freeipa

#6704 Installation fails when HTTPD with mod_nss is already running
Closed: wontfix Opened by cheimes.

Closed: wontfix
Reopen Issue

Installation of latest 4.5 dev fails if Apache HTTPD with mod_nss is already running. By default nss.conf configures a listener on port 8443.

$ dnf install httpd mod_nss
$ systemctl start httpd
$ ipa-server-install ...
...
IPA requires port 8443 for PKI but it is currently in use
$ ss -tlpn | grep 8443
LISTEN     0      128         :::8443                    :::*                   users:(("httpd",pid=15308,fd=6),("httpd",pid=15307,fd=6),("httpd",pid=15306,fd=6),("httpd",pid=15305,fd=6),("httpd",pid=15304,fd=6),("httpd",pid=15302,fd=6))
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install
    for _nothing in self._installer(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 557, in main
    master_install_check(self)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 249, in decorated
    func(installer)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 598, in install_check
    ca.install_check(False, None, options)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 175, in install_check
    raise ScriptError("Aborting installation")
2017-02-24T09:50:29Z DEBUG The ipa-server-install command failed, exception: ScriptError: Aborting installation
2017-02-24T09:50:29Z ERROR Aborting installation

I also tried to replace all occurrences of 8443 in /etc/httpd/conf.d/nss.conf with 443, followed by {{{systemctl restart httpd}}}:

$ sed -i s/8443/443/g /etc/httpd/conf.d/nss.conf
$ systemctl restart httpd
$ ipa-server-install ...
...
Apache is already configured with a listener on port 443:
*:443                  master.ipa.example (/etc/httpd/conf.d/nss.conf:83)

For the record, I'm using my pki-vagans playbook to test installation of FreeIPA. I never ran into this issue before. The exact same playbook, configuration and VM image work just fine with FreeIPA 4.4. The only difference between the working 4.4 scenario and the broken 4.5 scenarios are:

  • @freeipa/freeipa-master COPR is enabled
  • 4.5 dev RPMs are installed (all RPMs from ./makerpms.sh)

Metadata Update from @cheimes:
- Issue assigned to someone
- Issue set to the milestone: 0.0 NEEDS_TRIAGE

Metadata Update from @pvoborni:
- Custom field affects_doc reset
- Custom field tester adjusted to wanted
- Issue close_status updated to: None
- Issue set to the milestone: FreeIPA 4.5 (was: 0.0 NEEDS_TRIAGE)

Metadata Update from @pvoborni:
- Issue tagged with: regression

Metadata Update from @pvoborni:
- Issue priority set to: 4 (was: 1)

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.5.1 (was: FreeIPA 4.5)

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.5.2 (was: FreeIPA 4.5.1)

FreeIPA 4.5.1 has been released, moving to FreeIPA 4.5.2 milestone

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.5.3 (was: FreeIPA 4.5.2)

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.5.4 (was: FreeIPA 4.5.3)

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.5.5 (was: FreeIPA 4.5.4)

The issue will be fixed once and for all when IPA uses mod_ssl instead of mod_nss. In the mean time there is no need to complicate the installer even further.

Metadata Update from @cheimes:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata

regression

None
None
High
defect
Installation
None
wanted
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.