Your message dated Thu, 24 Mar 2022 13:21:08 +0100
with message-id <[email protected]>
and subject line Re: Bug#1008195: Joining a domain fails on chrony.service in
all scenarios
has caused the Debian Bug report #1008195,
regarding Joining a domain fails on chrony.service in all scenarios
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1008195: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008195
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: freeipa-client
Version: 4.9.8-1+b1
Despite several attempts to fix it [1][2], interaction with chrony is still
broken on current Debian testing.
freeipa-client Recommends: chrony, so it is installed by default. Trying to
join a domain on a clean system:
| # ipa-client-install --domain cockpit.lan --realm COCKPIT.LAN --principal
admin -W
| This program will set up IPA client.
| Version 4.9.8
|
| WARNING: conflicting time&date synchronization service 'ntp' will be disabled
in favor of chronyd
|
| Discovery was successful!
| Do you want to configure chrony with NTP server or pool address? [no]: yes
| Enter NTP source server addresses separated by comma, or press Enter to skip:
| Enter a NTP source pool address, or press Enter to skip:
| Client hostname: x0.cockpit.lan
| Realm: COCKPIT.LAN
| DNS Domain: cockpit.lan
| IPA Server: f0.cockpit.lan
| BaseDN: dc=cockpit,dc=lan
|
| Continue to configure the system with these values? [no]: yes
| Synchronizing time
| No SRV records of NTP servers found and no NTP server or pool address was
provided.
| Using default chrony configuration.
| CalledProcessError(Command ['/bin/systemctl', 'restart', 'chrony.service']
returned non-zero exit status 1: 'Failed to restart chrony.service: Unit
chrony.service is masked.\n')
| The ipa-client-install command failed. See /var/log/ipaclient-install.log for
more information
ipaclient-install.log doesn't really say anything different, it just has a
large traceback for essentially the same thing.
Now, the chrony package is indeed rather weird/broken:
| root@x0:~# find /etc/systemd -name '*chrony*' | xargs ls -l
| lrwxrwxrwx 1 root root 9 Mar 24 05:54 /etc/systemd/system/chrony.service ->
/dev/null
| lrwxrwxrwx 1 root root 34 Mar 23 04:31 /etc/systemd/system/chronyd.service ->
/lib/systemd/system/chrony.service
| lrwxrwxrwx 1 root root 34 Mar 23 04:31
/etc/systemd/system/multi-user.target.wants/chrony.service ->
/lib/systemd/system/chrony.service
| # systemctl status chrony chronyd
| Warning: The unit file, source configuration file or drop-ins of
chronyd.service changed on disk. Run 'systemctl daemon-reload' to relo>
| ○ chrony.service
| Loaded: masked (Reason: Unit chrony.service is masked.)
| Active: inactive (dead)
|
| ○ chronyd.service
| Loaded: error (Reason: Unit chronyd.service failed to load properly,
please adjust/correct and reload service manager: File exists)
| Active: inactive (dead)
Again, this is unconfigured and out of the box -- the idea is that FreeIPA
sets up everything and configures NTP/chrony/etc. to listen to the FreeIPA
server.
Purging chrony doesn't really help, though:
| dpkg -P chrony
| # no '*chrony*' files in /etc any more
Exactly the same failure, and it still tries to configure chrony even though
it's not there any more:
| WARNING: conflicting time&date synchronization service 'ntp' will be disabled
in favor of chronyd
|
| Discovery was successful!
| Do you want to configure chrony with NTP server or pool address? [no]: yes
| Enter NTP source server addresses separated by comma, or press Enter to skip:
| Enter a NTP source pool address, or press Enter to skip:
| Client hostname: x0.cockpit.lan
| Realm: COCKPIT.LAN
| DNS Domain: cockpit.lan
| IPA Server: f0.cockpit.lan
| BaseDN: dc=cockpit,dc=lan
|
| Continue to configure the system with these values? [no]: yes
| Synchronizing time
| No SRV records of NTP servers found and no NTP server or pool address was
provided.
| Using default chrony configuration.
| CalledProcessError(Command ['/bin/systemctl', 'restart', 'chrony.service']
returned non-zero exit status 5: 'Failed to restart chrony.service: Unit
chrony.service not found.\n')
| The ipa-client-install command failed. See /var/log/ipaclient-install.log for
more information
And even if I say "no" to the NTP question:
| # ipa-client-install --domain cockpit.lan --realm COCKPIT.LAN --principal
admin -W
| This program will set up IPA client.
| Version 4.9.8
|
| WARNING: conflicting time&date synchronization service 'ntp' will be disabled
in favor of chronyd
|
| Discovery was successful!
| Do you want to configure chrony with NTP server or pool address? [no]:
| Client hostname: x0.cockpit.lan
| Realm: COCKPIT.LAN
| DNS Domain: cockpit.lan
| IPA Server: f0.cockpit.lan
| BaseDN: dc=cockpit,dc=lan
|
| Continue to configure the system with these values? [no]: yes
| Synchronizing time
| No SRV records of NTP servers found and no NTP server or pool address was
provided.
| Using default chrony configuration.
| CalledProcessError(Command ['/bin/systemctl', 'restart', 'chrony.service']
returned non-zero exit status 5: 'Failed to restart chrony.service: Unit
chrony.service not found.\n')
| The ipa-client-install command failed. See /var/log/ipaclient-install.log for
more information
There's probably two bugs -- chrony having a broken default config, and
ipa-client-install not being able to detect and handle it. But at this point
I'm not even sure what *should* happen.
Note: I'm testing this in the context of https://cockpit-project.org/, which
doesn't call ipa-client-install directly, but `realm join`. That calls
ipa-client-install with --force-ntpd, but the underlying bug reproduces with
the more direct ipa-client-install CLI as well in all combinations.
Thanks,
Martin
[1] https://bugs.debian.org/968428
[2] https://launchpad.net/bugs/1890786
--- End Message ---
--- Begin Message ---
Hello,
I was chasing this some more, as Timo asked in the corresponding Ubuntu bug [1].
Turns out this was because we install the "systemd-timesyncd" package into our
VMs. This conflicts with the "chronyd" package, so it was in state "deinstall
ok config-files", and installing that package creates the
/etc/systemd/system/chrony.service -> /dev/null
mask symlink.
So, this is not a bug after all, just my confusion. Sorry for the noise!
Martin
--- End Message ---
