FreeIPA Upgrade F31 -> F32: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
After upgrading FreeIPA from F31 to F32, on startup I now see a lot of these errors from certmonger, ns-slapd, java, etc.
May 08 17:57:28 certmonger[38]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:30 ns-slapd[67]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:33 dogtag-ipa-renew-agent-submit[143]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:42 java[640]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
The server seems to come up without issue, but can you point me in the right direction to resolve these errors?
freeipa-server-4.8.6-1.fc32.x86_64 opendnssec-2.1.6-5.fc32.x86_64 opencryptoki-3.13.0-1.fc32.x86_64
I've installed a fresh F32 freeipa-server (on a test domain) and I don't see these errors.
Thanks. -A
On Saturday, May 9, 2020 3:17:25 PM CDT Anthony Joseph Messina via FreeIPA-users wrote:
After upgrading FreeIPA from F31 to F32, on startup I now see a lot of these errors from certmonger, ns-slapd, java, etc.
May 08 17:57:28 certmonger[38]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:30 ns-slapd[67]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:33 dogtag-ipa-renew-agent-submit[143]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:42 java[640]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
The server seems to come up without issue, but can you point me in the right direction to resolve these errors?
freeipa-server-4.8.6-1.fc32.x86_64 opendnssec-2.1.6-5.fc32.x86_64 opencryptoki-3.13.0-1.fc32.x86_64
I've installed a fresh F32 freeipa-server (on a test domain) and I don't see these errors.
I've tracked this to a difference in the crypto-policies package -- the F31 version contains the p11-kit-proxy stuff whereas the F32 version does not.
# # F31: /etc/crypto-policies/back-ends/nss.config library= name=Policy NSS=flags=policyOnly,moduleDB config="disallow=ALL allow=HMAC-SHA256:HMAC-SHA1:HMAC-SHA384:HMAC-SHA512:CURVE25519:SECP256R1:SECP384R1:SECP521R1:aes256-gcm:chacha20-poly1305:aes256-cbc:aes128-gcm:aes128-cbc:SHA256:SHA384:SHA512:SHA224:SHA1:ECDHE-RSA:ECDHE-ECDSA:RSA:DHE-RSA:tls-version-min=tls1.0:dtls-version-min=dtls1.0:DH-MIN=1023:DSA-MIN=2048:RSA-MIN=2048"
name=p11-kit-proxy library=p11-kit-proxy.so
# # F32: /etc/crypto-policies/back-ends/nss.config library= name=Policy NSS=flags=policyOnly,moduleDB config="disallow=ALL allow=HMAC-SHA256:HMAC-SHA1:HMAC-SHA384:HMAC-SHA512:CURVE25519:SECP256R1:SECP384R1:SECP521R1:aes256-gcm:chacha20-poly1305:aes256-cbc:aes128-gcm:aes128-cbc:SHA256:SHA384:SHA512:SHA224:SHA1:ECDHE-RSA:ECDHE-ECDSA:RSA:DHE-RSA:tls-version-min=tls1.0:dtls-version-min=dtls1.0:DH-MIN=1023:DSA-MIN=2048:RSA-MIN=2048"
I'm not sure whether removing the p11-kit-proxy related stuff from /etc/crypto-policies/back-ends/nss.config is the right thing to do, but the errors go away after that.
On la, 09 touko 2020, Anthony Joseph Messina via FreeIPA-users wrote:
On Saturday, May 9, 2020 3:17:25 PM CDT Anthony Joseph Messina via FreeIPA-users wrote:
After upgrading FreeIPA from F31 to F32, on startup I now see a lot of these errors from certmonger, ns-slapd, java, etc.
May 08 17:57:28 certmonger[38]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:30 ns-slapd[67]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:33 dogtag-ipa-renew-agent-submit[143]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:42 java[640]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
The server seems to come up without issue, but can you point me in the right direction to resolve these errors?
freeipa-server-4.8.6-1.fc32.x86_64 opendnssec-2.1.6-5.fc32.x86_64 opencryptoki-3.13.0-1.fc32.x86_64
I've installed a fresh F32 freeipa-server (on a test domain) and I don't see these errors.
I've tracked this to a difference in the crypto-policies package -- the F31 version contains the p11-kit-proxy stuff whereas the F32 version does not.
# # F31: /etc/crypto-policies/back-ends/nss.config library= name=Policy NSS=flags=policyOnly,moduleDB config="disallow=ALL allow=HMAC-SHA256:HMAC-SHA1:HMAC-SHA384:HMAC-SHA512:CURVE25519:SECP256R1:SECP384R1:SECP521R1:aes256-gcm:chacha20-poly1305:aes256-cbc:aes128-gcm:aes128-cbc:SHA256:SHA384:SHA512:SHA224:SHA1:ECDHE-RSA:ECDHE-ECDSA:RSA:DHE-RSA:tls-version-min=tls1.0:dtls-version-min=dtls1.0:DH-MIN=1023:DSA-MIN=2048:RSA-MIN=2048"
name=p11-kit-proxy library=p11-kit-proxy.so
# # F32: /etc/crypto-policies/back-ends/nss.config library= name=Policy NSS=flags=policyOnly,moduleDB config="disallow=ALL allow=HMAC-SHA256:HMAC-SHA1:HMAC-SHA384:HMAC-SHA512:CURVE25519:SECP256R1:SECP384R1:SECP521R1:aes256-gcm:chacha20-poly1305:aes256-cbc:aes128-gcm:aes128-cbc:SHA256:SHA384:SHA512:SHA224:SHA1:ECDHE-RSA:ECDHE-ECDSA:RSA:DHE-RSA:tls-version-min=tls1.0:dtls-version-min=dtls1.0:DH-MIN=1023:DSA-MIN=2048:RSA-MIN=2048"
I'm not sure whether removing the p11-kit-proxy related stuff from /etc/crypto-policies/back-ends/nss.config is the right thing to do, but the errors go away after that.
p11-kit-proxy simplifies configuration of HSM modules -- it automatically proxies HSM modules configured in the system.
Either through crypto-policies before F32 or with nss package in F32, nss library configures to import HSM moduels through p11-kit proxy automatically. In F32 nss installs /etc/crypto-policies/local.d/nss-p11-kit.config which contains the configuration that imports p11 kit automatically.
Since opendnssec uses SoftHSM, SoftHSM package is installed and it is automatically loaded into all applications using nss libraries, unless they are specifically configured to ignore p11-kit-proxy.
On a new install, FreeIPA creates /etc/pkcs11/modules/softhsm2.module that disables import of SoftHSM module through p11-kit-proxy. This was done with ticket https://pagure.io/freeipa/issue/7810 in FreeIPA 4.8.0, about a year ago. I guess, your installation was older than F31.
On Sunday, May 10, 2020 1:32:14 PM CDT Alexander Bokovoy wrote:
On la, 09 touko 2020, Anthony Joseph Messina via FreeIPA-users wrote:
On Saturday, May 9, 2020 3:17:25 PM CDT Anthony Joseph Messina via FreeIPA-
users wrote:
After upgrading FreeIPA from F31 to F32, on startup I now see a lot of these errors from certmonger, ns-slapd, java, etc.
May 08 17:57:28 certmonger[38]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:30 ns-slapd[67]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:33 dogtag-ipa-renew-agent-submit[143]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:42 java[640]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
The server seems to come up without issue, but can you point me in the right direction to resolve these errors?
freeipa-server-4.8.6-1.fc32.x86_64 opendnssec-2.1.6-5.fc32.x86_64 opencryptoki-3.13.0-1.fc32.x86_64
I've installed a fresh F32 freeipa-server (on a test domain) and I don't see these errors.
I've tracked this to a difference in the crypto-policies package -- the F31 version contains the p11-kit-proxy stuff whereas the F32 version does not.
# # F31: /etc/crypto-policies/back-ends/nss.config library= name=Policy NSS=flags=policyOnly,moduleDB config="disallow=ALL allow=HMAC-SHA256:HMAC-SHA1:HMAC-SHA384:HMAC-SHA512:CURVE25519:SECP256R1:S ECP384R1:SECP521R1:aes256-gcm:chacha20-poly1305:aes256-cbc:aes128-gcm:aes12 8-cbc:SHA256:SHA384:SHA512:SHA224:SHA1:ECDHE-RSA:ECDHE-ECDSA:RSA:DHE-RSA:tl s-version-min=tls1.0:dtls-version-min=dtls1.0:DH-MIN=1023:DSA-MIN=2048:RSA- MIN=2048"
name=p11-kit-proxy library=p11-kit-proxy.so
# # F32: /etc/crypto-policies/back-ends/nss.config library= name=Policy NSS=flags=policyOnly,moduleDB config="disallow=ALL allow=HMAC-SHA256:HMAC-SHA1:HMAC-SHA384:HMAC-SHA512:CURVE25519:SECP256R1:S ECP384R1:SECP521R1:aes256-gcm:chacha20-poly1305:aes256-cbc:aes128-gcm:aes12 8-cbc:SHA256:SHA384:SHA512:SHA224:SHA1:ECDHE-RSA:ECDHE-ECDSA:RSA:DHE-RSA:tl s-version-min=tls1.0:dtls-version-min=dtls1.0:DH-MIN=1023:DSA-MIN=2048:RSA- MIN=2048"
I'm not sure whether removing the p11-kit-proxy related stuff from /etc/crypto-policies/back-ends/nss.config is the right thing to do, but the errors go away after that.
p11-kit-proxy simplifies configuration of HSM modules -- it automatically proxies HSM modules configured in the system.
Either through crypto-policies before F32 or with nss package in F32, nss library configures to import HSM moduels through p11-kit proxy automatically. In F32 nss installs /etc/crypto-policies/local.d/nss-p11-kit.config which contains the configuration that imports p11 kit automatically.
Since opendnssec uses SoftHSM, SoftHSM package is installed and it is automatically loaded into all applications using nss libraries, unless they are specifically configured to ignore p11-kit-proxy.
On a new install, FreeIPA creates /etc/pkcs11/modules/softhsm2.module that disables import of SoftHSM module through p11-kit-proxy. This was done with ticket https://pagure.io/freeipa/issue/7810 in FreeIPA 4.8.0, about a year ago. I guess, your installation was older than F31.
Thank you Alexander for the guidance.
I have removed/backed up the /etc/crypto-policies/local.d/nss-p11-kit.config and regenerated the configuration via update-crypto-policies --set on my F32 FreeIPA servers.
Oddly, I did (and do) have the following file in place:
# cat /etc/pkcs11/modules/softhsm2.module # created by IPA installer module: /usr/lib64/pkcs11/libsofthsm2.so disable-in: p11-kit-proxy
But that didn't make a difference to the errors until I removed /etc/crypto-policies/local.d/nss-p11-kit.config
In a completely fresh install of freeipa-server, f34, my logs are filled with
certmonger[5754]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
On 5/10/21 10:58 AM, Harry Coin via FreeIPA-users wrote:
In a completely fresh install of freeipa-server, f34, my logs are filled with
certmonger[5754]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock _______________________________________________
Just now:
# ipa-server-certinstall -v -w -d --pin= <omitted> -p <omitted> /etc/pki/CA/private/SAN_registry.1.quietfountain.com.pfx May 10 12:54:23 registry1.1.quietfountain.com certutil[14635]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 12:54:25 registry1.1.quietfountain.com pk12util[14647]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 12:54:27 registry1.1.quietfountain.com certutil[14649]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 12:54:27 registry1.1.quietfountain.com certutil[14651]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 12:54:28 registry1.1.quietfountain.com certutil[14653]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 12:54:29 registry1.1.quietfountain.com certutil[14655]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 12:54:29 registry1.1.quietfountain.com certutil[14657]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 12:54:30 registry1.1.quietfountain.com certutil[14659]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 12:54:31 registry1.1.quietfountain.com certutil[14661]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 12:54:31 registry1.1.quietfountain.com certutil[14663]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 12:54:32 registry1.1.quietfountain.com certutil[14665]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
On 5/10/21 10:58 AM, Harry Coin via FreeIPA-users wrote:
In a completely fresh install of freeipa-server, f34, my logs are filled with
certmonger[5754]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
I get similar messages from certutil, certmonger and pk12util
May 10 14:31:21 registry1.1.quietfountain.com certutil[18672]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:22 registry1.1.quietfountain.com certutil[18674]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:23 registry1.1.quietfountain.com certutil[18676]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:25 registry1.1.quietfountain.com certutil[18678]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:25 registry1.1.quietfountain.com certutil[18680]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:26 registry1.1.quietfountain.com certutil[18682]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:27 registry1.1.quietfountain.com certutil[18684]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:28 registry1.1.quietfountain.com pk12util[18686]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:32 registry1.1.quietfountain.com certutil[18688]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:35 registry1.1.quietfountain.com pk12util[18700]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
Hi, this is a known selinux-policy issue, tracked at https://bugzilla.redhat.com/show_bug.cgi?id=1894132 flo
On Mon, May 10, 2021 at 9:42 PM Harry G. Coin via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
On 5/10/21 10:58 AM, Harry Coin via FreeIPA-users wrote:
In a completely fresh install of freeipa-server, f34, my logs are filled
with
certmonger[5754]: usr/lib/api/apiutil.c Could not open
/run/lock/opencryptoki/LCK..APIlock
I get similar messages from certutil, certmonger and pk12util
May 10 14:31:21 registry1.1.quietfountain.com certutil[18672]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:22 registry1.1.quietfountain.com certutil[18674]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:23 registry1.1.quietfountain.com certutil[18676]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:25 registry1.1.quietfountain.com certutil[18678]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:25 registry1.1.quietfountain.com certutil[18680]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:26 registry1.1.quietfountain.com certutil[18682]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:27 registry1.1.quietfountain.com certutil[18684]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:28 registry1.1.quietfountain.com pk12util[18686]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:32 registry1.1.quietfountain.com certutil[18688]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:35 registry1.1.quietfountain.com pk12util[18700]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
On 12/05/2021 08:03, Florence Renaud via FreeIPA-users wrote:
Hi, this is a known selinux-policy issue, tracked at https://bugzilla.redhat.com/show_bug.cgi?id=1894132 https://bugzilla.redhat.com/show_bug.cgi?id=1894132 flo
On Mon, May 10, 2021 at 9:42 PM Harry G. Coin via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org> wrote:
On 5/10/21 10:58 AM, Harry Coin via FreeIPA-users wrote: > In a completely fresh install of freeipa-server, f34, my logs are filled with > > certmonger[5754]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock I get similar messages from certutil, certmonger and pk12util May 10 14:31:21 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18672]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:22 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18674]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:23 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18676]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:25 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18678]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:25 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18680]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:26 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18682]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:27 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18684]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:28 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> pk12util[18686]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:32 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18688]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:35 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> pk12util[18700]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org <https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure <https://pagure.io/fedora-infrastructure>
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
I think this might be the culprit in most recent CentOS updated packages:
sssd-client-2.4.0-9.el8_4.1.x86_64 sssd-common-2.4.0-9.el8_4.1.x86_64 sssd-common-pac-2.4.0-9.el8_4.1.x86_64 sssd-dbus-2.4.0-9.el8_4.1.x86_64 sssd-ipa-2.4.0-9.el8_4.1.x86_64 sssd-kcm-2.4.0-9.el8_4.1.x86_64 sssd-krb5-common-2.4.0-9.el8_4.1.x86_64 sssd-nfs-idmap-2.4.0-9.el8_4.1.x86_64 sssd-tools-2.4.0-9.el8_4.1.x86_64 389-ds-base-1.4.3.16-16.module_el8.4.0+845+0c39e1b7.x86_64 389-ds-base-libs-1.4.3.16-16.module_el8.4.0+845+0c39e1b7.x86_64 ipa-client-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64 ipa-client-common-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-common-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-selinux-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-server-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64 ipa-server-common-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-server-dns-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-server-trust-ad-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64
which updates make existing IPAs upgrade and new installations fail. I too see: ... Stopped PKI Tomcat Server pki-tomcat. Starting PKI Tomcat Server pki-tomcat... usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock Started PKI Tomcat Server pki-tomcat. Java virtual machine used: /usr/lib/jvm/java-1.8.0-openjdk/bin/java classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/jav> main class used: org.apache.catalina.startup.Bootstrap flags used: -Dcom.redhat.fips=false options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.> arguments used: start .. ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='midway.ccn.am.priv.dom', po> ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='midway.ccn.am.priv.dom', po> ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='midway.ccn.am.priv.dom', po> ...skipping... ipa-pki-wait-running: Request failed unexpectedly, 404 Client Error: for url...
Above is from 'pki-tomcatd@pki-tomcat.service'
regards, L.
On Thu, Jul 1, 2021 at 9:34 AM lejeczek via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
On 12/05/2021 08:03, Florence Renaud via FreeIPA-users wrote:
Hi, this is a known selinux-policy issue, tracked at https://bugzilla.redhat.com/show_bug.cgi?id=1894132 https://bugzilla.redhat.com/show_bug.cgi?id=1894132 flo
On Mon, May 10, 2021 at 9:42 PM Harry G. Coin via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org> wrote:
On 5/10/21 10:58 AM, Harry Coin via FreeIPA-users wrote: > In a completely fresh install of freeipa-server, f34, my logs are filled with > > certmonger[5754]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock I get similar messages from certutil, certmonger and pk12util May 10 14:31:21 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18672]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:22 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18674]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:23 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18676]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:25 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18678]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:25 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18680]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:26 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18682]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:27 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18684]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:28 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> pk12util[18686]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:32 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> certutil[18688]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 10 14:31:35 registry1.1.quietfountain.com <http://registry1.1.quietfountain.com> pk12util[18700]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
<
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure <https://pagure.io/fedora-infrastructure>
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure
I think this might be the culprit in most recent CentOS updated packages:
sssd-client-2.4.0-9.el8_4.1.x86_64 sssd-common-2.4.0-9.el8_4.1.x86_64 sssd-common-pac-2.4.0-9.el8_4.1.x86_64 sssd-dbus-2.4.0-9.el8_4.1.x86_64 sssd-ipa-2.4.0-9.el8_4.1.x86_64 sssd-kcm-2.4.0-9.el8_4.1.x86_64 sssd-krb5-common-2.4.0-9.el8_4.1.x86_64 sssd-nfs-idmap-2.4.0-9.el8_4.1.x86_64 sssd-tools-2.4.0-9.el8_4.1.x86_64 389-ds-base-1.4.3.16-16.module_el8.4.0+845+0c39e1b7.x86_64
There have been several reports today of issues upgrading or installing IPA with Centos 8. It seems they are fixing downgrading 389-ds to 1.4.3.16-13 (instead fo 1.4.3.16-16).
HTH,
Rafael
389-ds-base-libs-1.4.3.16-16.module_el8.4.0+845+0c39e1b7.x86_64 ipa-client-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64 ipa-client-common-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-common-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-selinux-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-server-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64 ipa-server-common-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-server-dns-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-server-trust-ad-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64
which updates make existing IPAs upgrade and new installations fail. I too see: ... Stopped PKI Tomcat Server pki-tomcat. Starting PKI Tomcat Server pki-tomcat... usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock Started PKI Tomcat Server pki-tomcat. Java virtual machine used: /usr/lib/jvm/java-1.8.0-openjdk/bin/java classpath used:
/usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/jav>
main class used: org.apache.catalina.startup.Bootstrap flags used: -Dcom.redhat.fips=false options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.> arguments used: start .. ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='midway.ccn.am.priv.dom', po> ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='midway.ccn.am.priv.dom', po> ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='midway.ccn.am.priv.dom', po> ...skipping... ipa-pki-wait-running: Request failed unexpectedly, 404 Client Error: for url...
Above is from 'pki-tomcatd@pki-tomcat.service'
regards, L. _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure
-- Rafael Guterres Jeffman Senior Software Engineer FreeIPA - Red Hat
freeipa-users@lists.fedorahosted.org
-
Alexander Bokovoy -
Anthony Joseph Messina -
Florence Renaud -
Harry Coin -
Harry G. Coin
-
lejeczek -
Rafael Jeffman