I noticed that one of my FreeIPA servers is missing the Vault tab in
the web UI.
I've got a workaround but it seems a bit fishy and I wondered if
someone else could suggest a better fix.
The server in question is the only one that runs CentOS 8 (ipa-server
4.8.0-13.module_el8.1.0+265+e1e65be4). My other servers are running
CentOS 7 and work fine.
The command 'ipa vaultconfig-show' fails when run against the bad
server with:
[admin@client ~]$ ipa -vv vaultconfig-show
[...]
ipa: INFO: Request: {
"id": 0,
"method": "vaultconfig_show/1",
"params": [
[],
{
"version": "2.233"
}
]
}
ipa: INFO: Response: {
"error": {
"code": 903,
"data": {},
"message": "an internal error has occurred",
"name": "InternalError"
},
"id": 0,
"principal": "admin(a)IPA.EXAMPLE.COM",
"result": null,
"version": "4.8.0"
}
ipa: ERROR: an internal error has occurred
The corresponding httpd logs on the server (192.0.2.1 is my client, the
server is [2001:db8::1]) contain:
==> /var/log/httpd/access_log <==
192.0.2.1 - admin(a)IPA.EXAMPLE.COM [18/Mar/2020:08:31:50 +0000] "POST /ipa/json
HTTP/1.1" 200 210
==> /var/log/httpd/error_log <==
[Wed Mar 18 08:31:51.760354 2020] [:warn] [pid 22279:tid 139671875061504] [client
192.0.2.1:62546] failed to set perms (3140) on file
(/run/ipa/ccaches/admin(a)IPA.EXAMPLE.COM)!, referer:
https://ipa2.ipa.example.com/ipa/xml
[Wed Mar 18 08:31:51.807084 2020] [wsgi:error] [pid 22274:tid 139672253028096] [remote
192.0.2.1:62546] ipa: INFO: [jsonserver_session] admin(a)IPA.EXAMPLE.COM: ping(): SUCCESS
==> /var/log/httpd/access_log <==
192.0.2.1 - admin(a)IPA.EXAMPLE.COM [18/Mar/2020:08:31:51 +0000] "POST
/ipa/session/json HTTP/1.1" 200 276
==> /var/log/httpd/error_log <==
[Wed Mar 18 08:31:51.917275 2020] [:warn] [pid 22279:tid 139671891846912] [client
192.0.2.1:62546] failed to set perms (3140) on file
(/run/ipa/ccaches/admin(a)IPA.EXAMPLE.COM)!, referer:
https://ipa2.ipa.example.com/ipa/xml
==> /var/log/httpd/access_log <==
2001:db8::1 - - [18/Mar/2020:08:31:52 +0000] "GET /pki/rest/info HTTP/1.1" 404
211
==> /var/log/httpd/error_log <==
[Wed Mar 18 08:31:52.582003 2020] [ssl:error] [pid 23219:tid 139671598266112] [client
2001:db8::1:44620] AH: verify client post handshake
[Wed Mar 18 08:31:52.582101 2020] [ssl:error] [pid 23219:tid 139671598266112] [client
2001:db8::1:44620] AH10158: cannot perform post-handshake authentication
[Wed Mar 18 08:31:52.582207 2020] [ssl:error] [pid 23219:tid 139671598266112] SSL Library
Error: error:14268117:SSL routines:SSL_verify_client_post_handshake:extension not
received
==> /var/log/httpd/access_log <==
2001:db8::1 - - [18/Mar/2020:08:31:52 +0000] "GET /kra/rest/config/cert/transport
HTTP/1.1" 403 298
==> /var/log/httpd/error_log <==
[Wed Mar 18 08:31:52.586053 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] ipa: ERROR: non-public: HTTPError: 403 Client Error: Forbidden for url:
https://ipa2.ipa.example.com:443/kra/rest/config/cert/transport
[Wed Mar 18 08:31:52.586100 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] Traceback (most recent call last):
[Wed Mar 18 08:31:52.586106 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/pki/__init__.py", line
429, in handler
[Wed Mar 18 08:31:52.586112 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] json = exc_val.response.json()
[Wed Mar 18 08:31:52.586116 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/requests/models.py",
line 897, in json
[Wed Mar 18 08:31:52.586121 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] return complexjson.loads(self.text, **kwargs)
[Wed Mar 18 08:31:52.586127 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib64/python3.6/json/__init__.py", line 354, in
loads
[Wed Mar 18 08:31:52.586133 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] return _default_decoder.decode(s)
[Wed Mar 18 08:31:52.586137 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib64/python3.6/json/decoder.py", line 339, in
decode
[Wed Mar 18 08:31:52.586142 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] obj, end = self.raw_decode(s, idx=_w(s, 0).end())
[Wed Mar 18 08:31:52.586146 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib64/python3.6/json/decoder.py", line 357, in
raw_decode
[Wed Mar 18 08:31:52.586151 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] raise JSONDecodeError("Expecting value", s, err.value) from
None
[Wed Mar 18 08:31:52.586156 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
[Wed Mar 18 08:31:52.586160 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546]
[Wed Mar 18 08:31:52.586165 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] During handling of the above exception, another exception occurred:
[Wed Mar 18 08:31:52.586169 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546]
[Wed Mar 18 08:31:52.586174 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] Traceback (most recent call last):
[Wed Mar 18 08:31:52.586179 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File
"/usr/lib/python3.6/site-packages/ipaserver/rpcserver.py", line 368, in
wsgi_execute
[Wed Mar 18 08:31:52.586184 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] result = command(*args, **options)
[Wed Mar 18 08:31:52.586189 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py",
line 450, in __call__
[Wed Mar 18 08:31:52.586194 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] return self.__do_call(*args, **options)
[Wed Mar 18 08:31:52.586199 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py",
line 478, in __do_call
[Wed Mar 18 08:31:52.586204 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] ret = self.run(*args, **options)
[Wed Mar 18 08:31:52.586209 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py",
line 800, in run
[Wed Mar 18 08:31:52.586214 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] return self.execute(*args, **options)
[Wed Mar 18 08:31:52.586252 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File
"/usr/lib/python3.6/site-packages/ipaserver/plugins/vault.py", line 1003, in
execute
[Wed Mar 18 08:31:52.586258 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] transport_cert = kra_client.system_certs.get_transport_cert()
[Wed Mar 18 08:31:52.586263 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/pki/__init__.py", line
434, in handler
[Wed Mar 18 08:31:52.586267 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] six.reraise(exc_type, exc_val, exc_tb)
[Wed Mar 18 08:31:52.586272 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/six.py", line 693, in
reraise
[Wed Mar 18 08:31:52.586277 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] raise value
[Wed Mar 18 08:31:52.586281 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/pki/__init__.py", line
423, in handler
[Wed Mar 18 08:31:52.586286 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] return fn_call(inst, *args, **kwargs)
[Wed Mar 18 08:31:52.586290 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/pki/systemcert.py",
line 54, in get_transport_cert
[Wed Mar 18 08:31:52.586295 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] response = self.connection.get(url, self.headers)
[Wed Mar 18 08:31:52.586300 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/pki/client.py", line
46, in wrapper
[Wed Mar 18 08:31:52.586305 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] return func(self, *args, **kwargs)
[Wed Mar 18 08:31:52.586309 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/pki/client.py", line
165, in get
[Wed Mar 18 08:31:52.586314 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] r.raise_for_status()
[Wed Mar 18 08:31:52.586319 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/requests/models.py",
line 940, in raise_for_status
[Wed Mar 18 08:31:52.586324 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] raise HTTPError(http_error_msg, response=self)
[Wed Mar 18 08:31:52.586330 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] requests.exceptions.HTTPError: 403 Client Error: Forbidden for url:
https://ipa2.ipa.example.com:443/kra/rest/config/cert/transport
[Wed Mar 18 08:31:52.586340 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546]
[Wed Mar 18 08:31:52.586647 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote
192.0.2.1:62546] ipa: INFO: [jsonserver_session] admin(a)IPA.EXAMPLE.COM:
vaultconfig_show/1(version='2.235'): InternalError
==> /var/log/httpd/access_log <==
192.0.2.1 - admin(a)IPA.EXAMPLE.COM [18/Mar/2020:08:31:51 +0000] "POST
/ipa/session/json HTTP/1.1" 200 173
It looks like the ipa api server requests
/kra/rest/config/cert/transport, which httpd normally proxies through
to tomcat; but there's something about the request that causes mod_ssl
to reject it ("cannot perform post-handshake authentication").
Unauthenticated requests to that URL work fine:
# curl -s
https://ipa2.ipa.example.com/kra/rest/config/cert/transport | head -n1
<?xml version="1.0" encoding="UTF-8"
standalone="yes"?><CertData
xmlns:ns2="http://www.w3.org/2005/Atom"
id="0xb"><Encoded>-----BEGIN CERTIFICATE-----
If I reconfigure httpd with "SSLProtocol +TLSv1.2 -TLSv1.3" then the
problem goes away. As far as I know, the default in RHEL 8 is to _not_
include an SSLProtocol line so that the system-wide crypto-policies(5)
will be used. Hence this feels like the wrong solution to me.
Interestingly, "SSLProtocol -TLSv1.3" causes httpd to fail to start
with "AH02231: No SSL protocols available [hint: SSLProtocol]"... even
though (testing with sslyze), no SSLProtocol directive leaves only
TLSv1.2 and TLSv1.3 enabled...
--
Sam Morris <
https://robots.org.uk/>
PGP: rsa4096/CAAA AA1A CA69 A83A
892B 1855 D20B 4202 5CDA 27B9