Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1513041 - ipa-restore does not enable/start oddjobd
Summary: ipa-restore does not enable/start oddjobd
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.4
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: ipa-qe
Depends On:
TreeView+ depends on / blocked
Reported: 2017-11-14 16:10 UTC by Florence Blanc-Renaud
Modified: 2018-10-30 10:58 UTC (History)
8 users (show)

Fixed In Version: ipa-4.6.4-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2018-10-30 10:57:10 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3187 None None None 2018-10-30 10:58:17 UTC

Description Florence Blanc-Renaud 2017-11-14 16:10:18 UTC
This bug is created as a clone of upstream ticket:

After running ipa-restore, the service oddjobd is not restarted. This means that domain-level1 replica installation will fail during ipa-replica-conncheck because this step is using oddjob to start the process ipa-replica-conncheck on the master.

How to reproduce:
1. install ipa server with `ipa-server-install`
2. perform a backup with `ipa-backup`
3. uninstall the server with `ipa-server-install --uninstall -U`
4. restore the server with `ipa-restore /path/to/backup`
5. try to configure a replica with `ipa-replica-install --server $MASTER`

The replica installation fails in the conncheck step with the following output:

    Client configuration complete.
    The ipa-client-install command was successful
    Checking DNS forwarders, please wait ...
    Run connection check to master
    Removing client side components
    Unenrolling client from IPA server
    Removing Kerberos service principals from /etc/krb5.keytab
    Disabling client Kerberos and LDAP configurations
    Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
    Restoring client configuration files
    Unconfiguring the NIS domain.
    nscd daemon is not installed, skip configuration
    nslcd daemon is not installed, skip configuration
    Systemwide CA database updated.
    Client uninstall complete.
    The ipa-client-install command was successful
    Your system may be partly configured.
    Run /usr/sbin/ipa-server-install --uninstall to clean up.
    ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR    Connection check failed!
    See /var/log/ipareplica-conncheck.log for more information.
    If the check results are not valid it can be skipped with --skip-conncheck parameter.
    ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR    The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

Content of ipareplication-install.log:

    2017-11-02T09:25:35Z DEBUG Starting external process
    2017-11-02T09:25:35Z DEBUG args=/usr/sbin/ipa-replica-conncheck --master --auto-master-check --realm DOMAIN.COM --hostname --principal admin --password XXXXXXXX --ca-cert-file /etc/ipa/ca.crt
    2017-11-02T09:25:39Z DEBUG Process finished, return code=1
    2017-11-02T09:25:39Z DEBUG stdout=
    2017-11-02T09:25:39Z DEBUG stderr=Check connection from replica to remote master '':
       Directory Service: Unsecure port (389): OK
       Directory Service: Secure port (636): OK
       Kerberos KDC: TCP (88): OK
       Kerberos Kpasswd: TCP (464): OK
       HTTP Server: Unsecure port (80): OK
       HTTP Server: Secure port (443): OK
    The following list of ports use UDP protocoland would need to be
    checked manually:
       Kerberos KDC: UDP (88): SKIPPED
       Kerberos Kpasswd: UDP (464): SKIPPED
    Connection from replica to master is OK.
    Start listening on required ports for remote master check
    Get credentials to log in to remote master
    Check RPC connection to remote master
    [try 1]: Forwarding 'ping/1' to json server ''
    Execute check on remote master
    [try 1]: Forwarding 'server_conncheck' to json server ''
    ERROR: Remote master check failed with following error message(s):
    an internal error has occurred
    2017-11-02T09:25:39Z DEBUG Starting external process
    2017-11-02T09:25:39Z DEBUG args=/usr/sbin/ipa-client-install --unattended --uninstall

If the service oddjobd is manually restarted + enabled on the master (with `systemctl enable oddjobd` and `systemctl start oddjobd`), the replica-conncheck step succeeds.

Comment 4 Florence Blanc-Renaud 2018-02-20 08:45:21 UTC
Fixed upstream

    97938e9 Enable and start oddjobd after ipa-restore

Comment 6 Sudhir Menon 2018-08-24 14:07:42 UTC
1. Replica install doesn't fail 
2. oddjobd service is up and running as well.

Verified on Red Hat Enterprise Linux Server release 7.6 Beta (Maipo) using

[root@master ~]# rpm -q ipa-server sssd samba krb5-server pki-server selinux-policy 389-ds-base

[root@master ~]# ipa-backup 
Preparing backup on master.apollo.test
Stopping IPA services
Backing up ipaca in APOLLO-TEST to LDIF
Backing up userRoot in APOLLO-TEST to LDIF
Backing up APOLLO-TEST
Backing up files
Backed up to /var/lib/ipa/backup/ipa-full-2018-08-24-17-24-59
Starting IPA service
The ipa-backup command was successful

[root@master ~]# ipa-server-install --uninstall -U
Client uninstall complete.
The ipa-client-install command was successful

[root@master ~]# ipa-restore /var/lib/ipa/backup/ipa-full-2018-08-24-17-24-59/
Preparing restore from /var/lib/ipa/backup/ipa-full-2018-08-24-17-24-59/ on master.apollo.test
Performing FULL restore from FULL backup
Temporary setting umask to 022
Restoring data will overwrite existing live data. Continue to restore? [no]: yes
Each master will individually need to be re-initialized or
re-created from this one. The replication agreements on
masters running IPA 3.1 or earlier will need to be manually
re-enabled. See the man page for details.
Disabling all replication.
Unable to get connection, skipping disabling agreements: directory server instance is not running/configured
Stopping IPA services
Configuring certmonger to stop tracking system certificates for CA
Restoring files
Systemwide CA database updated.
Restoring from userRoot in APOLLO-TEST
Restoring from ipaca in APOLLO-TEST
Restarting GSS-proxy
Starting IPA services
Restarting SSSD
Restarting oddjobd
Restoring umask to 18
The ipa-restore command was successful

[root@master ~]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
ipa: INFO: The ipactl command was successful

[root@client ~]# ipa-replica-install --principal admin --admin-password Secret123 
Run connection check to master
Connection check OK
Starting replication, please wait until this has completed.
Update in progress, 16 seconds elapsed
Update succeeded
Finalize replication settings
Restarting the KDC

===replica-install log file===
2018-08-24T14:01:56Z DEBUG stderr=
2018-08-24T14:01:56Z DEBUG Restart of ipa.service complete
2018-08-24T14:01:56Z INFO The ipa-replica-install command was successful

[root@client ~]# systemctl status oddjobd
● oddjobd.service - privileged operations for unprivileged applications
   Loaded: loaded (/usr/lib/systemd/system/oddjobd.service; enabled; vendor preset: disabled)
   Active: active (running) since Fri 2018-08-24 09:59:06 EDT; 6min ago

Comment 7 Florence Blanc-Renaud 2018-08-27 07:48:10 UTC
Note that there is upstream automation for this issue:

Comment 9 errata-xmlrpc 2018-10-30 10:57:10 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

Note You need to log in before you can comment on or make changes to this bug.