12:40 a.m.
This patch documents continued implementation of the PKI Deployment
Framework based upon the revised filesystem layout documented here:
*
http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment#CA_.2F_KRA_.2F_...
This patch addresses the following issues:
* TRAC Ticket #263 - Dogtag 10: Fix 'pkidestroy' problem of
sporadically "not" removing "/etc/sysconfig/{pki_instance_id}" . .
.
* TRAC Ticket #264 - Dogtag 10: Enable various other subsystems for
configuration . . .
* TRAC Ticket #261 - Dogtag 10: Revisit command-line options of
'pkispawn' and 'pkidestroy' . . .
* TRAC Ticket #268 - Dogtag 10: Create a parameter for optional
restart of configured PKI instance . . .
* TRAC Ticket #270 - Dogtag 10: Add missing parameters to
'pkideployment.cfg' . . .
* TRAC Ticket #265 - Dogtag 10: Provide configurable options for PKI
client information . . .
* TRAC Ticket #275 - Dogtag 10: Add debug information (comments) to
Tomcat 7 "logging.properties"
* TRAC Ticket #276 - Dogtag 10: Relocate all 'pin' data to the
'sensitive' dictionary
* TRAC Ticket #277 - Dogtag 10: Create an 'archive' for 'manifest' and
'pkideployment.cfg' files
*WARNING: Due to some of the changes to the command-line parameters
(mainly the introduction of a dependency on the existence of a new
symlink), instances previously created with the old "pkispawn" will once
again need to be removed by the old "pkidestroy" PRIOR to the
installation of this patch.*
Note: You will definitely need to establish the following "passwords"
in your copy of "pkideployment.cfg" in order to install a "CA":
* pki_admin_password
* pki_client_pkcs12_password
* pki_ds_password
* pki_security_domain_password
I ran the following command: pkispawn -s CA -f
/tmp/pki/pkideployment.cfg -vvv
Unfortunately, for me, out-of-the-box installation failed with the
following problem:
* pkispawn : ERROR ....... port 8080 has invalid selinux
context http_cache_port_t
This error occurred despite downloading the latest SELinux policies
on my 64-bit Fedora 17 box and compiling 'pki-selinux' against them.
The work-around that I used was to edit
"/usr/lib/python2.7/site-packages/pki/deployment/initialization.py"
and comment out the call to
"util.configuration_file.verify_selinux_ports()" in the 'spawn()'
method.
Re-running the command 'pkispawn -s CA -f /tmp/pki/pkideployment.cfg
-vvv' now produces the following error:
pkispawn : INFO ... populating 'pki.deployment.selinux_setup'
Traceback (most recent call last):
File "/bin/pkispawn", line 225, in <module>
main(sys.argv)
File "/bin/pkispawn", line 212, in main
rv = instance.spawn()
File
"/usr/lib/python2.7/site-packages/pki/deployment/selinux_setup.py",
line 69, in spawn
port1.add(port, "tcp", "s0",
config.PKI_PORT_SELINUX_CONTEXT)
File "/usr/lib64/python2.7/site-packages/seobject.py", line
1045, in add
self.__add(port, proto, serange, type)
File "/usr/lib64/python2.7/site-packages/seobject.py", line
1002, in __add
raise ValueError(_("Port %s/%s already defined") % (proto,
port))
ValueError: Port tcp/8080 already defined
My work-around to fix to this error is to remove the symlinks which
call the 'selinux_setup.py' scriptlet for both 'pkispawn' and
'pkidestroy':
* rm /usr/share/pki/deployment/spawn/*/035_selinux_setup
* rm /usr/share/pki/deployment/destroy/*/985_selinux_setup
Unfortunately, at this stage, sufficient installation has been made
which prevents a new installation, and 'pkidestroy' in its current
incarnation
will be unable to completely remove the instance. Therefore,
presuming an instance name of 'pki-tomcat', run the following commands:
* rm -rf /var/lib/pki
* rm -rf /etc/pki/pki-tomcat/
* rm -rf /etc/sysconfig/pki
* rm -rf /var/log/pki
* rm /etc/sysconfig/pki-tomcat (this command will fail, as it has
not yet been created)
Re-running the command 'pkispawn -s CA -f /tmp/pki/pkideployment.cfg
-vvv'should now run to successful completion!
To test this patch, run the test instructions documented in earlier
patches for installing the Admin Cert.
Note that the 'ca_admin_cert.p12' file is now located under
'/var/lib/pki/{pki-instance-id}/conf/alias/ca_admin_cert.p12', and
since a browser may not
have the appropriate permissions to traverse past the '/var/lib/pki'
directory, the administrator will need to make this file available
(i. e. - copy it to /tmp).
*Please note, that although KRA, OCSP, and TKS installations will
run to completion, at the present time, a crash occurs in the
invocation of the java configuration
client (quite possibly due to the specification of
incorrect/incomplete parameters for these subsystems).*
Thanks,
-- Matt