Marc Schlinger wrote:
Hello all,

I have juste spotted a bug during ipa server installation process

While configuring the CA server the installation crash if the
DirectoryManager password contains parenthesis "("

The version I tried to install is
ipa-server-1.9.0GITe42d3bc-0.ufo2.i686.rpm


This is this command which failed with:
-bash: syntax error near unexpected token `('

java -cp
/usr/share/java/silent.jar:/usr/lib/java/jss4.jar:/usr/share/java/ldapjdk.jar:/usr/share/java/pki/certsrv.jar:/usr/share/java/pki/cmscore.jar:/usr/share/java/pki/nsutil.jar:/usr/share/java/pki/cmsutil.jar:/usr/share/java/pkitools.jar:/usr/share/java/cstools.jar:/usr/share/java/pki/cstools.jar:/usr/share/pki/classes:/usr/share/java/xml-commons-resolver.jar:/usr/share/java/xerces-j2.jar:/usr/lib/java/osutil.jar:
ConfigureCA -cs_hostname ipa-server.beta.agorabox.org -cs_port 9445
-client_certdb_dir /tmp/tmp-PNQa1v -client_certdb_pwd XXXXXXX -preop_pin
MCOs0y2x2uBprJLhxDe7 -domain_name IPA -admin_user admin -admin_email
r...@localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent
-agent_key_size 2048 -agent_key_type rsa -agent_cert_subject
"CN=ipa-ca-agent,O=IPA" -ldap_host ipa-server.beta.agorabox.org
-ldap_port 7389 -bind_dn "cn=Directory Manager" -bind_password XXXXXXXX
-base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa
-key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX
-subsystem_name pki-cad -token_name internal
-ca_subsystem_cert_subject_name "CN=CA Subsystem,O=IPA"
-ca_ocsp_cert_subject_name "CN=OCSP Subsystem,O=IPA"
-ca_server_cert_subject_name "CN=ipa-server.beta.agorabox.org,O=IPA"
-ca_audit_signing_cert_subject_name "CN=CA Audit,O=IPA"
-ca_sign_cert_subject_name "CN=Certificate Authority,O=IPA" -external
false -clone false

Should't the passwords be quoted ?

Thanks for all,



Marc Schlinger


# Installation output

Directory Manager password:
Password (confirm):

The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.

IPA admin password:
Password (confirm):


The following operations may take some minutes to complete.
Please wait until the prompt is returned.

Configuring directory server for the CA:
[1/4]: creating directory server user
[2/4]: creating directory server instance
[3/4]: configuring directory to start on boot
[4/4]: restarting directory server
done configuring pkids.
Configuring certificate server:
[1/15]: creating certificate server user
[2/15]: restarting certificate server
[3/15]: configuring certificate server instance
root : CRITICAL failed to restart ca instance Command '/usr/bin/perl
/usr/bin/pkisilent ConfigureCA -cs_hostname ipa-server.beta.agorabox.org
-cs_port 9445 -client_certdb_dir /tmp/tmp-PNQa1v -client_certdb_pwd
XXXXXXXX -preop_pin MCOs0y2x2uBprJLhxDe7 -domain_name IPA -admin_user
admin -admin_email r...@localhost -admin_password XXXXXXXX -agent_name
ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa
-agent_cert_subject "CN=ipa-ca-agent,O=IPA" -ldap_host
ipa-server.beta.agorabox.org -ldap_port 7389 -bind_dn "cn=Directory
Manager" -bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca
-key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true
-backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal
-ca_subsystem_cert_subject_name "CN=CA Subsystem,O=IPA"
-ca_ocsp_cert_subject_name "CN=OCSP Subsystem,O=IPA"
-ca_server_cert_subject_name "CN=ipa-server.beta.agorabox.org,O=IPA"
-ca_audit_signing_cert_subject_name "CN=CA Audit,O=IPA"
-ca_sign_cert_subject_name "CN=Certificate Authority,O=IPA" -external
false -clone false' returned non-zero exit status 255
[4/15]: restarting certificate server
[5/15]: creating CA agent PKCS#12 file in /root
Unexpected error - see ipaserver-install.log for details:
Command '/usr/bin/pk12util -n ipa-ca-agent -o /root/ca-agent.p12 -d
/tmp/tmp-PNQa1v -k /tmp/tmpCuiRb3 -w /tmp/tmpCuiRb3' returned non-zero
exit status 24

Yes, I guess it wouldn't hurt to quote the passwords. We call exec() so avoid bash but it gets invoked later down the line by pkisilent so it gets interpreted. I'll open a ticket in our trac instance for this.

rob

_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Reply via email to