv).
    CA did not start in 300.0s


    tail -100 /var/log/pki/pki-tomcat/ca/debug

    [04/Nov/2014:03:58:24][localhost-startStop-1]: CMSEngine: ready to init id=dbs
    [04/Nov/2014:03:58:24][localhost-startStop-1]: DBSubsystem: init()  mEnableSerialMgmt=false
    [04/Nov/2014:03:58:24][localhost-startStop-1]: LdapBoundConnFactory: init
    [04/Nov/2014:03:58:24][localhost-startStop-1]: LdapBoundConnFactory:doCloning true
    [04/Nov/2014:03:58:24][localhost-startStop-1]: LdapAuthInfo: init()
    [04/Nov/2014:03:58:24][localhost-startStop-1]: LdapAuthInfo: init begins
    [04/Nov/2014:03:58:24][localhost-startStop-1]: LdapAuthInfo: init ends
    [04/Nov/2014:03:58:24][localhost-startStop-1]: init: before makeConnection errorIfDown is true
    [04/Nov/2014:03:58:24][localhost-startStop-1]: makeConnection: errorIfDown true
    [04/Nov/2014:03:58:24][localhost-startStop-1]: LdapJssSSLSocket set client auth cert nicknamesubsystemCert cert-pki-ca
    [04/Nov/2014:03:58:24][localhost-startStop-1]: CMS:Caught EBaseException
    Internal Database Error encountered: Could not connect to LDAP server host vm-043.xxx.xx.xxx port 636 Error netscape.ldap.LDAPException: IO Error creating JSS SSL Socket (-1)
            at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:658)
            at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:934)
            at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:865)
            at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:362)
            at com.netscape.certsrv.apps.CMS.init(CMS.java:189)
            at com.netscape.certsrv.apps.CMS.start(CMS.java:1585)
            at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114)
            at javax.servlet.GenericServlet.init(GenericServlet.java:158)
            at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
            at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
            at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
            at java.lang.reflect.Method.invoke(Method.java:606)
            at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277)
            at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274)
            at java.security.AccessController.doPrivileged(Native Method)
            at javax.security.auth.Subject.doAsPrivileged(Subject.java:536)
            at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309)
            at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:169)
            at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:123)
            at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1267)
            at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1192)
            at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1087)
            at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5210)
            at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5493)
            at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
            at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901)
            at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
            at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156)
            at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145)
            at java.security.AccessController.doPrivileged(Native Method)
            at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:875)
            at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:632)
            at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:670)
            at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1839)
            at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
            at java.util.concurrent.FutureTask.run(FutureTask.java:262)
            at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
            at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
            at java.lang.Thread.run(Thread.java:745)
    [04/Nov/2014:03:58:24][localhost-startStop-1]: CMSEngine.shutdown()
    [04/Nov/2014:03:58:24][localhost-startStop-1]: LogFile:In log shutdown
    [04/Nov/2014:03:58:24][localhost-startStop-1]: SignedAuditEventFactory: create() message=[AuditEvent=AUDIT_LOG_SHUTDOWN][SubjectID=$System$][Outcome=Success] audit function shutdown

    [04/Nov/2014:03:58:24][localhost-startStop-1]: LogFile:In log shutdown
    [04/Nov/2014:03:58:24][localhost-startStop-1]: SignedAuditEventFactory: create() message=[AuditEvent=AUDIT_LOG_SHUTDOWN][SubjectID=$System$][Outcome=Success] audit function shutdown

    [04/Nov/2014:03:58:40][http-bio-8443-exec-2]: according to ccMode, authorization for servlet: caGetStatus is LDAP based, not XML {1}, use default authz mgr: {2}.

The fix recommended in https://fedorahosted.org/freeipa/ticket/4666#comment:4 did not work during my tests (branch ipa 4.0.4).

The workaround that worked was to set 'nsssl3:on' and 'nstls1:on' during the installation of DS (before creating CS).
setting 'sslversionMin:tls1' SHOULD be equivalent but I was unsuccessful to make it work.

Need to identify the appropriate setting of sslversion[Min|Max], equivalent to 'nsssl3:on' and 'nstls:on'

Workaround from https://bugzilla.redhat.com/show_bug.cgi?id=871171#c6 :

  • before ipa-server-install
  • edit /usr/share/pki/server/conf/server.xml

  • set the options below to secure port connecter (element which starts with <Connector name="[PKI_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_SECURE_PORT]")

    sslVersionRangeStream="tls1_0:tls1_2"
    sslVersionRangeDatagram="tls1_1:tls1_2"
    sslRangeCiphers="-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_DSS_WITH_AES_128_CBC_SHA,+TLS_DHE_DSS_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,+TLS_RSA_WITH_AES_128_CBC_SHA256,+TLS_RSA_WITH_AES_256_CBC_SHA256,+TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=1158410 (Red Hat Enterprise Linux 7)

Trying to implement a temporary workaround in DS configuration. I succeeded to make it work with

dn: cn=encryption,cn=config
objectClass: top
objectClass: nsEncryptionConfig
cn: encryption
nsSSLSessionTimeout: 0
nsSSLClientAuth: allowed
nsTLS1: on
nsSSL3: on
nsSSL3Ciphers: +all
allowWeakCipher: off
numSubordinates: 1

But the two following config still trigger the failure

dn: cn=encryption,cn=config
objectClass: top
objectClass: nsEncryptionConfig
cn: encryption
nsSSLSessionTimeout: 0
nsSSLClientAuth: allowed
sslVersionMin: tls1.0
sslVersionMax: tls1.2
nsSSL3Ciphers: +all
allowWeakCipher: off
numSubordinates: 1

or 

dn: cn=encryption,cn=config
objectClass: top
objectClass: nsEncryptionConfig
cn: encryption
nsSSLSessionTimeout: 0
nsSSLClientAuth: allowed
sslVersionMin: SSL3
sslVersionMax: tls1.2
nsSSL3Ciphers: +all
allowWeakCipher: off
numSubordinates: 1

I was expecting the last one to work and being equivalent to 'nsssl3:on' + 'nstls1.0'. But it is not. Possibly a problem in DS.

Here is the configuration that I would recommend as workaround (to enable ssl3, it requires nsSSL3: on)

dn: cn=encryption,cn=config
objectClass: top
objectClass: nsEncryptionConfig
cn: encryption
nsSSLSessionTimeout: 0
nsSSLClientAuth: allowed
sslVersionMin: tls1.0
sslVersionMax: tls1.2
nsSSL3: on
nsSSL3Ciphers: +all
allowWeakCipher: off
numSubordinates: 1

A new release of pki-tomcatd will support new TLS ciphers (https://fedorahosted.org/pki/ticket/1198).
The attached patch is temporary workaround to allow IPA installation.

Replying to [comment:9 pvoborni]:

Workaround from https://bugzilla.redhat.com/show_bug.cgi?id=871171#c6 :

  • before ipa-server-install
  • edit /usr/share/pki/server/conf/server.xml
  • set the options below to secure port connecter (element which starts with <Connector name="[PKI_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_SECURE_PORT]")

{{{
sslVersionRangeStream="tls1_0:tls1_2"
sslVersionRangeDatagram="tls1_1:tls1_2"
sslRangeCiphers="-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_DSS_WITH_AES_128_CBC_SHA,+TLS_DHE_DSS_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,+TLS_RSA_WITH_AES_128_CBC_SHA256,+TLS_RSA_WITH_AES_256_CBC_SHA256,+TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"
}}}

This workaround works for the ipa-4-0 branch tests

Replying to [comment:15 tbordaz]:

Replying to [comment:9 pvoborni]:

Workaround from https://bugzilla.redhat.com/show_bug.cgi?id=871171#c6 :

  • before ipa-server-install
  • edit /usr/share/pki/server/conf/server.xml
  • set the options below to secure port connecter (element which starts with <Connector name="[PKI_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_SECURE_PORT]")

{{{
sslVersionRangeStream="tls1_0:tls1_2"
sslVersionRangeDatagram="tls1_1:tls1_2"
sslRangeCiphers="-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_DSS_WITH_AES_128_CBC_SHA,+TLS_DHE_DSS_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,+TLS_RSA_WITH_AES_128_CBC_SHA256,+TLS_RSA_WITH_AES_256_CBC_SHA256,+TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"
}}}

This workaround works for the ipa-4-0 branch tests

Humm... I was too fast stating it works for ipa-4-0.
It allows pki-tomcatd to start successfully but later at the end of the install, ldappassword fails 

...
Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 seconds
  [1/26]: creating certificate server user
  [2/26]: configuring certificate server instance
  [3/26]: stopping certificate server instance to update CS.cfg
  [4/26]: backing up CS.cfg
  [5/26]: disabling nonces
  [6/26]: set up CRL publishing
  [7/26]: starting certificate server instance
  [8/26]: creating RA agent certificate database
  [9/26]: importing CA chain to RA certificate database
  [10/26]: fixing RA database permissions
  [11/26]: setting up signing cert profile
  [12/26]: set certificate subject base
  [13/26]: enabling Subject Key Identifier
  [14/26]: enabling Subject Alternative Name
  [15/26]: enabling CRL and OCSP extensions for certificates
  [16/26]: setting audit signing renewal to 2 years
  [17/26]: configuring certificate server to start on boot
  [18/26]: restarting certificate server
  [19/26]: requesting RA certificate from CA
  [20/26]: issuing RA agent certificate
  [21/26]: adding RA agent as a trusted user
  [22/26]: configure certmonger for renewals
  [23/26]: configure certificate renewals
  [24/26]: configure RA certificate renewal
  [25/26]: configure Server-Cert certificate renewal
  [26/26]: Configure HTTP to proxy connections
Done configuring certificate server (pki-tomcatd).
Configuring directory server (dirsrv): Estimated time 10 seconds
  [1/3]: configuring ssl for ds instance
  [2/3]: restarting directory server
  [3/3]: adding CA certificate entry
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds
  [1/10]: adding sasl mappings to the directory
  [2/10]: adding kerberos container to the directory
  [3/10]: configuring KDC
  [4/10]: initialize kerberos container
  [5/10]: adding default ACIs
  [6/10]: creating a keytab for the directory
  [7/10]: creating a keytab for the machine
  [8/10]: adding the password extension to the directory
  [9/10]: starting the KDC
  [10/10]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
  [1/2]: starting kadmin
  [2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa_memcached
  [1/2]: starting ipa_memcached
  [2/2]: configuring ipa_memcached to start on boot
Done configuring ipa_memcached.
Configuring ipa-otpd
  [1/2]: starting ipa-otpd
  [2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Configuring the web interface (httpd): Estimated time 1 minute
  [1/14]: setting mod_nss port to 443
  [2/14]: setting mod_nss protocol list to TLSv1.0 and TLSv1.1
  [3/14]: setting mod_nss password file
  [4/14]: enabling mod_nss renegotiate
  [5/14]: adding URL rewriting rules
  [6/14]: configuring httpd
  [7/14]: setting up ssl
  [8/14]: setting up browser autoconfig
  [9/14]: publish CA cert
  [10/14]: creating a keytab for httpd
  [11/14]: clean up any existing httpd ccache
  [12/14]: configuring SELinux for httpd
  [13/14]: restarting httpd
  [14/14]: configuring httpd to start on boot
Done configuring the web interface (httpd).
Applying LDAP updates
Restarting the directory server
Restarting the KDC
Restarting the certificate server
Configuring DNS (named)
  [1/11]: generating rndc key file
  [2/11]: adding DNS container
  [3/11]: setting up our zone
  [4/11]: setting up our own record
  [5/11]: setting up records for other masters
  [6/11]: setting up CA record
  [7/11]: setting up kerberos principal
  [8/11]: setting up named.conf
  [9/11]: restarting named
  [10/11]: configuring named to start on boot
  [11/11]: changing resolv.conf to point to ourselves
Done configuring DNS (named).

Global DNS configuration in LDAP server is empty
You can use 'dnsconfig-mod' command to set global DNS options that
would override settings in local named.conf files

Restarting the web server
Configuration of client side components failed!
ipa-client-install returned: Command ''/usr/sbin/ipa-client-install' '--on-master' '--unattended' '--domain' 'idm.lab.bos.redhat.com' '--server' 'vm-043.idm.lab.bos.redhat.com' '--realm' 'IDM.LAB.BOS.REDHAT.COM' '--hostname' 'vm-043.idm.lab.bos.redhat.com'' returned non-zero exit status 1
Unable to set admin password Command ''/usr/bin/ldappasswd' '-h' 'vm-043.idm.lab.bos.redhat.com' '-ZZ' '-x' '-D' 'cn=Directory Manager' '-y' '/var/lib/ipa/tmp4wSCwI' '-T' '/var/lib/ipa/tmpyHBDXF' 'uid=admin,cn=users,cn=accounts,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com'' returned non-zero exit status 1

Currently only https://fedorahosted.org/freeipa/ticket/4666?replyto=15#comment:13 allows to run successfully install+make-tests on ipa-4-0

See https://bugzilla.redhat.com/show_bug.cgi?id=1160466 for the ldappassword failure.

Fixing milestone, 4.0.4 was already released.

AFAIK, this is not an issue any more, FreeIPA installs on Fedora 20.

Metadata Update from @tbordaz:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.0.6
7 years ago

Login to comment on this ticket.

Metadata
None
None
None
important
None
None
None
None
defect
None
None
Installation
None
0
None
None
None
None
https://bugzilla.redhat.com/show_bug.cgi?id=1158410
None
None
None
Powered by Pagure 5.13.3
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.