ipa-client-install fails at certutil stage because /etc/pki doesn't exist

[Stephan Rügamer]

Dear Colleagues,

ipa-client-install fails at the import stage of the freeipa server cert.

Created /etc/ipa/default.conf
New SSSD config will be created.
Configured /etc/sssd/sssd.conf
Traceback (most recent call last):
  File "/usr/sbin/ipa-client-install", line 1292, in <module>
    sys.exit(main())
  File "/usr/sbin/ipa-client-install", line 1279, in main
    rval = install(options, env, fstore, statestore)
  File "/usr/sbin/ipa-client-install", line 1124, in install
    run(["/usr/bin/certutil", "-A", "-d", "/etc/pki/nssdb", "-n", "IPA CA", "-t", "CT,C,C", "-a", "-i", "/etc/ipa/ca.crt"])
  File "/usr/lib/python2.7/dist-packages/ipapython/ipautil.py", line 273, in run
    raise CalledProcessError(p.returncode, args)
subprocess.CalledProcessError: Command '/usr/bin/certutil -A -d /etc/pki/nssdb -n IPA CA -t CT,C,C -a -i /etc/ipa/ca.crt' returned non-zero exit status 255

It looks like the patch create_client_dirs.patch needs to be refreshed to:

1. check if /etc/pki exists
2. if not, create it

this is important especially for debian and ubuntu, because /etc/pki is/was fedora/rhel specific

Regards,

\sh

[Stephan Rügamer (sruegamer)]

Well

this patch is not the right location.

We should create this directory in debian/rules

[Stephan Rügamer (sruegamer)]

The attached branch has the right bugfix.

I tested in on my local installations and it works like a charm.
Certutil call of ipa-client-install won't fail anymore on this missing directory.

[Timo Aaltonen (tjaalton)]

Thanks for the patch. Unfortunately, I'm afraid that can't be added to the freeipa packaging since it really belongs in nss, see Debian bug 537866:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=537866

[Timo Aaltonen (tjaalton)]

nss should create the nssdb hierarchy

[Stephan Rügamer (sruegamer)]

What do you think we can have a fix for this from debian, or should we go ahead and do it on ubuntu first?

[Timo Aaltonen (tjaalton)]

Preferably in debian first, since I'm not sure what possible issues it might bring. Need to discuss it with Mike.

[Timo Aaltonen (tjaalton)]

I've got a patch that generates empty db's during package build, need to polish it and send to debian.

[Timo Aaltonen (tjaalton)]

uploaded a new nss to the freeipa ppa that adds support for nssdb:

https://launchpad.net/~freeipa/+archive/ppa

only for precise, guess that's what people are testing with.. so please test if it works with ipa-client-install.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[[e-mail] (dylan-q)]

Hi,

When will we see this bug fix in ubuntu?

Thanks!

[Timo Aaltonen (tjaalton)]

it's actually fixed in trusty

[Stephan Rügamer (sruegamer)]

@Timo: This fix in trusty is good, but doesn't help.
The ipa-client after 12.04 LTS are not compatible anymore with the working IPA server from RHEL.
This client can't talk to an older IPA master server....so 12.04 LTS is still stucked.

RH doesn't plan to update IPA Server to a new version.

[Timo Aaltonen (tjaalton)]

nothing I can do about that

but you should be able to pass options to ipa-client-install to disable the new features