> -----Original Message-----
> From: Rob Crittenden [mailto:rcrit...@redhat.com]
> Sent: Friday, October 25, 2013 10:54 AM
> To: Thomson, Ryan; freeipa-users@redhat.com
> Subject: Re: [Freeipa-users] Failure decoding Certificate Signing Request
> Thomson, Ryan wrote:
> >> -----Original Message-----
> >> From: Rob Crittenden [mailto:rcrit...@redhat.com]
> >> Sent: Thursday, October 24, 2013 11:41 AM
> >> To: Thomson, Ryan; freeipa-users@redhat.com
> >> Subject: Re: [Freeipa-users] Failure decoding Certificate Signing
> >> Request
> >>
> >> Thomson, Ryan wrote:
> >>>> -----Original Message-----
> >>>> From: Rob Crittenden [mailto:rcrit...@redhat.com]
> >>>> Sent: Wednesday, October 23, 2013 6:58 PM
> >>>> To: Thomson, Ryan; freeipa-users@redhat.com
> >>>> Subject: Re: [Freeipa-users] Failure decoding Certificate Signing
> >>>> Request
> >>>>
> >>>> I think this still points to NSS not being initialized. The way we
> >>>> currently use NSS in the server is Apache fires things up using
> >>>> mod_nss, then because we are a child of Apache via mod_wsgi, we
> >>>> inherit the open NSS database in /etc/httpd/alias. This gives us
> >>>> the CA cert and the client cert we need in order to talk to dogtag.
> >>>>
> >>>> What I thought, and the excellent debugging above confirms, is that
> >>>> at some point the NSS database is being shut down. At some point we
> >>>> need to do some crypto and try to initialize it ourselves to no
> >>>> avail. We shouldn't ever need to do it in the server and thus don't
> >>>> have access to PINs and such because we don't need them. We do
> >>>> initialize things from time to time on the client side but we tend
> >>>> to do a database-less initialization (nss_init_nodb()).
> >>>>
> >>>> I'm not really sure what this tells us though. It would appear that
> >>>> SSL is working in Apache, because you are able to get far enough to
> >>>> make a request and have it fail. So the NSS database is still
> >>>> initialized in Apache, but for some reason the wsgi code doesn't
> >>>> seem to
> >> agree.
> >>>>
> >>>> Would it be possible for you to stop and restart Apache and run
> >>>> some simple IPA command like ipa user-show admin (and let me know
> >>>> if it
> >> succeeds)?
> >>>> Then send me the error_log?
> >>>>
> >>>> If you are in SELinux enforcing mode it would also be helpful to
> >>>> check for any AVCs. Maybe we simply can't access the database.
> >>>>
> >>>> thanks
> >>>>
> >>>> rob
> >>>
> >>> I am able to stop/wait/start apache and then execute "ipa user-show
> >> admin" successfully.
> >>>
> >>
> >> Ok, let's try a couple more things.
> >>
> >> Can you set LogLevel debug in /etc/httpd/conf.d/nss.conf and restart
> >> Apache again? This may give us more information on what mod_nss is
> doing.
> >>
> >> Next, lets try a different cert command that should also invoke the
> >> NSS client within IPA:
> >>
> >> $ ipa cert-show 22
> >>
> >> Can you describe your environment? Do you have multiple IPA masters?
> >> Was this a new install at 3.0 or is it an upgrade from 2.2?
> >>
> >> rob
> >
> > The environment is simple: Single master, upgraded from 2.2.
> >
> > Output in /var/log/httpd/error_log after setting LogLevel to debug in
> /etc/httpd/conf.d/nss.conf and restarting apache:
> [ snip ]
> >
> > I'm not sure what to make of this.
> This is just more confirmation that the IPA framework is trying to initialize
> NSS for some reason. It should never do this which is why it is failing so
> spectacularly.
> Can you provide nss.conf and ipa.conf from /etc/httpd/conf.d?
> Who owns and what are the permissions of /etc/httpd/alias/*.db?
> thanks
> rob

Thanks for sticking with me on this.

Below is the contents of the requested files and ownership/permissions of the 
apache NSS db. 


# This file may be overwritten on upgrades.
# LoadModule auth_kerb_module modules/mod_auth_kerb.so

ProxyRequests Off

#We use xhtml, a file format that the browser validates
DirectoryIndex index.html

# Substantially increase the request field size to support MS-PAC
# requests, ticket #2767. This should easily support a 64KiB PAC.
LimitRequestFieldSize 100000

# ipa-rewrite.conf is loaded separately

# This is required so the auto-configuration works with Firefox 2+
AddType application/java-archive        jar
AddType application/x-xpinstall         xpi

# FIXME: WSGISocketPrefix is a server-scope directive.  The mod_wsgi package
# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
WSGISocketPrefix /var/run/httpd/wsgi

# Configure mod_wsgi handler for /ipa
WSGIDaemonProcess ipa processes=2 threads=1 maximum-requests=500
WSGIProcessGroup ipa
WSGIApplicationGroup ipa
WSGIImportScript /usr/share/ipa/wsgi.py process-group=ipa application-group=ipa
WSGIScriptAlias /ipa /usr/share/ipa/wsgi.py
WSGIScriptReloading Off

# Turn off mod_msgi handler for errors, config, crl:
<Location "/ipa/errors">
  SetHandler None
<Location "/ipa/config">
  SetHandler None
<Location "/ipa/crl">
  SetHandler None

KrbConstrainedDelegationLock ipa

# Protect /ipa and everything below it in webspace with Apache Kerberos auth
<Location "/ipa">
  AuthType Kerberos
  AuthName "Kerberos Login"
  KrbMethodNegotiate on
  KrbMethodK5Passwd off
  KrbServiceName HTTP
  Krb5KeyTab /etc/httpd/conf/ipa.keytab
  KrbSaveCredentials on
  KrbConstrainedDelegation on
  Require valid-user
  ErrorDocument 401 /ipa/errors/unauthorized.html

# Turn off Apache authentication for sessions
<Location "/ipa/session/json">
  Satisfy Any
  Order Deny,Allow
  Allow from all

<Location "/ipa/session/xml">
  Satisfy Any
  Order Deny,Allow
  Allow from all

<Location "/ipa/session/login_password">
  Satisfy Any
  Order Deny,Allow
  Allow from all

<Location "/ipa/session/change_password">
  Satisfy Any
  Order Deny,Allow
  Allow from all

# This is where we redirect on failed auth
Alias /ipa/errors "/usr/share/ipa/html"

# For the MIT Windows config files
Alias /ipa/config "/usr/share/ipa/html"

# Do no authentication on the directory that contains error messages
<Directory "/usr/share/ipa/html">
  SetHandler None
  AllowOverride None
  Satisfy Any
  Allow from all

# For CRL publishing
Alias /ipa/crl "/var/lib/ipa/pki-ca/publish"
<Directory "/var/lib/ipa/pki-ca/publish">
  SetHandler None
  AllowOverride None
  Options Indexes FollowSymLinks
  Satisfy Any
  Allow from all

#  webUI  is now completely static, and served out of that directory
Alias /ipa/ui "/usr/share/ipa/ui"
<Directory "/usr/share/ipa/ui">
  SetHandler None
  AllowOverride None
  Satisfy Any
  Allow from all

# Protect our CGIs
<Directory /var/www/cgi-bin>
  AuthType Kerberos
  AuthName "Kerberos Login"
  KrbMethodNegotiate on
  KrbMethodK5Passwd off
  KrbServiceName HTTP
  KrbAuthRealms FMRI.UBC.CA
  Krb5KeyTab /etc/httpd/conf/ipa.keytab
  KrbSaveCredentials on
  Require valid-user
  ErrorDocument 401 /ipa/errors/unauthorized.html

# migration related pages
Alias /ipa/migration "/usr/share/ipa/migration"
<Directory "/usr/share/ipa/migration">
    AllowOverride None
    Satisfy Any
    Allow from all
    Options ExecCGI
    AddHandler wsgi-script .py


# This is the Apache server configuration file providing SSL support using.
# the mod_nss plugin.  It contains the configuration directives to instruct
# the server how to serve pages over an https connection.
# Do NOT simply read the instructions in here without understanding
# what they do.  They're here only as hints or reminders.  If you are unsure
# consult the online docs. You have been warned.  

LoadModule nss_module modules/libmodnss.so

# When we also provide SSL we have to listen to the 
# standard HTTP port (see above) and to the HTTPS port
# Note: Configurations that use IPv6 but not IPv4-mapped addresses need two
#       Listen directives: "Listen [::]:443" and "Listen"
Listen 443

##  SSL Global Context
##  All SSL configuration in this context applies both to
##  the main server and all SSL-enabled virtual hosts.

#   Some MIME-types for downloading Certificates and CRLs
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl

#   Pass Phrase Dialog:
#   Configure the pass phrase gathering process.
#   The filtering dialog program (`builtin' is a internal
#   terminal dialog) has to provide the pass phrase on stdout.
NSSPassPhraseDialog "file:/etc/httpd/conf/password.conf"

#   Pass Phrase Helper:
#   This helper program stores the token password pins between
#   restarts of Apache.
NSSPassPhraseHelper /usr/sbin/nss_pcache

#   Configure the SSL Session Cache. 
#   NSSSessionCacheSize is the number of entries in the cache.
#   NSSSessionCacheTimeout is the SSL2 session timeout (in seconds).
#   NSSSession3CacheTimeout is the SSL3/TLS session timeout (in seconds).
NSSSessionCacheSize 10000
NSSSessionCacheTimeout 100
NSSSession3CacheTimeout 86400

# Pseudo Random Number Generator (PRNG):
# Configure one or more sources to seed the PRNG of the SSL library.
# The seed data should be of good random quality.
# WARNING! On some platforms /dev/random blocks if not enough entropy
# is available. Those platforms usually also provide a non-blocking
# device, /dev/urandom, which may be used instead.
# This does not support seeding the RNG with each connection.

NSSRandomSeed startup builtin
#NSSRandomSeed startup file:/dev/random  512
#NSSRandomSeed startup file:/dev/urandom 512

# TLS Negotiation configuration under RFC 5746
# Only renegotiate if the peer's hello bears the TLS renegotiation_info
# extension. Default off.
NSSRenegotiation on

# Peer must send Signaling Cipher Suite Value (SCSV) or
# Renegotiation Info (RI) extension in ALL handshakes.  Default: off
NSSRequireSafeNegotiation on

## SSL Virtual Host Context

<VirtualHost _default_:443>

#   General setup for the virtual host
#DocumentRoot "/etc/httpd/htdocs"
#ServerName www.example.com:443
#ServerAdmin y...@example.com

# mod_nss can log to separate log files, you can choose to do that if you'd like
# LogLevel is not inherited from httpd.conf.
ErrorLog /etc/httpd/logs/error_log
TransferLog /etc/httpd/logs/access_log
LogLevel debug

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
NSSEngine on

#   SSL Cipher Suite:
#   List the ciphers that the client is permitted to negotiate.
#   See the mod_nss documentation for a complete list.

# SSL 3 ciphers. SSL 2 is disabled by default.

# SSL 3 ciphers + ECC ciphers. SSL 2 is disabled by default.
# Comment out the NSSCipherSuite line above and use the one below if you have
# ECC enabled NSS and mod_nss and want to use Elliptical Curve Cryptography

NSSProtocol SSLv3,TLSv1.0

#NSSEnforceValidCerts off

#   SSL Certificate Nickname:
#   The nickname of the RSA server certificate you are going to use.
NSSNickname Server-Cert

#   SSL Certificate Nickname:
#   The nickname of the ECC server certificate you are going to use, if you
#   have an ECC-enabled version of NSS and mod_nss
#NSSECCNickname Server-Cert-ecc

#   Server Certificate Database:
#   The NSS security database directory that holds the certificates and
#   keys. The database consists of 3 files: cert8.db, key3.db and secmod.db.
#   Provide the directory that these files exist.
NSSCertificateDatabase /etc/httpd/alias

#   Database Prefix:
#   In order to be able to store multiple NSS databases in one directory
#   they need unique names. This option sets the database prefix used for
#   cert8.db and key3.db.
#NSSDBPrefix my-prefix-

#   Client Authentication (Type):
#   Client certificate verification type.  Types are none, optional and
#   require.
#NSSVerifyClient none

#   Online Certificate Status Protocol (OCSP).
#   Verify that certificates have not been revoked before accepting them.

#   Use a default OCSP responder. If enabled this will be used regardless
#   of whether one is included in a client certificate. Note that the
#   server certificate is verified during startup.
#   NSSOCSPDefaultURL defines the service URL of the OCSP responder
#   NSSOCSPDefaultName is the nickname of the certificate to trust to
#       sign the OCSP responses.
#NSSOCSPDefaultResponder on
#NSSOCSPDefaultURL http://example.com/ocsp/status
#NSSOCSPDefaultName ocsp-nickname

#   Access Control:
#   With SSLRequire you can do per-directory access control based
#   on arbitrary complex boolean expressions containing server
#   variable checks and other lookup directives.  The syntax is a
#   mixture between C and Perl.  See the mod_nss documentation
#   for more details.
#<Location />
#NSSRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/

#   SSL Engine Options:
#   Set various options for the SSL engine.
#   o FakeBasicAuth:
#     Translate the client X.509 into a Basic Authorisation.  This means that
#     the standard Auth/DBMAuth methods can be used for access control.  The
#     user name is the `one line' version of the client's X.509 certificate.
#     Note that no password is obtained from the user. Every entry in the user
#     file needs this password: `xxj31ZMTZzkVA'.
#   o ExportCertData:
#     This exports two additional environment variables: SSL_CLIENT_CERT and
#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
#     server (always existing) and the client (only existing when client
#     authentication is used). This can be used to import the certificates
#     into CGI scripts.
#   o StdEnvVars:
#     This exports the standard SSL/TLS related `SSL_*' environment variables.
#     Per default this exportation is switched off for performance reasons,
#     because the extraction step is an expensive operation and is usually
#     useless for serving static content. So one usually enables the
#     exportation for CGI and SSI requests only.
#   o StrictRequire:
#     This denies access when "NSSRequireSSL" or "NSSRequire" applied even
#     under a "Satisfy any" situation, i.e. when it applies access is denied
#     and no other module can change it.
#   o OptRenegotiate:
#     This enables optimized SSL connection renegotiation handling when SSL
#     directives are used in per-directory context. 
#NSSOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    NSSOptions +StdEnvVars
<Directory "/var/www/cgi-bin">
    NSSOptions +StdEnvVars

#   Per-Server Logging:
#   The home of a custom SSL log file. Use this when you want a
#   compact non-error SSL logfile on a virtual host basis.
#CustomLog /home/rcrit/redhat/apache/logs/ssl_request_log \
#          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

Include conf.d/ipa-rewrite.conf

And finally:

# ls -alh *.db
-rw-r-----. 1 root apache 64K Oct  5 00:17 cert8.db
-rw-r-----. 1 root apache 36K Oct  5 00:17 key3.db
-rw-r-----. 1 root apache 16K Oct  2 00:29 secmod.db

Thank you,


Freeipa-users mailing list

Reply via email to