freeipa

#9792 /var/log/sssd directory not created during ipa-server-install (Fedora 42, freeipa-server distro packages)
Opened by jorenminer. Modified

Open
Close Issue

Issue

New install of freeipa-server on clean Fedora 42 instance, root user.
ipa-server-install does not create /var/log/sssd folder.

During installation (with ipa-server-install), the following messages are part of the output (with first few lines included to show where it happens):

Configured /etc/sssd/sssd.conf
Systemwide CA database updated.
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Broadcast message from systemd-journald@ipa.campwest.internal (Tue 2025-05-20 17:34:04 UTC):
sssd_kcm[11877]: Could not open file [/var/log/sssd/sssd_kcm.log]. Error: [2][No such file or directory]
SSSD enabled
Broadcast message from systemd-journald@ipa.campwest.internal (Tue 2025-05-20 17:34:21 UTC):
sssd[11916]: Could not open file [/var/log/sssd/sssd.log]. Error: [2][No such file or directory]

Output of ls -lah /var/log/ confirms that all logging directories are created except for 'sssd'.

Manually running mkdir /var/log/sssd and chown sssd:sssd /var/log/sssd does mitigate/workaround this issue, allowing sssd logs to be written.

Steps to Reproduce

  1. fresh install of fedora 42, root user, /etc/hostname configured, etc.
  2. installed freeipa-server and freeipa-server-dns via dnf install
  3. ran ipa-server-install, "yes" for setup DNS, defaults for remainder.

Actual behavior

/var/log/sssd folder is not created. Output of ipa-server-install command reflects this.

Expected behavior

/var/log/sssd folder to be created, with proper permissions set (sssd:sssd ownership), during ipa-server-install command

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

freeipa-server-4.12.2-13.fc42.x86_64
freeipa-client-4.12.2-13.fc42.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-3.1.2-4.fc42.x86_64
package pki-ca is not installed
krb5-server-1.21.3-5.fc42.x86_64

SSSD is responsible for creating and managing its log directory.

$ rpm -q --whatprovides /var/log/sssd/
sssd-common-2.10.2-3.fc42.x86_64

The directory is present in a fresh installation I just did.

Same SSSD version here:
$ rpm -q --whatprovides /var/log/sssd/ sssd-common-2.10.2-3.fc42.x86_64

When running from a 100% clean instance, with just dnf install freeipa-server followed by ipa-server-install, isn't it now ipa-server-install that's setting up SSSD?
So either SSSD has a bug, or ipa-server-install.

Or is it possible that the problem is running as root? i.e., ipa-server-install sets up /var/log directory and does so with root permissions (the /var/log folder is set with owner and group root:root). Once SSSD is initialized and tries to create /var/log/sssd, it's unable to for lack of permissions (either because of SSSD's process, or ipa-server-install not running sssd setup as root).
I'm not saying this is why/what happens, just a potential explanation.

As a follow up question, did you run your fresh install just now as root?

sssd-common should create the directory when the package is installed.

I assume that this shows the directory as missing.
$ rpm -V sssd-common

ipa-server-install can only be run as root.

IPA is not responsible for creating or managing the SSSD directory structure. The SSSD packaging is responsible and it appears to be creating things correctly.

To fix this you can run:
# dnf -y reinstall sssd-common

Fair enough.

Although on a second fresh install, the same issue happened again (not running dnf install sssd-common manually, but letting that be installed as a dependency for freeipa-server package)

So imo it's worth looking into why sssd doesn't set it up properly, when installed as a dependency to freeipa, as that affects freeipa users more than users only setting up SSSD specifically.

Or even just adding a note or troubleshooting entry for this, as I'm sure I'm not the only person to think "I can just let dnf install freeipa-server handle dependencies, and that won't cause issues that manual dependency installs would fix"

Either way, I'm not too invested in this issue myself. If core FreeIPA maintainers want to look into this, great. Otherwise, it's here for future reference/others that run into this. In that case, feel free to close this issue.

How are you installing F42 and the ipa packages? Is this a VM, bare metal or container?
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.