freeipa

#9862 Update breaks krb5.conf if modified
Closed: fixed by sumenon. Opened by pbrideau.

Closed: fixed
Reopen Issue

Issue

I have this problem for about two years now, and finally decided to open an issue about it.

When FreeIPA is updated, the /etc/krb5.conf file is modified, and is no longer valid: The dbmodules section is commented out and then added weirdly to the plugins section.

Before FreeIPA update:

[...]
[dbmodules]
    VAGRANT.EXAMPLE.COM = {
        db_library = ipadb.so
    }
[plugins]
    certauth = {
        enable_only = ipakdb
        module = ipakdb:kdb/ipadb.so
    }

After FreeIPA update:

[...]
[dbmodules]
#    VAGRANT.EXAMPLE.COM = {
#        db_library = ipadb.so
#    }
[plugins]
    certauth = {
        enable_only = ipakdb
        module = ipakdb:kdb/ipadb.so
    }
VAGRANT.EXAMPLE.COM = {
     db_library = ipadb.so
 }

After the update, the krb5.conf file is no longer valid, and the FreeIPA service cannot restart successfully.

Steps to Reproduce

  1. Modify the content of /etc/krb5.conf (indentation? see additional info)
  2. Update FreeIPA

Actual behavior

FreeIPA does not restart after an update

Expected behavior

FreeIPA should restart after an update

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.12.2-14.el9_6.5.x86_64
ipa-client-4.12.2-14.el9_6.5.x86_64
389-ds-base-2.6.1-11.el9_6.x86_64
package pki-ca is not installed
krb5-server-1.21.1-8.el9_6.x86_64

Additional info:

I manage my /etc/krb5.conf file with puppet. The content of the file is still the same, even the sections order, but the only difference I find is the indentation of the content, and a missing \n after the dbmodules section. Here is the full content of my krb5.conf after puppet has provisionned it:

# This file is managed by Puppet. DO NOT EDIT.
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
    default = FILE:/var/log/krb5libs.log
    admin_server = FILE:/var/log/kadmind.log
    kdc = FILE:/var/log/krb5kdc.log
[libdefaults]
    default_realm = VAGRANT.EXAMPLE.COM
    default_ccache_name = KEYRING:persistent:%{uid}
    dns_canonicalize_hostname = false
    dns_lookup_kdc = true
    dns_lookup_realm = false
    udp_preference_limit = 0
    forwardable = true
    rdns = false
[realms]
    VAGRANT.EXAMPLE.COM = {
        default_domain = vagrant.example.com
        kpasswd_server = vdgl0-freeipa-x01.vagrant.example.com:464
        admin_server = vdgl0-freeipa-x01.vagrant.example.com:749
        admin_server = vdgl0-freeipa-x02.vagrant.example.com:749
        kdc = vdgl0-freeipa-x01.vagrant.example.com:88
        kdc = vdgl0-freeipa-x02.vagrant.example.com:88
        pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
        pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem    
    }
[domain_realm]
    .vagrant.example.com = VAGRANT.EXAMPLE.COM
    vagrant.example.com = VAGRANT.EXAMPLE.COM
    vdgl0-freeipa-x01.vagrant.example.com = VAGRANT.EXAMPLE.COM
[dbmodules]
    VAGRANT.EXAMPLE.COM = {
        db_library = ipadb.so
    }
[plugins]
    certauth = {
        enable_only = ipakdb
        module = ipakdb:kdb/ipadb.so
    }

There is an old issue that may also be a potential fix this problem also: https://pagure.io/freeipa/issue/5913

Can you attach your krb5.conf rather than pasting it? That will let us better see the white spacing (e.g. there could be tabs).

I'm guessing your issue is related to this line:
https://github.com/freeipa/freeipa/blob/master/ipaserver/install/server/upgrade.py#L246

Augeas is used in other places for krb5.conf. I'm not sure if dbmodules is an oversight or at some point it was found to not work.

This particular code dates back to 2012 so it could also be that we moved to Augeas afterward.

Thanks for the quick reply. Sorry I deleted the last comment. I uploaded the wrong config: it was the client config, not the server config.

Here is the attached file of the server config
krb5.conf

Metadata Update from @rcritten:
- Issue assigned to rcritten

https://github.com/freeipa/freeipa/pull/7980

master:

  • 9605ea9a0b1f190f931e0b491b8ccb9146fa409d Use Augeas when updating dbmodules in krb5.conf

ipa-4-12:

  • 611c9b3e735a56fa6bd91ca2dcf31c131cf788ff Use Augeas when updating dbmodules in krb5.conf

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.