freeipa

#8051 ipa server upgrade fails, services fail to start
Closed: worksforme by mbaloch. Opened by mbaloch.

Closed: worksforme
Reopen Issue

Issue

ipa server upgrade fails

Actual behavior

when trying to start ipact services using
"ipactl start"
I get
IPA version error: data needs to be upgraded (expected version '4.6.4-10.el7.centos.6', current version '4.6.4-10.el7.centos.3')
IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
Unexpected error - see /var/log/ipaupgrade.log for details:
AttributeError: 'NoneType' object has no attribute 'lower'

Expected behavior

ipactl should start the ipa services successfully

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.6.4-10.el7.centos.6.x86_64
ipa-client-4.6.4-10.el7.centos.6.x86_64
389-ds-base-1.3.8.4-25.1.el7_6.x86_64
pki-ca-10.5.9-13.el7_6.noarch
krb5-server-1.15.1-37.el7_6.x86_64

Additional info:

/var/log/ipaupgrade.log

2019-08-23T13:44:30Z DEBUG stderr=
2019-08-23T13:44:30Z INFO [Migrate CRL publish directory]
2019-08-23T13:44:30Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state'
2019-08-23T13:44:30Z INFO CRL tree already moved
2019-08-23T13:44:30Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2019-08-23T13:44:30Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run
server.upgrade()
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2085, in upgrade
upgrade_configuration()
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1750, in upgrade_configuration
sub_dict['CLONE']='#' if crl.lower() == 'true' else ''

2019-08-23T13:44:30Z DEBUG The ipa-server-upgrade command failed, exception: AttributeError: 'NoneType' object has no attribute 'lower'
2019-08-23T13:44:30Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details:
AttributeError: 'NoneType' object has no attribute 'lower'
2019-08-23T13:44:30Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information

Hi @mbaloch
Can you check if the file /etc/pki/pki-tomcat/ca/CS.cfg contains a line with ca.crl.MasterCRL.enableCRLUpdates=... ?

The line should be present with either =true (if the server is the CRL generation master) or =false (if the server does not generate CRL). If you have multiple IPA masters, you can check the content of the file on the other masters which provide the CA functionality (only one of them must have the ca.crl.MasterCRL.enableCRLUpdates=true), and add the line accordingly.

hi @frenaud
thanks for the response.
file /etc/pki/pki-tomcat/ca/CS.cfg is empty. but there is a file /etc/pki/pki-tomcat/ca/CS.cfg.bak which contains the line "ca.crl.MasterCRL.enableCRLUpdates=false" along with other settings.

so should i rename the CS.cfg.bak to CS.cfg? or
should i put only this line ca.crl.MasterCRL.enableCRLUpdates=false in the blank CS.cfg ?
Edited by mbaloch

Hi @mbaloch
The file backup is created when Dogtag starts successfully so this operation (rename the CS.cfg.bak to CS.cfg) should be safe but I would like you to check first if the backup is a recent one. The file CS.cfg.bak points to /var/lib/pki/pki-tomcat/conf/ca/archives/CS.cfg.bak. and there are probably multiple backup files in the /var/lib/pki/pki-tomcat/conf/ca/archives/ directory.
After that, relaunch ipa-server-upgrade and I hope this time it will succeed.

The corruption of CS.cfg can happen if the file is written while dogtag server is running (see 1163). The command ipa-server-upgrade normally stops dogtag server before any update to the file, we would need to see the journal to correlate the ipaugrade.log timestamps with the stop pki commands issued to systemd.

Hi @frenaud
thanks a lot. the system is updated and all services running now. I did
[root@ipa2 ca]# cat CS.cfg.bak >> CS.cfg
[root@ipa2 ca]# ipactl start
IPA version error: data needs to be upgraded (expected version '4.6.4-10.el7.centos.6', current version '4.6.4-10.el7.centos.3')
Automatically running upgrade, for details see /var/log/ipaupgrade.log
Be patient, this may take a few minutes.
Starting Directory Service
Starting krb5kdc Service
Starting kadmin Service
Starting named Service
Starting httpd Service
Starting ipa-custodia Service
Starting ntpd Service
Starting pki-tomcatd Service
Starting ipa-otpd Service
Starting ipa-dnskeysyncd Service
ipa: INFO: The ipactl command was successful
[root@ipa2 ca]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
ipa: INFO: The ipactl command was successful

Metadata Update from @mbaloch:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.