| *** Guest97385 has quit (Ping timeout: 250 seconds) | 00:37 | |
| *** mkirank (6a338d8d@gateway/web/freenode/ip.106.51.141.141) has joined #wikid | 05:12 | |
| mkirank | I am trying to generate a certificate after installation and get a "database error prevented processing of your request" | 05:13 |
|---|---|---|
| *** mkirank has quit (Quit: Page closed) | 05:58 | |
| *** nowen (~nowen@99-174-93-102.lightspeed.tukrga.sbcglobal.net) has joined #wikid | 13:16 | |
| *** nowen is now known as msg | 13:16 | |
| *** msg is now known as nowen | 13:17 | |
| *** nowen has quit (Quit: Leaving.) | 14:02 | |
| *** nowen (~nowen@99-174-93-102.lightspeed.tukrga.sbcglobal.net) has joined #wikid | 14:03 | |
| *** mkirank (7ab369e7@gateway/web/freenode/ip.122.179.105.231) has joined #wikid | 17:02 | |
| mkirank | How long does it take to generate a certificate | 17:02 |
| nowen | not long at all, | 17:02 |
| nowen | must be an error | 17:02 |
| nowen | what is the domain? | 17:03 |
| mkirank | hmm, I get a your certificate is being generated message but nothing happens | 17:03 |
| mkirank | the one that I enter in the server host name ? | 17:03 |
| nowen | yeah | 17:04 |
| mkirank | kirank.dev.genares.net | 17:04 |
| nowen | ok - not seeing it. hold on a bit | 17:05 |
| nowen | ok - try it now | 17:19 |
| mkirank | ok | 17:20 |
| mkirank | I'm getting a certificate DN's are required to be unique | 17:22 |
| nowen | hmm | 17:24 |
| nowen | can you slightly change it - I can't get to that db from here to delete it, it's stuck in a bit of a no-mans land. just change the email address - doesn't have to be real or you can do name+cert@..com | 17:25 |
| mkirank | ok | 17:27 |
| mkirank | that fixed it | 17:29 |
| mkirank | When configured does wikid act as a radius server ? | 17:30 |
| nowen | thanks for letting me know | 17:30 |
| nowen | it will authenticate radius requests, but that's about it | 17:30 |
| nowen | real radius servers will do authorization against a directory etc | 17:30 |
| mkirank | does it use port 1812 ? | 17:31 |
| nowen | use | 17:31 |
| nowen | yes | 17:31 |
| mkirank | ok | 17:31 |
| mkirank | I am trying to wrap my head around a system that I inherited | 17:31 |
| nowen | so, you can have your VPN talk to it directly, or you can put a radius server in the middle of the two | 17:32 |
| mkirank | we do not seem to have a radius server | 17:32 |
| mkirank | the clients have radius configured to point to a wikid system | 17:32 |
| nowen | ko | 17:33 |
| nowen | ok | 17:33 |
| nowen | how many clients are there? | 17:33 |
| mkirank | there are around 15-20 servers | 17:35 |
| mkirank | the wikid is broken when we tried to upgrade | 17:36 |
| nowen | and each one is listed as a network client on the WiKID Server? | 17:36 |
| mkirank | It was supposed to be working earlier, by the time I started it was broken when we tried to upgrade and it is in that state | 17:37 |
| nowen | what is going wrong? | 17:37 |
| mkirank | the previous sysadmin had made a few local mods to wikid to run only as wikid user and postgre port is changed to 5434 | 17:38 |
| mkirank | when we try to start wikid the wauth keeps printing ... and does not come out of it, there does not seem to be any errors in the log | 17:39 |
| nowen | hmm | 17:40 |
| nowen | so upgrading would change the port back | 17:40 |
| nowen | plus we added support to run as wikid users | 17:40 |
| nowen | on the latest rpms you do have to create new certs. that could be it | 17:41 |
| mkirank | so for postgres change we have to modify the port on the tomcat server.xml right ? | 17:42 |
| nowen | are you running in replication? | 17:43 |
| mkirank | yes it used to run replication | 17:43 |
| nowen | ok - that's probably why the port is that way | 17:44 |
| nowen | can you start the server now? | 17:45 |
| mkirank | do I change the server.xml file ? | 17:45 |
| nowen | not yet, I want to know if the updated server with the new cert will restart properly | 17:46 |
| nowen | what version did you update to? | 17:46 |
| mkirank | 3.5 build 0-b1428 | 17:47 |
| mkirank | The cert i generated is for a test server | 17:47 |
| mkirank | on the main server we are unable to get wikid to start | 17:48 |
| nowen | on your main server run this: keytool -list -v -keystore /opt/WiKID/private/intCAKeys.p12 -storetype pkcs12 -storepass yourpassphrase | 17:48 |
| mkirank | I am not sure what the passphrase is | 17:49 |
| nowen | look in /etc/WIKID/security | 17:49 |
| nowen | is it in that file? | 17:51 |
| mkirank | ok I got back the output | 17:51 |
| nowen | is the cert expired? | 17:51 |
| mkirank | no its valid till 2016 | 17:51 |
| nowen | hmm | 17:51 |
| nowen | our last cert expired this year. the new one 2024 | 17:52 |
| nowen | oh wait | 17:52 |
| nowen | run keytool -list -v -keystore /opt/WiKID/privateCACertStore | 17:52 |
| nowen | use passphrase == changeit | 17:52 |
| mkirank | keystore file does not exist | 17:55 |
| nowen | oops | 17:55 |
| nowen | opt/WiKID/private/CACertStore | 17:55 |
| nowen | dropped a / | 17:55 |
| mkirank | yeah noticed that | 17:55 |
| mkirank | got back something | 17:55 |
| nowen | expired? | 17:56 |
| mkirank | it has 2 entries, | 17:57 |
| mkirank | first one expired | 17:57 |
| nowen | ok | 17:57 |
| nowen | how many users on this system? | 17:57 |
| mkirank | not sure about exact number | 17:58 |
| mkirank | but I'm guessing within 100 | 17:58 |
| nowen | ok | 17:58 |
| nowen | what version is on the production server/ | 17:59 |
| nowen | ? | 17:59 |
| mkirank | 3.5.0.b1428-1 | 18:00 |
| nowen | huh - ok | 18:00 |
| nowen | that's a bit puzzling. 1428 should have the new cert | 18:01 |
| mkirank | so what happened was after the new upgrade we could not get tomcat to start | 18:01 |
| mkirank | so it was left in that state for a while | 18:02 |
| nowen | did you upgrade the secondary too? | 18:05 |
| mkirank | no I do not thing it was upgraded but let me check | 18:06 |
| mkirank | secondary has 3.4.1.b3314-1 | 18:07 |
| nowen | so, they should both be the same | 18:09 |
| nowen | unless you turned off replication | 18:09 |
| mkirank | no I guess we started the upgrade on the primary and when that did not come up the secondary was not changed | 18:10 |
| nowen | I'm still worried about the cert being expired. did you do the upgrade? | 18:10 |
| nowen | also, did you upgrade the utilites rpm? | 18:11 |
| mkirank | yes we upgraded the utility rpm, we worked with someone from wikid support that day ( not sure who it was) | 18:12 |
| nowen | haha, most likely me ;-) | 18:12 |
| mkirank | lol | 18:12 |
| mkirank | my coworker was with me | 18:12 |
| nowen | hmm | 18:13 |
| nowen | ok - so, here is a link to a more recent RPM. http://wikidsystems-dl.com/wikid-server-enterprise-3.5.0.b1428-1.noarch.rpm | 18:13 |
| nowen | grab that and upgrade on the production server. then upgrade both rpms on the secondary | 18:14 |
| mkirank | I will need permission to do that , What is the best way to go about this ? | 18:15 |
| mkirank | just upgrade wikid and start over ? | 18:15 |
| mkirank | Is there a way to restore the old configuration | 18:16 |
| nowen | just rpm -Uvh the rpms. then run 'wikidctl sync' | 18:16 |
| nowen | then start | 18:16 |
| nowen | did you'll do a back up/ | 18:16 |
| nowen | ? | 18:16 |
| nowen | it might be problematic as the certs are expired. | 18:16 |
| nowen | we could promote your secondary | 18:17 |
| mkirank | yes we do back up but in this case it has been broken for sometime so not sure if what we have helps | 18:17 |
| nowen | your secondary has the old version | 18:17 |
| mkirank | yes it has the old version | 18:17 |
| mkirank | can we get the old version on the primary and get it working and then upgrade ? | 18:17 |
| nowen | why? we can just promote the secondary and see if it works. then work on the primary | 18:18 |
| mkirank | hmm | 18:19 |
| mkirank | yeah that option seems to make sense | 18:20 |
| mkirank | so is it a matter of starting wikid and telling it to take over ? | 18:20 |
| nowen | http://www.wikidsystems.com/support/wikid-support-center/installation-how-tos/how-to-configure-the-wikid-strong-authentication-system-for-replication | 18:20 |
| mkirank | ok let me check with the team and see what they think about this | 18:22 |
| nowen | ok | 18:24 |
| nowen | I have a meeting from about 3-4 pm edt | 18:28 |
| mkirank | I've told them the option , it might be a while till I hear from them | 18:32 |
| nowen | ok | 18:38 |
| nowen | what timezone are you in? | 18:38 |
| mkirank | I'm in IST | 18:40 |
| mkirank | the team is CST | 18:40 |
| nowen | how long has the server been down? | 18:41 |
| mkirank | It has been around 4-5 months | 18:43 |
| nowen | woah | 18:43 |
| mkirank | lol but does not affect us much | 18:43 |
| mkirank | I'm not sure why this was set up initially | 18:45 |
| nowen | I'm guessing to meet PCI compliance | 18:46 |
| mkirank | yeah I think that is correct | 18:46 |
| nowen | ok - I have to go. I will be back later | 18:56 |
| *** nowen has quit (Quit: Leaving.) | 18:56 | |
| *** mkirank has quit (Quit: Page closed) | 18:59 | |
| *** nowen (~nowen@99-174-93-102.lightspeed.tukrga.sbcglobal.net) has joined #wikid | 19:51 | |
| *** nowen has quit (Quit: Leaving.) | 20:55 | |
Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!