freeipa

#7184 ipa-server fails to uninstall successfully due to named-pkcs11 not stopping
Opened by mreznik. Modified

Open
Close Issue

In CA-less scenario sometimes ipa-server fails to uninstall due to named-pkcs11 not stopping.

[root@master ~]# systemctl status named-pkcs11
● named-pkcs11.service - Berkeley Internet Name Domain (DNS) with native PKCS#11
   Loaded: loaded (/usr/lib/systemd/system/named-pkcs11.service; disabled; vendor preset: disabled)
   Active: active (running) since Thu 2017-10-05 17:39:53 CEST; 15h ago
 Main PID: 7348 (named-pkcs11)
    Tasks: 5 (limit: 4915)
   CGroup: /system.slice/named-pkcs11.service
           └─7348 /usr/sbin/named-pkcs11 -u named
Oct 06 08:58:38 master.ipa.test named-pkcs11[7348]: client @0x7f66f44423c0 10.34.78.26#44637 (26.78.34.10.in-addr.arpa): RFC 1918 response from Internet for 26.78.34.10.in-addr.arpa
Oct 06 08:58:38 master.ipa.test named-pkcs11[7348]: client @0x7f66f44423c0 10.34.78.26#56370 (26.78.34.10.in-addr.arpa): RFC 1918 response from Internet for 26.78.34.10.in-addr.arpa
Oct 06 08:59:13 master.ipa.test named-pkcs11[7348]: Failed to parse the principal name 'DNS/master.ipa.test' (Configuration file does not specify default realm)
Oct 06 08:59:13 master.ipa.test named-pkcs11[7348]: ldap_syncrepl will reconnect in 60 seconds
Oct 06 09:00:13 master.ipa.test named-pkcs11[7348]: Failed to parse the principal name 'DNS/master.ipa.test' (Configuration file does not specify default realm)
Oct 06 09:00:13 master.ipa.test named-pkcs11[7348]: ldap_syncrepl will reconnect in 60 seconds
Oct 06 09:01:13 master.ipa.test named-pkcs11[7348]: Failed to parse the principal name 'DNS/master.ipa.test' (Configuration file does not specify default realm)
Oct 06 09:01:13 master.ipa.test named-pkcs11[7348]: ldap_syncrepl will reconnect in 60 seconds
Oct 06 09:02:13 master.ipa.test named-pkcs11[7348]: Failed to parse the principal name 'DNS/master.ipa.test' (Configuration file does not specify default realm)
Oct 06 09:02:13 master.ipa.test named-pkcs11[7348]: ldap_syncrepl will reconnect in 60 seconds

After that ipa-server-install fails:

2017-10-05T16:31:26Z DEBUG Logging to /var/log/ipaserver-install.log
2017-10-05T16:31:26Z INFO Checking DNS domain ipa.test, please wait ...
2017-10-05T16:31:26Z DEBUG   File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 174, in execute
    return_value = self.run()
  File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 327, in run
    self.option_parser.error("{0}: {1}".format(desc, e))
  File "/usr/lib64/python3.6/optparse.py", line 1569, in error
    self.exit(2, "%s: error: %s\n" % (self.get_prog_name(), msg))
  File "/usr/lib64/python3.6/optparse.py", line 1559, in exit
    sys.exit(status)
2017-10-05T16:31:26Z DEBUG The ipa-server-install command failed, exception: SystemExit: 2
2017-10-05T16:31:26Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

Fedora 26 

# ipa ping
------------------------------------------------------------------------
IPA server version 4.6.90.dev201710031743+git7902fc9a. API version 2.229
------------------------------------------------------------------------

I don't think that CA less is relevant here.

I've saw such error when installer failed even in CA installation. And it applied also for httpd service.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.