freeipa

#7535 ipa-restore fails because tmp/etc/ipa/ca.crt is missing
Closed: fixed Opened by cheimes.

Closed: fixed
Reopen Issue

Issue

ipa-restore fails because ca.crt is not available when the ReplicationManager verifies the DM password.

On Fedora 27, libldap uses NSS (ldap.get_option(ldap.OPT_X_TLS_PACKAGE) == 'MozNSS'). On Fedora 28, it's OpenSSL (ldap.get_option(ldap.OPT_X_TLS_PACKAGE) == 'OpenSSL'). OpenSSL behaves slightly different and fails in OPT_X_TLS_NEWCTX when the CA cert file is invalid or does not exist.

Steps to Reproduce

  1. ipa-backup
  2. ipa-server-install --uninstall -U
  3. ipa-restore

Actual behavior

2018-05-07T07:46:03Z DEBUG   File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 178, in execute
    return_value = self.run()
  File "/usr/lib/python3.6/site-packages/ipaserver/install/ipa_restore.py", line 334, in run
    self.init_api(confdir=self.dir + paths.ETC_IPA)
  File "/usr/lib/python3.6/site-packages/ipaserver/install/ipa_restore.py", line 890, in init_api
    self.dirman_password)
  File "/usr/lib/python3.6/site-packages/ipaserver/install/replication.py", line 222, in __init__
    start_tls=starttls)
  File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 773, in __init__
    self._conn = self._connect()
  File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1122, in _connect
    conn = ldap_initialize(self.ldap_uri, cacertfile=self._cacert)
  File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 111, in ldap_initialize
    conn.set_option(ldap.OPT_X_TLS_NEWCTX, 0)
  File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 919, in set_option
    return self._ldap_call(self._l.set_option,option,invalue)
  File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 313, in _ldap_call
    result = func(*args,**kwargs)
2018-05-07T07:46:03Z DEBUG The ipa-restore command failed, exception: ValueError: option error

Expected behavior

No error

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

Additional info:

Reproducer script:

import ldap
ldap.set_option(ldap.OPT_DEBUG_LEVEL, -1)
conn = ldap.initialize('ldap://localhost')
conn.set_option(ldap.OPT_X_TLS_CACERTFILE, '/etc/ipa/ca.crt')
conn.set_option(ldap.OPT_X_TLS_NEWCTX, 0)

Output:

ldap_create
ldap_url_parse_ext(ldap://localhost)
TLSMC: MozNSS compatibility interception begins.
tlsmc_intercept_initialization: INFO: entry options follow:
tlsmc_intercept_initialization: INFO: cacertdir = `(null)'
tlsmc_intercept_initialization: INFO: certfile = `(null)'
tlsmc_intercept_initialization: INFO: keyfile = `(null)'
tlsmc_convert: INFO: trying to open NSS DB with CACertDir = `(null)'.
tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present.
tlsmc_intercept_initialization: INFO: altered options follow:
tlsmc_intercept_initialization: INFO: cacertdir = `(null)'
tlsmc_intercept_initialization: INFO: certfile = `(null)'
tlsmc_intercept_initialization: INFO: keyfile = `(null)'
tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only.
TLSMC: MozNSS compatibility interception ends.
openat(AT_FDCWD, "/etc/crypto-policies/back-ends/openssl.config", O_RDONLY) = 3
openat(AT_FDCWD, "/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 3
openat(AT_FDCWD, "/etc/ipa/ca.crt", O_RDONLY) = -1 ENOENT (No such file or directory)
TLS: could not load verify locations (file:`/etc/ipa/ca.crt',dir:`').
TLS: error:02001002:system library:fopen:No such file or directory crypto/bio/bss_file.c:74
TLS: error:2006D080:BIO routines:BIO_new_file:no such file crypto/bio/bss_file.c:81
TLS: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib crypto/x509/by_file.c:201
Traceback (most recent call last):
  File "/tmp/l.py", line 6, in <module>
openat(AT_FDCWD, "/tmp/l.py", O_RDONLY|O_CLOEXEC) = 3
    conn.set_option(ldap.OPT_X_TLS_NEWCTX, 0)
  File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 919, in set_option
openat(AT_FDCWD, "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", O_RDONLY|O_CLOEXEC) = 3
    return self._ldap_call(self._l.set_option,option,invalue)
  File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 313, in _ldap_call
openat(AT_FDCWD, "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", O_RDONLY|O_CLOEXEC) = 3
    result = func(*args,**kwargs)
ValueError: option error

The regression is caused by https://pagure.io/freeipa/c/0653d2a17e67a32c9adcca8145afa231f228b855 from ticket https://pagure.io/freeipa/issue/7136

master:

  • 2a58fe6a3231f070dc979ab64a1deb10b8f085fd Revert "Validate the Directory Manager password"

Metadata Update from @rcritten:
- Issue assigned to rcritten
- Issue priority set to: normal
- Issue set to the milestone: FreeIPA 4.7

ipa-4-6:

  • 3da2124fa6a7fd4fb5308e56cc7f75bb125bb75d Revert "Validate the Directory Manager password"

https://github.com/freeipa/freeipa/pull/1911

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.6.4 (was: FreeIPA 4.7)

master:

  • 2256f9ef6af5c5eb780a0c5aeadb249ff882549f Validate the Directory Manager password before starting restore
  • 59b3eb0433b85f554ba999487288ad18a2be33e0 Add tests for ipa-restore with DM password validation check

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-6:

  • e045b0a74e42f95220b48ddbbb9480ce3e0eb917 Validate the Directory Manager password before starting restore
  • f8b6e8cd7f900049411c88ce51c51c726f70c102 Add tests for ipa-restore with DM password validation check
Metadata
None
None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.