Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1600525 - ipa-client-install --uninstall fails to uninstall client.
Summary: ipa-client-install --uninstall fails to uninstall client.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.6
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Michal Reznik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-07-12 12:37 UTC by anuja
Modified: 2018-10-30 10:59 UTC (History)
7 users (show)

Fixed In Version: ipa-4.6.4-5.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-30 10:58:44 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3187 None None None 2018-10-30 10:59:43 UTC

Description anuja 2018-07-12 12:37:34 UTC
Description of problem:

ipa-client-install fails to uninstall

Version-Release number of selected component (if applicable):
ipa-client-4.6.4-2.el7.x86_64

How reproducible:


Steps to Reproduce:

1. install IPA master
2. on client
   add another ip 
   ipa-client-install --hostname --server --domain -p -w -U

   In /etc/sssd/sssd.conf add

   dyndns_update = True
   dyndns_iface = *

   restart sssd.service

5. On master 
   ipa dnsrecord-show clinet.shortname should display both ip

6. on client
   ipa-client-install -U --uninstall



Actual results:
client uninstall fails

Expected results:
client uninstall success

Additional info:
After uninstall fails, subsequent client installation passes but uninsntallation fails

Comment 5 Rob Crittenden 2018-07-16 16:50:06 UTC
What does /var/lib/ipa-client/sysrestore.state contain after the first uninstall?

Be sure this file does NOT exist prior to testing.

Comment 6 anuja 2018-07-24 07:54:59 UTC
Hi Rob,
On client after first uninstall /var/lib/ipa-client/sysrestore.state does not exist.

Comment 7 anuja 2018-07-24 07:58:53 UTC
# tail /var/log/ipaclient-uninstall.log 
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 73, in _uninstall
    for unused in self._uninstaller(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3624, in main
    uninstall(self)
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3346, in uninstall
    raise ScriptError(rval=rv)

2018-07-24T07:51:46Z DEBUG The ipa-client-install command failed, exception: ScriptError: 
2018-07-24T07:51:46Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-uninstall.log for more information


# cat /var/lib/ipa-client/sysrestore.state
cat: /var/lib/ipa-client/sysrestore.state: No such file or directory

Comment 8 anuja 2018-07-24 09:51:39 UTC
Hi Rob,
On client there is sysrestore.state file exist.

# cat /var/lib/ipa-client/sysrestore/sysrestore.state 
[network]
hostname = x.y.z

Comment 9 Rob Crittenden 2018-07-24 11:48:38 UTC
Uh, so it does exist or it doesn't? Comments 6/7 and 8 seem to be in conflict.

If it exists post ipa-client-install --uninstall, particularly with this exact content, then this explains the hostname issue and why behavior is different between the first and subsequent installations.

Comment 10 anuja 2018-07-24 13:11:32 UTC
Yes it exist in path /var/lib/ipa-client/sysrestore/sysrestore.state

Comment 11 Rob Crittenden 2018-07-24 13:23:53 UTC
Upstream ticket:
https://pagure.io/freeipa/issue/7648

Comment 12 Rob Crittenden 2018-07-24 19:50:55 UTC
Fixed upstream:

master: e32cfd14a9559a126e29f8c0215e3e80bf3924f6
ipa-4-6: 8151b69ba40277fe54370f53b05fcf2a55988cab

Comment 14 Michal Reznik 2018-08-13 14:42:50 UTC
Verifying using non-existent hostname.

Failing on ipa-client-4.6.4-3.el7.x86_64:

[root@kvm-02-guest02 ~]# ipa-client-install -p admin -w Secret123 --server master.ipa.test --domain ipa.test --hostname $(hostname).nonexistent -U
WARNING: ntpd time&date synchronization service will not be configured as
conflicting service (chronyd) is enabled
Use --force-ntpd option to disable it and force configuration of ntpd

Client hostname: client.ipa.test.nonexistent
Realm: IPA.TEST
DNS Domain: ipa.test
IPA Server: master.ipa.test
BaseDN: dc=ipa,dc=test

Skipping synchronizing time with NTP server.
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=IPA.TEST
    Issuer:      CN=Certificate Authority,O=IPA.TEST
    Valid From:  2018-08-13 14:23:30
    Valid Until: 2038-08-13 14:23:30

Enrolled in IPA realm IPA.TEST
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm IPA.TEST
trying https://master.ipa.test/ipa/json
[try 1]: Forwarding 'schema' to json server 'https://master.ipa.test/ipa/json'
trying https://master.ipa.test/ipa/session/json
[try 1]: Forwarding 'ping' to json server 'https://master.ipa.test/ipa/session/json'
[try 1]: Forwarding 'ca_is_enabled' to json server 'https://master.ipa.test/ipa/session/json'
Systemwide CA database updated.
Hostname (client.ipa.test.nonexistent) does not have A/AAAA record.
Failed to update DNS records.
Missing A/AAAA record(s) for host client.ipa.test.nonexistent: 10.16.68.108, 2620:52:0:1040:5054:ff:fe41:90ef.
Missing reverse record(s) for address(es): 2620:52:0:1040:5054:ff:fe41:90ef.
Incorrect reverse record(s):
10.16.68.108 is pointing to kvm-02-guest02.rhts.eng.bos.redhat.com. instead of client.ipa.test.nonexistent.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
[try 1]: Forwarding 'host_mod' to json server 'https://master.ipa.test/ipa/session/json'
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring ipa.test as NIS domain.
Client configuration complete.
The ipa-client-install command was successful
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# ipa-client-install --uninstall -U
Unenrolling client from IPA server
Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
Unconfiguring the NIS domain.
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Some installation state for network has not been restored, see /var/lib/ipa/sysrestore/sysrestore.state
Some installation state has not been restored.
This may cause re-installation to fail.
It should be safe to remove /var/lib/ipa-client/sysrestore.state but it may
 mean your system hasn't been restored to its pre-installation state.
Systemwide CA database updated.
Client uninstall complete.
The ipa-client-install command failed. See /var/log/ipaclient-uninstall.log for more information
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# tail /var/log/ipaclient-uninstall.log
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 73, in _uninstall
    for unused in self._uninstaller(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3624, in main
    uninstall(self)
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3346, in uninstall
    raise ScriptError(rval=rv)

2018-08-13T14:36:58Z DEBUG The ipa-client-install command failed, exception: ScriptError: 
2018-08-13T14:36:58Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-uninstall.log for more information
[root@kvm-02-guest02 ~]# 


Verified on ipa-client-4.6.4-5.el7.x86_64.

[root@kvm-02-guest02 ~]# ipa-client-install -p admin -w Secret123 --server master.ipa.test --domain ipa.test --hostname $(hostname).nonexistent -U
WARNING: ntpd time&date synchronization service will not be configured as
conflicting service (chronyd) is enabled
Use --force-ntpd option to disable it and force configuration of ntpd

Client hostname: client.ipa.test.nonexistent
Realm: IPA.TEST
DNS Domain: ipa.test
IPA Server: master.ipa.test
BaseDN: dc=ipa,dc=test

Skipping synchronizing time with NTP server.
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=IPA.TEST
    Issuer:      CN=Certificate Authority,O=IPA.TEST
    Valid From:  2018-08-13 14:23:30
    Valid Until: 2038-08-13 14:23:30

Enrolled in IPA realm IPA.TEST
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm IPA.TEST
trying https://master.ipa.test/ipa/json
[try 1]: Forwarding 'ping' to json server 'https://master.ipa.test/ipa/json'
[try 1]: Forwarding 'ca_is_enabled' to json server 'https://master.ipa.test/ipa/json'
Systemwide CA database updated.
Hostname (client.ipa.test.nonexistent) does not have A/AAAA record.
Failed to update DNS records.
Missing A/AAAA record(s) for host client.ipa.test.nonexistent: 10.16.68.108, 2620:52:0:1040:5054:ff:fe41:90ef.
Missing reverse record(s) for address(es): 2620:52:0:1040:5054:ff:fe41:90ef.
Incorrect reverse record(s):
10.16.68.108 is pointing to kvm-02-guest02.rhts.eng.bos.redhat.com. instead of client.ipa.test.nonexistent.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
[try 1]: Forwarding 'host_mod' to json server 'https://master.ipa.test/ipa/json'
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring ipa.test as NIS domain.
Client configuration complete.
The ipa-client-install command was successful
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# ipa-client-install --uninstall -U
Unenrolling client from IPA server
Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
Unconfiguring the NIS domain.
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Systemwide CA database updated.
Client uninstall complete.
The ipa-client-install command was successful
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# 
[root@kvm-02-guest02 ~]# tail /var/log/ipaclient-uninstall.log
2018-08-13T14:38:26Z DEBUG stderr=
2018-08-13T14:38:26Z DEBUG Restart of sshd.service complete
2018-08-13T14:38:26Z DEBUG Starting external process
2018-08-13T14:38:26Z DEBUG args=/usr/bin/update-ca-trust
2018-08-13T14:38:27Z DEBUG Process finished, return code=0
2018-08-13T14:38:27Z DEBUG stdout=
2018-08-13T14:38:27Z DEBUG stderr=
2018-08-13T14:38:27Z INFO Systemwide CA database updated.
2018-08-13T14:38:27Z INFO Client uninstall complete.
2018-08-13T14:38:27Z INFO The ipa-client-install command was successful
[root@kvm-02-guest02 ~]#

Comment 17 errata-xmlrpc 2018-10-30 10:58:44 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3187


Note You need to log in before you can comment on or make changes to this bug.