[Freeipa-users] Bug in ipa-server-install

[Marc Schlinger]

Hello all,

I have juste spotted a bug during ipa server installation process

While configuring the CA server the installation crash if the 
DirectoryManager password contains parenthesis "("

The version I tried to install is ipa-server-1.9.0GITe42d3bc-0.ufo2.i686.rpm


This is this command which failed with:
-bash: syntax error near unexpected token `('

java -cp 
/usr/share/java/silent.jar:/usr/lib/java/jss4.jar:/usr/share/java/ldapjdk.jar:/usr/share/java/pki/certsrv.jar:/usr/share/java/pki/cmscore.jar:/usr/share/java/pki/nsutil.jar:/usr/share/java/pki/cmsutil.jar:/usr/share/java/pkitools.jar:/usr/share/java/cstools.jar:/usr/share/java/pki/cstools.jar:/usr/share/pki/classes:/usr/share/java/xml-commons-resolver.jar:/usr/share/java/xerces-j2.jar:/usr/lib/java/osutil.jar: 
ConfigureCA -cs_hostname ipa-server.beta.agorabox.org -cs_port 9445 
-client_certdb_dir /tmp/tmp-PNQa1v -client_certdb_pwd XXXXXXX -preop_pin 
MCOs0y2x2uBprJLhxDe7 -domain_name IPA -admin_user admin -admin_email 
root at localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent 
-agent_key_size 2048 -agent_key_type rsa -agent_cert_subject 
"CN=ipa-ca-agent,O=IPA" -ldap_host ipa-server.beta.agorabox.org 
-ldap_port 7389 -bind_dn "cn=Directory Manager" -bind_password XXXXXXXX 
-base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa 
-key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX 
-subsystem_name pki-cad -token_name internal 
-ca_subsystem_cert_subject_name "CN=CA Subsystem,O=IPA" 
-ca_ocsp_cert_subject_name "CN=OCSP Subsystem,O=IPA" 
-ca_server_cert_subject_name "CN=ipa-server.beta.agorabox.org,O=IPA" 
-ca_audit_signing_cert_subject_name "CN=CA Audit,O=IPA" 
-ca_sign_cert_subject_name "CN=Certificate Authority,O=IPA" -external 
false -clone false

Should't the passwords be quoted ?

Thanks for all,



Marc Schlinger


# Installation output

Directory Manager password:
Password (confirm):

The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.

IPA admin password:
Password (confirm):


The following operations may take some minutes to complete.
Please wait until the prompt is returned.

Configuring directory server for the CA:
   [1/4]: creating directory server user
   [2/4]: creating directory server instance
   [3/4]: configuring directory to start on boot
   [4/4]: restarting directory server
done configuring pkids.
Configuring certificate server:
   [1/15]: creating certificate server user
   [2/15]: restarting certificate server
   [3/15]: configuring certificate server instance
root        : CRITICAL failed to restart ca instance Command 
'/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname 
ipa-server.beta.agorabox.org -cs_port 9445 -client_certdb_dir 
/tmp/tmp-PNQa1v -client_certdb_pwd XXXXXXXX -preop_pin 
MCOs0y2x2uBprJLhxDe7 -domain_name IPA -admin_user admin -admin_email 
root at localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent 
-agent_key_size 2048 -agent_key_type rsa -agent_cert_subject 
"CN=ipa-ca-agent,O=IPA" -ldap_host ipa-server.beta.agorabox.org 
-ldap_port 7389 -bind_dn "cn=Directory Manager" -bind_password XXXXXXXX 
-base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa 
-key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX 
-subsystem_name pki-cad -token_name internal 
-ca_subsystem_cert_subject_name "CN=CA Subsystem,O=IPA" 
-ca_ocsp_cert_subject_name "CN=OCSP Subsystem,O=IPA" 
-ca_server_cert_subject_name "CN=ipa-server.beta.agorabox.org,O=IPA" 
-ca_audit_signing_cert_subject_name "CN=CA Audit,O=IPA" 
-ca_sign_cert_subject_name "CN=Certificate Authority,O=IPA" -external 
false -clone false' returned non-zero exit status 255
   [4/15]: restarting certificate server
   [5/15]: creating CA agent PKCS#12 file in /root
Unexpected error - see ipaserver-install.log for details:
  Command '/usr/bin/pk12util -n ipa-ca-agent -o /root/ca-agent.p12 -d 
/tmp/tmp-PNQa1v -k /tmp/tmpCuiRb3 -w /tmp/tmpCuiRb3' returned non-zero 
exit status 24