search

inverse-inc / packetfence

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, powerful BYOD management options, 802.1X support, layer-2 isolation of problematic devices; PacketFence can be used to effectively secure networks small to very large heterogeneous networks.
https://packetfence.org
GNU General Public License v2.0
1.27k stars 274 forks source link

PF devel upgrade broken #4908

Closed lzammit closed 4 years ago

lzammit commented 4 years ago

I just upgraded my level environment and it looks broken.

==============================================================================================================================================================================================================================================
 Package                                                 Arch                                       Version                                                                       Repository                                             Size
==============================================================================================================================================================================================================================================
Updating:
 packetfence                                             x86_64                                     9.1.9-20191108171654.94695892.0007.el7                                        packetfence-devel                                      59 M
 packetfence-release                                     noarch                                     2.0.0-20191108171654.94695892.0007.el7                                        packetfence-devel                                     5.8 k

Transaction Summary
==============================================================================================================================================================================================================================================
Upgrade  2 Packages

Total download size: 59 M
Is this ok [y/d/N]: y
Downloading packages:
Delta RPMs disabled because /usr/bin/applydeltarpm not installed.
(1/2): packetfence-release-2.0.0-20191108171654.94695892.0007.el7.noarch.rpm                                                                                                                                           | 5.8 kB  00:00:00
(2/2): packetfence-9.1.9-20191108171654.94695892.0007.el7.x86_64.rpm                                                                                                                                                   |  59 MB  00:00:04
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                                                                                          13 MB/s |  59 MB  00:00:04
Running transaction check
Running transaction test
Transaction test succeeded
Fixed permissions.
Restarting journald to enable persistent logging
Setting packetfence.target as the default systemd target.
Restarting rsyslogd
Makefile:1: config.mk: No such file or directory
make: *** No rule to make target `config.mk'.  Stop.
Disabling httpd startup script
Disabling redis startup script

The config.mk is not there:

[root@c7-testing pf]# ls -ltr
total 9320
-rw-r--r--  1 pf pf    8282 Nov  8 12:30 Makefile
-rw-r--r--  1 pf pf   18013 Nov  8 12:30 COPYING
-rw-r--r--  1 pf pf 9050283 Nov  8 12:30 ChangeLog
drwxr-xr-x  6 pf pf      76 Nov  8 12:30 html
-rw-r--r--  1 pf pf   66406 Nov  8 12:31 UPGRADE.old
-rw-r--r--  1 pf pf   86074 Nov  8 12:31 UPGRADE.asciidoc
-rw-r--r--  1 pf pf     281 Nov  8 12:31 README.network-devices
-rw-r--r--  1 pf pf    4206 Nov  8 12:31 README.md
-rw-r--r--  1 pf pf  131661 Nov  8 12:31 NEWS.old
-rw-r--r--  1 pf pf  103966 Nov  8 12:31 NEWS.asciidoc
drwxr-xr-x 12 pf pf    4096 Nov  8 13:48 addons
drwxr-xr-x  3 pf pf     154 Nov  8 13:48 bin
drwxr-xr-x  2 pf pf    8192 Nov  8 13:48 db
drwxr-xr-x 12 pf pf    4096 Nov  8 13:48 docs
drwxr-xr-x 29 pf pf    4096 Nov  8 13:48 go
drwxr-xr-x 11 pf pf     228 Nov  8 13:48 lib
drwxr-xr-x  9 pf pf    4096 Nov  8 13:48 raddb
drwxr-xr-x  2 pf pf     265 Nov  8 13:48 sbin
drwxrwsr-x 12 pf pf     267 Nov  8 13:48 var
drwxrwsr-x 13 pf pf    8192 Nov  8 13:48 conf
drwxrwsr-x  2 pf pf    4096 Nov  8 13:51 logs
nqb commented 4 years ago

Good catch @lzammit.

I added config.mk in RPM packaging, already presents in Debian.

Please close issue if all is working fine.

lzammit commented 4 years ago

I tested twice:

The first time I did check the time on the server and it was wrong:

Creating non-existing 'fingerbank.conf' file
make: Warning: File `Makefile' has modification time 312610 s in the future
make: warning:  Clock skew detected.  Your build may be incomplete.
  Installing : perl-Catalyst-View-JSON-0.33-5.5.noarch                                                                                                                                                                                749/761
  Installing : perl-Catalyst-View-TT-0.42-7.4.noarch                                                                                                                                                                                  750/761
  Installing : perl-Catalyst-View-CSV-1.7-1.noarch                                                                                                                                                                                    751/761
  Installing : libnetfilter_queue-1.0.2-3.2.x86_64                                                                                                                                                                                    752/761
  Installing : conntrack-tools-1.4.4-5.el7_7.2.x86_64                                                                                                                                                                                 753/761
Created symlink from /etc/systemd/system/mariadb.service to /dev/null.
Warning: mariadb.service changed on disk. Run 'systemctl daemon-reload' to reload units.
Created symlink from /etc/systemd/system/systemd-logind.service to /dev/null.
Creating pf user
Adding pf user to app groups
  Installing : packetfence-9.1.9-20191108185052.94987570.0007.el7.x86_64                                                                                                                                                              754/761
Adding PacketFence config startup script
Restarting journald to enable persistent logging
Setting packetfence.target as the default systemd target.
Removed symlink /etc/systemd/system/default.target.
Created symlink from /etc/systemd/system/default.target to /etc/systemd/system/packetfence.target.
Restarting rsyslogd
Warning: rsyslog.service changed on disk. Run 'systemctl daemon-reload' to reload units.
Makefile:1: config.mk: No such file or directory
make: Warning: File `Makefile' has modification time 899380 s in the future
make: *** No rule to make target `config.mk'.  Stop.
Building default RADIUS certificates...
make: Warning: File `passwords.mk' has modification time 899380 s in the future
openssl dhparam -out dh -2 2048
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time

I reverted the snapshot and I fixed the time:

Adding pf user to app groups
  Installing : packetfence-9.1.9-20191108185052.94987570.0007.el7.x86_64                                                                                                                                                              754/761
Adding PacketFence config startup script
Restarting journald to enable persistent logging
Setting packetfence.target as the default systemd target.
Removed symlink /etc/systemd/system/default.target.
Created symlink from /etc/systemd/system/default.target to /etc/systemd/system/packetfence.target.
Restarting rsyslogd
Makefile:1: config.mk: No such file or directory
make: *** No rule to make target `config.mk'.  Stop.
Building default RADIUS certificates...
openssl dhparam -out dh -2 2048
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time

That time it created the server certificate and the DH key.

nqb commented 4 years ago

Ok. Now, could you make a test with latest package built on devel ? config.mk should be included in RPM.

lzammit commented 4 years ago

I tried to restart and the certs are not there.

FATAL - please define exactly one management interface
WARNING - internal network(s) not defined!
FATAL - Unable to connect to your database. Please verify your connection settings in conf/pf.conf and make sure that it is started.
WARNING - networks.conf is empty but services.dhcpd is enabled. Disable it to remove this warning.
FATAL - Cannot connect to database to check schema version: unable to connect to database: Access denied for user 'pf'@'localhost' (using password: YES) at /usr/local/pf/lib/pf/dal.pm line 69.
WARNING - Cannot open the following certificate /usr/local/pf/conf/ssl/server.pem
WARNING - Cannot open the following certificate /usr/local/pf/conf/ssl/server.crt

Yes, that's the latest devel:

[root@c7-testing pf]# yum list installed packetfence
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: centos.mirror.netelligent.ca
 * extras: centos.mirror.netelligent.ca
 * updates: centos.mirror.netelligent.ca
Installed Packages
packetfence.x86_64                                                                                  9.1.9-20191108185052.94987570.0007.el7                                                                                  @packetfence-devel
lzammit commented 4 years ago 
[root@c7-testing pf]# ll
total 9316
drwxr-xr-x. 12 pf pf    4096 Nov 11 09:22 addons
drwxr-xr-x.  3 pf pf     154 Nov 11 09:22 bin
-rw-r--r--.  1 pf pf 9050283 Nov 10 23:23 ChangeLog
drwxrwsr-x. 13 pf pf    8192 Nov 11 09:22 conf
-rw-r--r--.  1 pf pf   18013 Nov 10 23:23 COPYING
drwxr-xr-x.  2 pf pf    8192 Nov 11 09:22 db
drwxr-xr-x. 12 pf pf    4096 Nov 11 09:22 docs
drwxr-xr-x. 29 pf pf    4096 Nov 11 09:22 go
drwxr-xr-x.  6 pf pf      76 Nov 11 09:22 html
drwxr-xr-x. 11 pf pf     228 Nov 11 09:22 lib
drwxrwsr-x.  2 pf pf     204 Nov 11 09:23 logs
-rw-r--r--.  1 pf pf    8282 Nov 10 23:23 Makefile
-rw-r--r--.  1 pf pf  103966 Nov 10 23:23 NEWS.asciidoc
-rw-r--r--.  1 pf pf  131661 Nov 10 23:23 NEWS.old
drwxr-xr-x.  9 pf pf    4096 Nov 11 09:22 raddb
-rw-r--r--.  1 pf pf    4206 Nov 10 23:23 README.md
-rw-r--r--.  1 pf pf     281 Nov 10 23:23 README.network-devices
drwxr-xr-x.  2 pf pf     265 Nov 11 09:22 sbin
-rw-r--r--.  1 pf pf   86074 Nov 10 23:23 UPGRADE.asciidoc
-rw-r--r--.  1 pf pf   66406 Nov 10 23:23 UPGRADE.old
drwxrwsr-x. 12 pf pf     192 Nov 11 09:22 var
nqb commented 4 years ago

I push a new commit into devel to fix (https://github.com/inverse-inc/packetfence/commit/268f15269e02aecc209281eaa3d9f4b49db5de57) and trigger a new pipeline. Should be good in ~20 minutes.

lzammit commented 4 years ago

It fixes it but I do have an issue with this, is there any particular reason that file need to be put in /usr/local/pf?

I do a lot of auto-completion with the conf/ directory and now it does not show up as before because of that file, can it be moved somewhere else ?

Thanks!

lzammit commented 4 years ago

Edit: is it removed after the install ? It's not present now.

Forget my previous suggestion

nqb commented 4 years ago

Hi @lzammit,

It should work as expected now:

# rpm -qa|grep packetfence
packetfence-9.1.9-20191112123512.95344370.0007.el7.x86_64
packetfence-release-2.0.0-20191112123512.95344370.0007.el7.noarch

# rpm -ql packetfence|grep config.mk
/usr/local/pf/config.mk

Edit: is it removed after the install ? It's not present now.

No, file is included in RPM like any other file.

nqb commented 4 years ago

I do a lot of auto-completion with the conf/ directory and now it does not show up as before because of that file, can it be moved somewhere else ?

I suppose what you mean is now you need to enter conf/ in place of c+TAB or co+TAB before. In that case, we can rename this file to another name later.

This file is only necessary during installation and post-installation steps, you can remove it after if you want.