Re: [Pki-users] How to setup PKI CA to ask for passwords at startup?

One big difference in starting PKI under nuxwdog control is that pki-tomcatd(a)pki-tomcat.service starts PKI as pkiuser:pkiuser but pki-tomcatd-nuxwdog(a)pki-tomcat.service starts PKI as root:root. Running PKI as root user is bad idea. On Thu, Aug 27, 2015 at 2:33 PM, Aleksey Chudov <aleksey.chudov(a)gmail.com&gt; wrote: > To begin with I have updated to version 10.2.6 from F22 testing to get > pki-server man pages. > > Enabling nuxwdog solves the problem. Thank you! > > On Wed, Aug 26, 2015 at 10:06 PM, Ade Lee <alee(a)redhat.com&gt; wrote: > >> Aleksey, >> >> password prompting in CS 8.1 worked because of a utility program called >> nuxwdog which would prompt for passwords. >> >> We have done some work to get nuxwdog working with the latest Dogtag >> code, but there is some setup required. >> Fortunately, all that setup has been encapsulated in the pki-server >> utility. >> >> For details, man pki-server , man pki-server-instance and man >> pki-server-nuxwdog. >> >> The specific command would be: >> pki-server instance-nuxwdog-enable <instance_id ie. pki-tomcat> >> >> You should then be prompted for the passwords, and can remove your >> password.conf file. >> >> Ade >> On Wed, 2015-08-26 at 21:49 +0300, Aleksey Chudov wrote: >> >> I'm looking at removing at least nss password but both nss and 389 >> passwords will be better. >> >> Actually PKI prompts for password but I don't see the prompt because of >> systemd. >> >> To reproduce >> >> systemctl stop pki-tomcatd(a)pki-tomcat.service >> sed -i.bak '/internal=/d' /etc/pki/pki-tomcat/password.conf >> systemctl start pki-tomcatd(a)pki-tomcat.service >> >> /var/log/messages >> Aug 26 21:37:33 srv333 server[8889]: Enter password for Internal Key >> Storage Token >> >> /var/log/pki/pki-tomcat/ca/debug >> [26/Aug/2015:21:37:52][localhost-startStop-1]: Got token Internal Key >> Storage Token by name >> [26/Aug/2015:21:37:52][localhost-startStop-1]: SigningUnit init: debug >> org.mozilla.jss.util.IncorrectPasswordException >> Invalid Password >> at com.netscape.ca.SigningUnit.init(SigningUnit.java:192) >> at >> com.netscape.ca.CertificateAuthority.initSigUnit(CertificateAuthority.java:1229) >> at >> com.netscape.ca.CertificateAuthority.init(CertificateAuthority.java:342) >> at >> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1107) >> at >> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1013) >> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:520) >> at com.netscape.certsrv.apps.CMS.init(CMS.java:187) >> at com.netscape.certsrv.apps.CMS.start(CMS.java:1601) >> at >> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114) >> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >> at >> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) >> at >> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) >> at java.lang.reflect.Method.invoke(Method.java:606) >> at >> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277) >> at >> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274) >> at java.security.AccessController.doPrivileged(Native Method) >> at javax.security.auth.Subject.doAsPrivileged(Subject.java:536) >> at >> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309) >> at >> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:169) >> at >> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:123) >> at >> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1272) >> at >> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1197) >> at >> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1087) >> at >> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5210) >> at >> org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5493) >> at >> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150) >> at >> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901) >> at >> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) >> at >> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156) >> at >> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145) >> at java.security.AccessController.doPrivileged(Native Method) >> at >> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:875) >> at >> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:632) >> at >> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:672) >> at >> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1862) >> at >> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471) >> at java.util.concurrent.FutureTask.run(FutureTask.java:262) >> at >> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) >> at >> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) >> at java.lang.Thread.run(Thread.java:745) >> [26/Aug/2015:21:37:52][localhost-startStop-1]: CMSEngine.shutdown() >> >> >> On Wed, Aug 26, 2015 at 8:09 PM, Dave Sirrine <dsirrine(a)redhat.com&gt; >> wrote: >> >> Aleksey, >> >> Did removing the password from the file not cause the system to prompt >> you for the password at startup. Also, are you looking at doing both nss >> and 389 passwords? >> >> -- David >> On Aug 26, 2015 5:58 AM, "Aleksey Chudov" <aleksey.chudov(a)gmail.com&gt; >> wrote: >> >> Hi, >> >> The password.conf file stores system passwords in plaintext, and I >> prefer to enter system passwords manually and to remove the password file. >> >> I have found original documentation >> https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/.... >> But it is for older version on PKI and does not work with systemd. >> >> How to setup PKI CA to ask for NSS DB password at startup? >> >> Packages versions (I have rebuilt F22 packages for CentOS 7): >> # rpm -qa | grep pki >> pki-base-10.2.5-1.el7.centos.noarch >> pki-server-10.2.5-1.el7.centos.noarch >> dogtag-pki-server-theme-10.2.5-1.el7.centos.noarch >> pki-ca-10.2.5-1.el7.centos.noarch >> pki-tools-10.2.5-1.el7.centos.x86_64 >> dogtag-pki-console-theme-10.2.5-1.el7.centos.noarch >> >> Aleksey >> >> _______________________________________________ >> Pki-users mailing list >> Pki-users(a)redhat.com >> https://www.redhat.com/mailman/listinfo/pki-users >> >> >> >> _______________________________________________ >> Pki-users mailing listPki-users@redhat.comhttps://www.redhat.com/mailman/listinfo/pki-users >> >> >