Mark, I am going no where with this. I am going to try with latest OpenStack
build (build internal to my company) that has HA support. I will keep you
posted.
On Thursday, October 9, 2014 10:46 PM, Mark Kirkwood
<mark.kirkw...@catalyst.net.nz> wrote:
Oh, I see. That complicates it a wee bit (looks back at your messages).
I see you have:
rgw_keystone_url = http://192.0.8.2:5000
So you'll need to amend/create etc a
<Virtualhost *:5000>
and put it in there. I suspect you might be better off changing your rgw
kesytone url to use port 35357 (the public one). However I think that is
a side issue.
Also just to double check - 192.0.8.2 *is* the server you are showing us
the sites-available from?
Cheers
Mark
On 10/10/14 12:50, lakshmi k s wrote:
> Yes Mark, but there is no keystone.conf in this modified Openstack code.
> There is only horizon.conf under /etc/apache2/sites-available folder.
> And that has virtual host 80 only. Should I simply add :35357?
>
> root@overcloud-controller0-fjvtpqjip2hl
> <mailto:root@overcloud-controller0-fjvtpqjip2hl>:/etc/apache2/sites-available#
> ls
> 000-default.conf default-ssl.conf horizon.conf
>
>
>
>
> On Thursday, October 9, 2014 4:45 PM, Mark Kirkwood
> <mark.kirkw...@catalyst.net.nz> wrote:
>
>
> Hmm - It looks to me like you added the chunked request into Horizon
> instead of Keystone. You want virtual host *:35357
>
>
> On 10/10/14 12:32, lakshmi k s wrote:
> > Have done this too, but in vain. I made changes to Horizon.conf as shown
> > below. I had only I do not see the user being validated in radosgw log
> > at all.
> >
> > root@overcloud-controller0-fjvtpqjip2hl
> <mailto:root@overcloud-controller0-fjvtpqjip2hl>:/etc/apache2/sites-available#
> ls
> > 000-default.conf default-ssl.conf horizon.conf
> >
> > ----------------------------------------------------
> > <VirtualHost *:80>
> > WSGIScriptAlias /
> >
> /opt/stack/venvs/horizon/lib/python2.7/site-packages/openstack_dashboard/wsgi/django.wsgi
> > WSGIDaemonProcess horizon user=horizon group=horizon processes=3
> > threads=10 home=/opt/stack/venvs/horizon
> >
> python-path=/opt/stack/venvs/horizon:/opt/stack/venvs/horizon/lib/python2.7/site-packages/
> > WSGIApplicationGroup %{GLOBAL}
> >
> > SetEnv APACHE_RUN_USER horizon
> > SetEnv APACHE_RUN_GROUP horizon
> > WSGIProcessGroup horizon
> > WSGIChunkedRequest On
> >
> > DocumentRoot
> >
> /opt/stack/venvs/horizon/lib/python2.7/site-packages/openstack_dashboard/static
> > Alias /static
> >
> /opt/stack/venvs/horizon/lib/python2.7/site-packages/openstack_dashboard/static
> > Alias /media
> >
> /opt/stack/venvs/horizon/lib/python2.7/site-packages/openstack_dashboard/static
> >
> > <Directory />
> > Options FollowSymLinks
> > AllowOverride None
> > </Directory>
> >
> > <Directory
> >
> /opt/stack/venvs/horizon/lib/python2.7/site-packages/openstack_dashboard/static>
> > Options Indexes FollowSymLinks MultiViews
> > Require all granted
> > AllowOverride None
> > Order allow,deny
> > allow from all
> > </Directory>
> >
> > <Directory
> > /opt/stack/venvs/horizon/lib/python2.7/site-packages/openstack_dashboard>
> > Options Indexes FollowSymLinks MultiViews
> > Require all granted
> > AllowOverride None
> > Order allow,deny
> > allow from all
> > </Directory>
> >
> > ErrorLog /var/log/httpd/horizon_error.log
> > LogLevel debug
> > CustomLog /var/log/httpd/horizon_access.log combined
> > </VirtualHost>
> >
> > WSGISocketPrefix /var/run/httpd
> >
> > ----------------------------------
> >
> >
> >
> >
> > On Thursday, October 9, 2014 3:51 PM, Mark Kirkwood
> > <mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>> wrote:
> >
> >
> > No, I don't have any explicit ssl enabled in the rgw site.
> >
> > Now you might be running into http://tracker.ceph.com/issues/7796
> > <http://tracker.ceph.com/issues/7796>. So
> > check if you have enabled
> >
> > WSGIChunkedRequest On
> >
> > In your keystone virtualhost setup (explained in the issue).
> >
> > Cheers
> >
> > Mark
> >
> >
> > On 10/10/14 11:03, lakshmi k s wrote:
> > > Right, I have these certs on both nodes - keystone node and rgw
> gateway
> > > node. Not sure where I am going wrong. And what about SSL? Should the
> > > following be in rgw.conf in gateway node? I am not using this as
> it was
> > > optional.
> > >
> > > SSLEngine on
> > > SSLCertificateFile /etc/apache2/ssl/apache.crt
> > > SSLCertificateKeyFile /etc/apache2/ssl/apache.key
> > > SetEnv SERVER_PORT_SECURE 443
> > >
> > >
> > >
> > >
> > >
> > > On Thursday, October 9, 2014 2:48 PM, Mark Kirkwood
> > > <mark.kirkw...@catalyst.net.nz <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>> wrote:
> > >
> > >
> > > Almost - the converted certs need to be saved on your *rgw* host in
> > > nss_db_path (default is /var/ceph/nss but wherever you have it
> > > configured should be ok). Then restart the gateway.
> > >
> > > What is happening is the the rgw needs these certs to speak with
> > > encryption to the keystone server (the latter does not need anything
> > > changed, as it is already using encryption).
> > >
> > > Regards
> > >
> > > Mark
> > >
> > > On 10/10/14 08:31, lakshmi k s wrote:
> > > > Thanks Mark. I got past this error being root. So essentially, I
> > copied
> > > > the certs from openstack controller node to gateway node. Did the
> > > > conversion using certutil and copied the files back to
> controller node
> > > > under /var/lib/ceph/nss directory. Is this the correct
> directory? Ceph
> > > > doc says /var/ceph/nss though.
> > > >
> > > > But after this, I tried to use curl GET command, but in
> vain.Same old
> > > > 401 - Authorization failure.
> > > >
> > > > curl -i -X GET
> > > >
> http://gateway.ex.com/swift/v1/AUTH_bad9e2232b304f89acb03436635b80cc
> > >
> <http://gateway.ex.com/swift/v1/AUTH_bad9e2232b304f89acb03436635b80cc>-H
> > > > "X-Auth-
> > > > Token: a510edb22f074946940cd4c07aafcd9d"
> > > >
> > > > HTTP/1.1 401 Unauthorized
> > > > Date: Thu, 09 Oct 2014 19:17:31 GMT
> > > > Server: Apache/2.4.7 (Ubuntu)
> > > > Accept-Ranges: bytes
> > > > Content-Length: 12
> > > > Content-Type: text/plain; charset=utf-8
> > > > AccessDeniedroot
> > > >
> > > > Not much difference in radosgw logs too. Note that the token used
> > above
> > > > is same one in ceph.conf file too. Please help.
> > > >
> > > > [client.radosgw.gateway]
> > > > rgw keystone url = http://192.0.8.2:5000 <http://192.0.8.2:5000/>
> > <http://192.0.8.2:5000/><http://192.0.8.2:5000/>
> > > > rgw keystone admin token = a510edb22f074946940cd4c07aafcd9d
> > > > rgw keystone accepted roles = admim Member _member_ swiftoperator
> > > > rgw keystone token cache size = 500
> > > > rgw keystone revocation interval = 500
> > > > rgw s3 auth use keystone = false
> > > > nss db path = /var/lib/ceph/nss
> > > > debug rgw = 20
> > > > host = gateway
> > > > keyring = /etc/ceph/ceph.client.radosgw.keyring
> > > > rgw socket path = /var/run/ceph/ceph.radosgw.gateway.fastcgi.sock
> > > > log file = /var/log/ceph/client.radosgw.gateway.log
> > > > rgw dns name = gateway
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > On Thursday, October 9, 2014 1:15 AM, Mark Kirkwood
> > > > <mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>
> > > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>>> wrote:
> > > >
> > > >
> > > > I ran into this - needed to actually be root via sudo -i or
> similar,
> > > > *then* it worked. Unhelpful error message is I think referring
> to no
> > > > intialized db.
> > > >
> > > > On 09/10/14 16:36, lakshmi k s wrote:
> > > > > Good workaround. But it did not work. Not sure what this error
> > is all
> > > > > about now.
> > > > >
> > > > > gateway@gateway <mailto:gateway@gateway>
> <mailto:gateway@gateway <mailto:gateway@gateway>>
> > <mailto:gateway@gateway <mailto:gateway@gateway>
> <mailto:gateway@gateway <mailto:gateway@gateway>>>
> > <mailto:gateway@gateway <mailto:gateway@gateway>
> <mailto:gateway@gateway <mailto:gateway@gateway>>
> > > <mailto:gateway@gateway <mailto:gateway@gateway>
> <mailto:gateway@gateway <mailto:gateway@gateway>>>>:~$ openssl x509 -in
> > > > /home/gateway/ca.pem -pubkey |
> > > > > certutil -d /var/lib/ceph/nss -A -n ca -t "TCu,Cu,Tuw"
> > > > > certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The
> > > > > certificate/key database is in an old, unsupported format.
> > > > >
> > > > >
> > > > >
> > > > > On Wednesday, October 8, 2014 7:55 PM, Mark Kirkwood
> > > > > <mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>>
> > > > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>
> > > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>>>> wrote:
> > > > >
> > > > >
> > > > > As a workaround check if your rgw host has openssl and certutil
> > > > > installed, if so you can copy the relevant unconverted certs
> over
> > > to it
> > > > > and convert 'em there.
> > > > >
> > > > > On 09/10/14 15:07, lakshmi k s wrote:
> > > > > > Tried aptitude as well, but no luck.
> > > > > >
> > > > > > Ceph users, have you tried to install libnss3-tools or
> certutil
> > > > tool on
> > > > > > debian/ubuntu? If so, how did you go about this problem.
> > > > > >
> > > > > >
> > > > > > On Wednesday, October 8, 2014 7:01 PM, Mark Kirkwood
> > > > > > <mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>
> > > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>>
>
> > > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>
> >
> > > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>>>
> > > > > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>
> > > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>>
> > >
> > > > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>
> > > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>
> > <mailto:mark.kirkw...@catalyst.net.nz
> <mailto:mark.kirkw...@catalyst.net.nz>>>>>> wrote:
> > > >
> > > > > >
> > > > > >
> > > > > > Ok, so that is the thing to get sorted. I'd suggest
> posting the
> > > > error(s)
> > > > > > you are getting perhaps here (someone else might know), but
> > > definitely
> > > > > > to one of the Debian specific lists.
> > > > > >
> > > > > > In the meantime perhaps try installing the packages with
> > aptitude
> > > > rather
> > > > > > than apt-get - if there is some fancy footwork required it is
> > > fairly
> > > > > > smart about what needs to be done.
> > > > > >
> > > > > > Cheers
> > > > > >
> > > > > > Mark
> > > > > >
> > > > > > On 09/10/14 14:38, lakshmi k s wrote:
> > > > > > > Thanks Mark. I have been trying to install this on
> controller
> > > > > node. But
> > > > > > > for some reason, I am unable to install certutil or
> > > > libnss3-tools on
> > > > > > > debian. I am not sure how to proceed.
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > > >
> > >
> > >
> > >
> >
> >
> >
>
>
>_______________________________________________
ceph-users mailing list
ceph-users@lists.ceph.com
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
