From fujisan43 at gmail.com Tue Aug 4 09:11:09 2020 Content-Type: multipart/mixed; boundary="===============4352571453284697076==" MIME-Version: 1.0 From: Fujisan To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] trouble running ipa-server-update Date: Tue, 04 Aug 2020 09:10:58 +0000 Message-ID: <20200804091058.2831.58973@mailman01.iad2.fedoraproject.org> --===============4352571453284697076== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I upgraded my FreeIPA server to F31 and when running ipa-server-update, I g= et and error message: # ipa-server-upgrade = Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/11]: stopping directory server [2/11]: saving configuration [3/11]: disabling listeners [4/11]: enabling DS global lock [5/11]: disabling Schema Compat [6/11]: starting directory server [7/11]: updating schema [8/11]: upgrading server [9/11]: stopping directory server [10/11]: restoring configuration [11/11]: starting directory server Done. Update complete Upgrading IPA services Upgrading the configuration of the IPA services Disabled p11-kit-proxy [Verifying that root certificate is published] [Migrate CRL publish directory] CRL tree already moved [Verifying that KDC configuration is using ipa-kdb backend] [Fix DS schema file syntax] Syntax already fixed [Removing RA cert from DS NSS database] RA cert already removed [Enable sidgen and extdom plugins by default] [Updating HTTPD service IPA configuration] [Updating HTTPD service IPA WSGI configuration] [Migrating from mod_nss to mod_ssl] Already migrated to mod_ssl [Moving HTTPD service keytab to gssproxy] [Removing self-signed CA] [Removing Dogtag 9 CA] [Checking for deprecated KDC configuration files] [Checking for deprecated backups of Samba configuration files] [Remove FILE: prefix from 'dedicated keytab file' in Samba configuration] [Update 'max smbd processes' in Samba configuration to prevent unlimited SM= BLoris attack amplification] [Add missing CA DNS records] IPA CA DNS records already processed [Removing deprecated DNS configuration options] [Ensuring minimal number of connections] [Updating GSSAPI configuration in DNS] [Updating pid-file configuration in DNS] [Checking global forwarding policy in named.conf to avoid conflicts with au= tomatic empty zones] Changes to named.conf have been made, restart named [Upgrading CA schema] CA schema update complete (no changes) [Verifying that CA audit signing cert has 2 year validity] [Update certmonger certificate renewal configuration] Certmonger certificate renewal configuration already up-to-date [Enable PKIX certificate path discovery and validation] PKIX already enabled [Authorizing RA Agent to modify profiles] [Authorizing RA Agent to manage lightweight CAs] [Ensuring Lightweight CAs container exists in Dogtag database] [Adding default OCSP URI configuration] [Disabling cert publishing] [Ensuring CA is using LDAPProfileSubsystem] [Migrating certificate profiles to LDAP] IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command = ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: RemoteRetrieveError: Failed to authenticate to CA REST API The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more= information The end of file /var/log/ipaupgrade.log shows the following: [...] 2020-08-04T08:46:11Z DEBUG request body '' 2020-08-04T08:46:12Z DEBUG response status 500 2020-08-04T08:46:12Z DEBUG response headers Content-Type: text/html;charset= =3Dutf-8 Content-Language: en Content-Length: 2234 Date: Tue, 04 Aug 2020 08:46:12 GMT Connection: close 2020-08-04T08:46:12Z DEBUG response body (decoded): b'HTTP Status 500 \xe2\x80\x93 Internal Server Error=

HTTP Status 500 \xe2\x80\x93 Internal Server Error


Type Exception Report

Message CA subsys= tem unavailable. Check CA debug log.

Description The server en= countered an unexpected condition that prevented it from fulfilling the req= uest.

Exception

javax.ws.rs.ServiceUnavailableExceptio=
n: CA subsystem unavailable. Check CA debug log.\n\tcom.netscape.cms.tomcat=
.ProxyRealm.validateRealm(ProxyRealm.java:81)\n\tcom.netscape.cms.tomcat.Pr=
oxyRealm.findSecurityConstrai
 nts(ProxyRealm.java:149)\n\torg.apache.catalina.authenticator.Authenticato=
rBase.invoke(AuthenticatorBase.java:530)\n\tcom.netscape.cms.tomcat.Externa=
lAuthenticationValve.invoke(ExternalAuthenticationValve.java:82)\n\torg.apa=
che.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\n\tor=
g.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogVal=
ve.java:690)\n\torg.apache.catalina.connector.CoyoteAdapter.service(CoyoteA=
dapter.java:343)\n\torg.apache.coyote.http11.Http11Processor.service(Http11=
Processor.java:373)\n\torg.apache.coyote.AbstractProcessorLight.process(Abs=
tractProcessorLight.java:65)\n\torg.apache.coyote.AbstractProtocol$Connecti=
onHandler.process(AbstractProtocol.java:868)\n\torg.apache.tomcat.util.net.=
NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)\n\torg.apache.tomc=
at.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\n\tjava.ut=
il.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\n\=
tjava.util.concurrent.T
 hreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\n\torg.apache.to=
mcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tja=
va.lang.Thread.run(Thread.java:748)\n

Note The full stack tr= ace of the root cause is available in the server logs.


Apache Tomcat/9.0.36

' 2020-08-04T08:46:12Z ERROR IPA server upgrade failed: Inspect /var/log/ipau= pgrade.log and run command ipa-server-upgrade manually. 2020-08-04T08:46:12Z DEBUG File "/usr/lib/python3.7/site-packages/ipapyth= on/admintool.py", line 179, in execute return_value =3D self.run() File "/usr/lib/python3.7/site-packages/ipaserver/install/ipa_server_upgra= de.py", line 54, in run server.upgrade() File "/usr/lib/python3.7/site-packages/ipaserver/install/server/upgrade.p= y", line 2280, in upgrade upgrade_configuration() File "/usr/lib/python3.7/site-packages/ipaserver/install/server/upgrade.p= y", line 2149, in upgrade_configuration ca_enable_ldap_profile_subsystem(ca) File "/usr/lib/python3.7/site-packages/ipaserver/install/server/upgrade.p= y", line 414, in ca_enable_ldap_profile_subsystem cainstance.migrate_profiles_to_ldap() File "/usr/lib/python3.7/site-packages/ipaserver/install/cainstance.py", = line 1943, in migrate_profiles_to_ldap _create_dogtag_profile(profile_id, profile_data, overwrite=3DFalse) File "/usr/lib/python3.7/site-packages/ipaserver/install/cainstance.py", = line 1949, in _create_dogtag_profile with api.Backend.ra_certprofile as profile_api: File "/usr/lib/python3.7/site-packages/ipaserver/plugins/dogtag.py", line= 1315, in __enter__ raise errors.RemoteRetrieveError(reason=3D_('Failed to authenticate to = CA REST API')) 2020-08-04T08:46:12Z DEBUG The ipa-server-upgrade command failed, exception= : RemoteRetrieveError: Failed to authenticate to CA REST API 2020-08-04T08:46:12Z ERROR Unexpected error - see /var/log/ipaupgrade.log f= or details: RemoteRetrieveError: Failed to authenticate to CA REST API 2020-08-04T08:46:12Z ERROR The ipa-server-upgrade command failed. See /var/= log/ipaupgrade.log for more information I check the certificate in the NSS database (as I've seen in this thread ht= tps://lists.fedorahosted.org/archives/list/freeipa-users(a)lists.fedorahost= ed.org/thread/J6WTQQFCQ6VPR66UWTT4QBUTE26OZWUG/#J6WTQQFCQ6VPR66UWTT4QBUTE26= OZWUG) but got an error as well. # certutil -L -d /etc/httpd/alias -n ipaCert certutil: function failed: SEC_ERROR_BAD_DATABASE: security library: bad da= tabase. And retrieving the certificate with ldapsearch gives the following (redacte= d): # ldapsearch -D "cn=3Ddirectory manager" -W -b o=3Dipaca -LLL -o ldif-wrap= =3Dno "(uid=3Dipara)" usercertificate description Enter LDAP Password: = dn: uid=3Dipara,ou=3Dpeople,o=3Dipaca usercertificate:: MIIDazCCAlOgAwIBAgIBBzANBgkqhkiG9w0... description: 2;7;CN=3DCertificate Authority,O=3DMYDOMAIN.LOCAL;CN=3DIPA RA,= O=3DMYDOMAIN.LOCAL Is the ipa-server-update error message linked to the certutil error? How can I import the correct certificate in the /etc/httpd/alias NSS databa= se? --===============4352571453284697076==--