Home / user-176044

ndemarco's questions

Martin Hope
ndemarco
Asked: 2021-05-18 17:00:13 +0800 CST
  • 2

AWS Lightsail supports container services, with deployment - kind of Docker compose structure. Add multiple containers, specify environment variables, and entrypoint, and choose to add a public IP.

Separately, Lightsail offers storage, as a block device. These can be connected to Lightsail instances.

I've been unable to find how to add persistent storage to a container deployment. What are some good ways to persist files?

amazon-lightsail
Martin Hope
ndemarco
Asked: 2020-03-05 06:51:38 +0800 CST
  • 1

I'm attempting to make VMWare's certificate authority (VMCA) v6.7 a trusted sub-CA of a FreeIPA certificate authority. I should be able to generate a certificate signing request within VMCA using either an interactive tool (certificate-manager) or by using VMWare's certool and a config file (certool.cfg).

Of course, interactive tools have their appeal. The tool asks questions. Some answers are required:

Press Enter key to skip optional parameters or use Previous value.

Enter proper value for 'Country' [Previous value : US] : 

Enter proper value for 'Name' [Previous value : vcenter.int.demarcohome.com] : 

Enter proper value for 'Organization' [Previous value : DeMarco Home] : 

Enter proper value for 'OrgUnit' [Previous value : none] : 

Enter proper value for 'State' [Previous value : North Carolina] : 

Enter proper value for 'Locality' [Previous value : Raleigh] : 

Enter proper value for 'IPAddress' (Provide comma separated values for multiple IP addresses) [optional] : 

Enter proper value for 'Email' [Previous value : [email protected]] : 

Enter proper value for 'Hostname' (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : vcenter.int.demarcohome.com

Enter proper value for VMCA 'Name' : vcenter

Within FreeIPA, when I attempt to sign this CSR, the request is not signed, with error #3009:

invalid 'csr': subject alt name type RFC822Name is forbidden for non-user principals

Decoding the CSR (https://www.sslshopper.com/csr-decoder.html) tells me it includes subject alternate names (SANs):

email:[email protected],
IP Address:10.71.73.8
vcenter.int.demarcohome.com

The error 'Name is forbidden for non-user principals' makes some sense to me, but not enough to point me in the right direction. Do I need to format my CSR differently by answering the questions differently, or am I going about the process of creating a subordinate CA incorrectly within FreeIPA?

vmware-vcenter certificate freeipa x509
Martin Hope
ndemarco
Asked: 2020-02-29 18:24:49 +0800 CST
  • 0

FreeIPA uses dogtag and NSS for PKI. Ubuntu and a lot of the world uses OpenSSL. I now have a pair of FreeIPA test servers replicating certificate functionality, and the single interface for authentication, authorization, and DNS is convenient. I'm more familiar with OpenSSL

I do not understand, however, how to configure Apache2's HTTPd to authenticate a site based on dogtag certificates. I'm trying to Apache module mod_ssl to work using these instructions: https://pagure.io/mod_nss. My certificate is valid. How do I get a site to be trusted (similar to 'SSLCertificateFile /path/to/cert.pem' and the associated key file)?

I'd appreciate a snippet of how that part of the VirtualHost directive should look.

Edit: I know I could convert/export the cert, but this would require manual work to renew/replace the cert. (http://itdoc.hitachi.co.jp/manuals/3020/30203Y1800e/EY180073.HTM)

apache2 freeipa dogtags
Martin Hope
ndemarco
Asked: 2020-02-25 13:34:26 +0800 CST
  • 0

In a browser, for URI server.group.myhomenetwork.com, I should be able to type server.group/ and press Enter. The browser autocompletes the URI to server.group.myhomenetwork.com and fetches the resource.

I've worked in networks that behave this way. How is it accomplished? DNS configuration? Web browser configuration? I'd like to configure this in my network.

uri
Martin Hope
ndemarco
Asked: 2015-05-10 14:41:09 +0800 CST
  • 0

Edit: This was a generally awful question, as in not well documented. It wasn't generally awful in that I truly didn't know what was going wrong, and had been searching and researching. I finally turned to ServerFault with a "BBBBLLLLaaarrggghhh" type question. The title still stands, but the body should have been:

My DNS server appears to be resolving my queries with different answers depending on what network I'm attached to. Examples are:

# DiG command
  resulting output from first zone

# DiG command
  resulting output from second zone

I'll gladly provide more supporting detail. Please explain how I should get the supporting detail, though.

Now back to my awful question:

I've read a lot of other ServerFault BIND9 DNS not forwarding questions and answers. Queries (using DiG) for FQDNs I expect to be forwarded respond as if the public internet has the authoritative answer. Beyond DiG, what tools can I use to trace through my BIND9 configuration? It appears the zone I'm trying to forward is not forwarding.

Specifically, I am at home with a VPN to my work. I want to access my home zone (myhome.com., with DNS server at 10.71.73.10) and also my work zone (mywork.com., with DNS server at 10.10.1.33).

Using DiG to query hostname.mywork.com, DiG reports the AUTHORITY to be the public nameserver. The local resolver seems to ignore the BIND forwarding zone (db.mywork.com).

In /etc/bind/zones/db.mywork.com
// forwards mywork queries to the mywork DNS servers
zone "mywork.com" {
        type forward;
        forwarders { 10.10.1.33; };
};

bind.conf: include "/etc/bind/named.conf.options"; include "/etc/bind/named.conf.local"; include "/etc/bind/named.conf.default-zones"; include "/etc/bind/rndc.key"; include "/etc/bind/named.conf.logging";

controls {
  inet 127.0.0.1 port 953
  allow { 127.0.0.1; } keys { "rndc-key"; };
};

named.conf.options

acl goodclients {
        10.71.73.0/24;
        localhost;
        localnets;
};

options {
        directory "/var/cache/bind";
        forwarders {
                8.8.8.8;        # Google DNS #1
                8.8.4.4;        # Google DNS #2
        };
        recursion yes;
        allow-query { goodclients; };

        dnssec-enable no;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
        listen-on port 53 { localhost; };
};

and named.conf.local

# Forward zone
zone "myhome.com." {
        type master;
        file "/etc/bind/zones/db.myhome.com";
};

# Reverse zone
zone "73.71.10.in-addr.arpa" IN {
        type master;
        notify no;
        file "/etc/bind/zones/db.10";
};
bind
Martin Hope
ndemarco
Asked: 2015-05-10 13:59:02 +0800 CST
  • 1

In FreeIPA, when browsing to the web UI, a failed authentication session should redirect to http://<servername>/browserconfig.html. Mine does not.

Maybe I'm over complicating things, but the default FreeIPA Apache ipa.conf appears to disable non-kerberos sessions for the directory.

Following is excerpt of ipa.conf 

# Protect /ipa and everything below it in webspace with Apache Kerberos auth
<Location "/ipa">
  AuthType Kerberos
  AuthName "Kerberos Login"
  KrbMethodNegotiate on
  KrbMethodK5Passwd off
  KrbServiceName HTTP
  KrbAuthRealms <servername>
  Krb5KeyTab /etc/httpd/conf/ipa.keytab
  KrbSaveCredentials on
  KrbConstrainedDelegation on
  Require valid-user
  ErrorDocument 401 /ipa/errors/unauthorized.html
</Location>

Unfortunately, this does not work on my server. When I fail authentication, I get a 404 Not Found message instead. I'm not sure why.

apache-2.4