search

freeipa / freeipa-letsencrypt

A quick hack allowing to use Let's Encrypt certificates for FreeIPA web interface.
143 stars 74 forks source link

Setup failing on Centos7 #7

Closed Tokynet closed 3 years ago

Tokynet commented 7 years ago

OS: Centos7u3

packages: freeipa-letsencrypt]# rpm -qa | grep ^ipa ipa-admintools-4.4.0-14.el7.centos.7.noarch ipa-client-common-4.4.0-14.el7.centos.7.noarch ipa-server-common-4.4.0-14.el7.centos.7.noarch ipa-client-4.4.0-14.el7.centos.7.x86_64 ipa-server-4.4.0-14.el7.centos.7.x86_64 ipa-common-4.4.0-14.el7.centos.7.noarch

Listening ports:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:749             0.0.0.0:*               LISTEN      6487/kadmind
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd
tcp        0      0 0.0.0.0:464             0.0.0.0:*               LISTEN      6487/kadmind
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      4754/sshd
tcp        0      0 0.0.0.0:88              0.0.0.0:*               LISTEN      6482/krb5kdc
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1025/master
tcp6       0      0 :::749                  :::*                    LISTEN      6487/kadmind
tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd
tcp6       0      0 :::8080                 :::*                    LISTEN      6677/java
tcp6       0      0 :::80                   :::*                    LISTEN      6500/httpd
tcp6       0      0 :::464                  :::*                    LISTEN      6487/kadmind
tcp6       0      0 :::22                   :::*                    LISTEN      4754/sshd
tcp6       0      0 :::88                   :::*                    LISTEN      6482/krb5kdc
tcp6       0      0 :::8443                 :::*                    LISTEN      6677/java
tcp6       0      0 :::443                  :::*                    LISTEN      6500/httpd
tcp6       0      0 :::636                  :::*                    LISTEN      6433/ns-slapd
tcp6       0      0 127.0.0.1:8005          :::*                    LISTEN      6677/java
tcp6       0      0 :::389                  :::*                    LISTEN      6433/ns-slapd
tcp6       0      0 ::1:8009                :::*                    LISTEN      6677/java

I edited setup-le.sh and changed dnf for yum.

freeipa-letsencrypt]# ./setup-le.sh
Loaded plugins: fastestmirror
Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast
base                                                                                                                                              | 3.6 kB  00:00:00
epel/x86_64/metalink                                                                                                                              |  14 kB  00:00:00
epel                                                                                                                                              | 4.3 kB  00:00:00
extras                                                                                                                                            | 3.4 kB  00:00:00
updates                                                                                                                                           | 3.4 kB  00:00:00
(1/5): epel/x86_64/group_gz                                                                                                                       | 170 kB  00:00:00
(2/5): epel/x86_64/updateinfo                                                                                                                     | 789 kB  00:00:00
(3/5): extras/7/x86_64/primary_db                                                                                                                 | 188 kB  00:00:00
(4/5): epel/x86_64/primary_db                                                                                                                     | 4.8 MB  00:00:00
(5/5): updates/7/x86_64/primary_db                                                                                                                | 7.7 MB  00:00:00
Determining fastest mirrors
 * base: mirror.cisp.com
 * epel: s3-mirror-us-east-1.fedoraproject.org
 * extras: linux.cc.lehigh.edu
 * updates: mirrors.advancedhosters.com
Resolving Dependencies
--> Running transaction check
---> Package certbot.noarch 0:0.14.1-3.el7 will be installed
--> Processing Dependency: python2-certbot = 0.14.1-3.el7 for package: certbot-0.14.1-3.el7.noarch
--> Running transaction check
---> Package python2-certbot.noarch 0:0.14.1-3.el7 will be installed
--> Processing Dependency: python2-acme = 0.14.1 for package: python2-certbot-0.14.1-3.el7.noarch
--> Processing Dependency: python2-dialog >= 3.3.0 for package: python2-certbot-0.14.1-3.el7.noarch
--> Processing Dependency: python2-configargparse >= 0.10.0 for package: python2-certbot-0.14.1-3.el7.noarch
--> Processing Dependency: python-psutil >= 2.1.0 for package: python2-certbot-0.14.1-3.el7.noarch
--> Processing Dependency: python2-future for package: python2-certbot-0.14.1-3.el7.noarch
--> Processing Dependency: python-zope-interface for package: python2-certbot-0.14.1-3.el7.noarch
--> Processing Dependency: python-zope-component for package: python2-certbot-0.14.1-3.el7.noarch
--> Processing Dependency: python-parsedatetime for package: python2-certbot-0.14.1-3.el7.noarch
--> Processing Dependency: python-mock for package: python2-certbot-0.14.1-3.el7.noarch
--> Running transaction check
---> Package python-parsedatetime.noarch 0:1.5-3.el7 will be installed
---> Package python-psutil.x86_64 0:2.2.1-1.el7 will be installed
---> Package python-zope-component.noarch 1:4.1.0-3.el7 will be installed
--> Processing Dependency: python-zope-event for package: 1:python-zope-component-4.1.0-3.el7.noarch
---> Package python-zope-interface.x86_64 0:4.0.5-4.el7 will be installed
---> Package python2-acme.noarch 0:0.14.1-1.el7 will be installed
--> Processing Dependency: pytz for package: python2-acme-0.14.1-1.el7.noarch
--> Processing Dependency: python-pyrfc3339 for package: python2-acme-0.14.1-1.el7.noarch
--> Processing Dependency: python-ndg_httpsclient for package: python2-acme-0.14.1-1.el7.noarch
---> Package python2-configargparse.noarch 0:0.11.0-1.el7 will be installed
---> Package python2-dialog.noarch 0:3.3.0-6.el7 will be installed
--> Processing Dependency: dialog for package: python2-dialog-3.3.0-6.el7.noarch
---> Package python2-future.noarch 0:0.16.0-2.el7 will be installed
---> Package python2-mock.noarch 0:1.0.1-9.el7 will be installed
--> Running transaction check
---> Package dialog.x86_64 0:1.2-4.20130523.el7 will be installed
---> Package python-ndg_httpsclient.noarch 0:0.3.2-1.el7 will be installed
---> Package python-zope-event.noarch 0:4.0.3-2.el7 will be installed
---> Package python2-pyrfc3339.noarch 0:1.0-2.el7 will be installed
---> Package pytz.noarch 0:2012d-5.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

=========================================================================================================================================================================
 Package                                           Arch                              Version                                       Repository                       Size
=========================================================================================================================================================================
Installing:
 certbot                                           noarch                            0.14.1-3.el7                                  epel                             19 k
Installing for dependencies:
 dialog                                            x86_64                            1.2-4.20130523.el7                            base                            208 k
 python-ndg_httpsclient                            noarch                            0.3.2-1.el7                                   epel                             43 k
 python-parsedatetime                              noarch                            1.5-3.el7                                     epel                             61 k
 python-psutil                                     x86_64                            2.2.1-1.el7                                   epel                            114 k
 python-zope-component                             noarch                            1:4.1.0-3.el7                                 epel                            227 k
 python-zope-event                                 noarch                            4.0.3-2.el7                                   epel                             79 k
 python-zope-interface                             x86_64                            4.0.5-4.el7                                   base                            138 k
 python2-acme                                      noarch                            0.14.1-1.el7                                  epel                            170 k
 python2-certbot                                   noarch                            0.14.1-3.el7                                  epel                            417 k
 python2-configargparse                            noarch                            0.11.0-1.el7                                  epel                             30 k
 python2-dialog                                    noarch                            3.3.0-6.el7                                   epel                             94 k
 python2-future                                    noarch                            0.16.0-2.el7                                  epel                            799 k
 python2-mock                                      noarch                            1.0.1-9.el7                                   epel                             92 k
 python2-pyrfc3339                                 noarch                            1.0-2.el7                                     epel                             13 k
 pytz                                              noarch                            2012d-5.el7                                   base                             38 k

Transaction Summary
=========================================================================================================================================================================
Install  1 Package (+15 Dependent packages)

Total download size: 2.5 M
Installed size: 11 M
Downloading packages:
(1/16): certbot-0.14.1-3.el7.noarch.rpm                                                                                                           |  19 kB  00:00:00
(2/16): python-ndg_httpsclient-0.3.2-1.el7.noarch.rpm                                                                                             |  43 kB  00:00:00
(3/16): python-parsedatetime-1.5-3.el7.noarch.rpm                                                                                                 |  61 kB  00:00:00
(4/16): python-psutil-2.2.1-1.el7.x86_64.rpm                                                                                                      | 114 kB  00:00:00
(5/16): python-zope-component-4.1.0-3.el7.noarch.rpm                                                                                              | 227 kB  00:00:00
(6/16): python-zope-event-4.0.3-2.el7.noarch.rpm                                                                                                  |  79 kB  00:00:00
(7/16): python2-acme-0.14.1-1.el7.noarch.rpm                                                                                                      | 170 kB  00:00:00
(8/16): python2-certbot-0.14.1-3.el7.noarch.rpm                                                                                                   | 417 kB  00:00:00
(9/16): python2-configargparse-0.11.0-1.el7.noarch.rpm                                                                                            |  30 kB  00:00:00
(10/16): python2-dialog-3.3.0-6.el7.noarch.rpm                                                                                                    |  94 kB  00:00:00
(11/16): python2-future-0.16.0-2.el7.noarch.rpm                                                                                                   | 799 kB  00:00:00
(12/16): python2-mock-1.0.1-9.el7.noarch.rpm                                                                                                      |  92 kB  00:00:00
(13/16): python2-pyrfc3339-1.0-2.el7.noarch.rpm                                                                                                   |  13 kB  00:00:00
(14/16): dialog-1.2-4.20130523.el7.x86_64.rpm                                                                                                     | 208 kB  00:00:02
(15/16): python-zope-interface-4.0.5-4.el7.x86_64.rpm                                                                                             | 138 kB  00:00:02
(16/16): pytz-2012d-5.el7.noarch.rpm                                                                                                              |  38 kB  00:00:00
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                    740 kB/s | 2.5 MB  00:00:03
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : python-zope-interface-4.0.5-4.el7.x86_64                                                                                                             1/16
  Installing : dialog-1.2-4.20130523.el7.x86_64                                                                                                                     2/16
  Installing : python2-dialog-3.3.0-6.el7.noarch                                                                                                                    3/16
  Installing : pytz-2012d-5.el7.noarch                                                                                                                              4/16
  Installing : python-parsedatetime-1.5-3.el7.noarch                                                                                                                5/16
  Installing : python2-future-0.16.0-2.el7.noarch                                                                                                                   6/16
  Installing : python-psutil-2.2.1-1.el7.x86_64                                                                                                                     7/16
  Installing : python-zope-event-4.0.3-2.el7.noarch                                                                                                                 8/16
  Installing : 1:python-zope-component-4.1.0-3.el7.noarch                                                                                                           9/16
  Installing : python-ndg_httpsclient-0.3.2-1.el7.noarch                                                                                                           10/16
  Installing : python2-pyrfc3339-1.0-2.el7.noarch                                                                                                                  11/16
  Installing : python2-acme-0.14.1-1.el7.noarch                                                                                                                    12/16
  Installing : python2-configargparse-0.11.0-1.el7.noarch                                                                                                          13/16
  Installing : python2-mock-1.0.1-9.el7.noarch                                                                                                                     14/16
  Installing : python2-certbot-0.14.1-3.el7.noarch                                                                                                                 15/16
  Installing : certbot-0.14.1-3.el7.noarch                                                                                                                         16/16
restorecon:  lstat(/etc/letsencrypt) failed:  No such file or directory
  Verifying  : python2-certbot-0.14.1-3.el7.noarch                                                                                                                  1/16
  Verifying  : python2-mock-1.0.1-9.el7.noarch                                                                                                                      2/16
  Verifying  : python2-configargparse-0.11.0-1.el7.noarch                                                                                                           3/16
  Verifying  : python2-pyrfc3339-1.0-2.el7.noarch                                                                                                                   4/16
  Verifying  : python-zope-interface-4.0.5-4.el7.x86_64                                                                                                             5/16
  Verifying  : python-ndg_httpsclient-0.3.2-1.el7.noarch                                                                                                            6/16
  Verifying  : python-zope-event-4.0.3-2.el7.noarch                                                                                                                 7/16
  Verifying  : python-psutil-2.2.1-1.el7.x86_64                                                                                                                     8/16
  Verifying  : certbot-0.14.1-3.el7.noarch                                                                                                                          9/16
  Verifying  : 1:python-zope-component-4.1.0-3.el7.noarch                                                                                                          10/16
  Verifying  : python2-dialog-3.3.0-6.el7.noarch                                                                                                                   11/16
  Verifying  : python2-future-0.16.0-2.el7.noarch                                                                                                                  12/16
  Verifying  : python-parsedatetime-1.5-3.el7.noarch                                                                                                               13/16
  Verifying  : python2-acme-0.14.1-1.el7.noarch                                                                                                                    14/16
  Verifying  : pytz-2012d-5.el7.noarch                                                                                                                             15/16
  Verifying  : dialog-1.2-4.20130523.el7.x86_64                                                                                                                    16/16

Installed:
  certbot.noarch 0:0.14.1-3.el7

Dependency Installed:
  dialog.x86_64 0:1.2-4.20130523.el7                        python-ndg_httpsclient.noarch 0:0.3.2-1.el7              python-parsedatetime.noarch 0:1.5-3.el7
  python-psutil.x86_64 0:2.2.1-1.el7                        python-zope-component.noarch 1:4.1.0-3.el7               python-zope-event.noarch 0:4.0.3-2.el7
  python-zope-interface.x86_64 0:4.0.5-4.el7                python2-acme.noarch 0:0.14.1-1.el7                       python2-certbot.noarch 0:0.14.1-3.el7
  python2-configargparse.noarch 0:0.11.0-1.el7              python2-dialog.noarch 0:3.3.0-6.el7                      python2-future.noarch 0:0.16.0-2.el7
  python2-mock.noarch 0:1.0.1-9.el7                         python2-pyrfc3339.noarch 0:1.0-2.el7                     pytz.noarch 0:2012d-5.el7

Complete!
WARNING: yacc table file version is out of date
Installing CA certificate, please wait
CA certificate successfully installed
The ipa-cacert-manage command was successful
WARNING: yacc table file version is out of date
ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: Not logging to a file
ipa: DEBUG: Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: trying https://pae01.domain.org/ipa/json
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: Created connection context.rpcclient_30052752
ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: Forwarding 'schema' to json server 'https://pae01.domain.org/ipa/json'
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: Destroyed connection context.rpcclient_30052752
ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG:   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipaclient/ipa_certupdate.py", line 54, in run
    api.finalize()
  File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 707, in finalize
    self.__do_if_not_done('load_plugins')
  File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 422, in __do_if_not_done
    getattr(self, name)()
  File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 585, in load_plugins
    for package in self.packages:
  File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line 919, in packages
    ipaclient.remote_plugins.get_package(self),
  File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py", line 118, in get_package
    plugins = schema.get_package(server_info, client)
  File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 543, in get_package
    schema = Schema(client)
  File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 387, in __init__
    fingerprint, ttl = self._fetch(client, ignore_cache=read_failed)
  File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 426, in _fetch
    schema = client.forward(u'schema', **kwargs)['result']
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 986, in forward
    return self._call_command(command, params)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 967, in _call_command
    return command(*params)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1117, in _call
    return self.__request(name, args)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1084, in __request
    verbose=self.__verbose >= 3,
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request
    return self.single_request(host, handler, request_body, verbose)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 617, in single_request
    h = SSLTransport.make_connection(self, host)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 492, in make_connection
    host, self._extra_headers, x509 = self.get_host_info(host)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 574, in get_host_info
    self._handle_exception(e, service=service)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 547, in _handle_exception
    raise errors.CCacheError()

ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: The ipa-certupdate command failed, exception: CCacheError: did not receive Kerberos credentials
ipa.ipaclient.ipa_certupdate.CertUpdate: ERROR: did not receive Kerberos credentials
ipa.ipaclient.ipa_certupdate.CertUpdate: ERROR: The ipa-certupdate command failed.

[root@pae01 freeipa-letsencrypt]# ls -l
total 148
drwxr-xr-x. 2 root root   4096 Jul 11 21:31 ca
-rw-r--r--. 1 root root   7183 Jul 11 22:10 lextab.py
-rw-r--r--. 1 root root    764 Jul 11 21:31 README.md
-rwxr-xr-x. 1 root root   1135 Jul 11 21:52 renew-le.sh
-rwxr-xr-x. 1 root root    394 Jul 11 21:53 setup-le.sh
-rw-r--r--. 1 root root 126135 Jul 11 22:10 yacctab.py
[root@pae01 freeipa-letsencrypt]# python --version
Python 2.7.5
nicki-krizek commented 7 years ago

It seems like you don't have a kerberos ticket.

kinit admin and try to run ./setup-le.sh again.