1.3: Nasty Error when activating UsersAndGroups-module on slave

[Andy]

Hello everybody,

I tried to set up an ebox-master and an ebox-slave.
On the master I created two groups and two users and set the status to "master".

On the slave machine I set the status to "slave" and filled in the IP of the master and the ldap.secret-password.
When activating UsersAndGroups on the slave machine I got a really nasty error, saying that something with permissions went wrong in

Code: [Select]

/usr/share/perl5/EBox/UsersAndGroups.pm line 2493.

I looked after that line

Code: [Select]

write_file(SSL_DIR . 'master.cert', $cert); and here's what did the trick for me:
In

Code: [Select]

/var/lib/ebox/confthere are the two dirs "ssl" and "ssl-ca"
Look at the rights for the dirs and the files in "ssl".
With chmod I set them to rwxrwxrwx (for the dirs) and rw-rw-rw- for the files, then I activated UsersAndGroups again. It worked. After that I set the rights back.

I hope this helps somebody (and I hope I'll found it again when I need it the next time :-)

Kind regards,
Andreas

[philmills]

great, gonna try that!

[philmills]

I'm not so familiar with using chmod thru terminal, but here's what I did:

Code: [Select]

cd var/lib/ebox/conf/
chmod -R 0777 ssl
chmod -R 0777 ssl-ca
I figured that 777 is full read/write so it should work

this doesn't work for me tho...
still getting same error

should i be making these changes on the slave or master (or both)?

any chance you can post exact chmod commands?

[Andy]

Hello,

I did that only on the slave.

Look for the dirs, do they have the rights you set? (drwxrwxrwx)
I did that only with e.g.

Code: [Select]

chmod 777 ssl but I think it's the same.

Can you post the entire error message?

[philmills]

Code: [Select]

drwxrwxrwx 2 ebox adm   4096 2010-01-05 15:48 ssl
drwxrwxrwx 2 ebox adm   4096 2010-01-12 17:51 ssl-ca

error message is as follows:

Code: [Select]

A really nasty bug has occurred
Exception
Failed to enable: Replication failed
Trace
Failed to enable: Replication failed at /usr/share/perl5/EBox/CGI/ServiceModule/ConfigureModuleController.pm line 74
EBox::CGI::ServiceModule::ConfigureModuleController::_process('EBox::CGI::ServiceModule::ConfigureModuleController=HASH(0xac...') called at /usr/share/perl5/EBox/CGI/Base.pm line 262
EBox::CGI::Base::run('EBox::CGI::ServiceModule::ConfigureModuleController=HASH(0xac...') called at /usr/share/perl5/EBox/CGI/Run.pm line 120
EBox::CGI::Run::run('EBox::CGI::Run', 'ServiceModule/ConfigureModuleController', 'EBox') called at /usr/share/ebox/cgi/ebox.cgi line 19
ModPerl::ROOT::ModPerl::Registry::usr_share_ebox_cgi_ebox_2ecgi::handler('Apache2::RequestRec=SCALAR(0xac7ffe0)') called at /usr/lib/perl5/ModPerl/RegistryCooker.pm line 204
eval {...} called at /usr/lib/perl5/ModPerl/RegistryCooker.pm line 204
ModPerl::RegistryCooker::run('ModPerl::Registry=HASH(0xaca0db8)') called at /usr/lib/perl5/ModPerl/RegistryCooker.pm line 170
ModPerl::RegistryCooker::default_handler('ModPerl::Registry=HASH(0xaca0db8)') called at /usr/lib/perl5/ModPerl/Registry.pm line 31
ModPerl::Registry::handler('ModPerl::Registry', 'Apache2::RequestRec=SCALAR(0xac7ffe0)') called at -e line 0
eval {...} called at -e line 0


[isaac]

I looked after that line

Code: [Select]

write_file(SSL_DIR . 'master.cert', $cert); and here's what did the trick for me:
In

Code: [Select]

/var/lib/ebox/confthere are the two dirs "ssl" and "ssl-ca"
Look at the rights for the dirs and the files in "ssl".
With chmod I set them to rwxrwxrwx (for the dirs) and rw-rw-rw- for the files, then I activated UsersAndGroups again. It worked. After that I set the rights back.

Uhm, weird, the default rights in my system after a new installation are:

Code: [Select]

drwx------ 2 ebox adm 4096 2010-01-11 14:41 /var/lib/ebox/conf/ssl/
drwxr-xr-x 2 ebox adm 4096 2009-12-24 14:19 /var/lib/ebox/conf/ssl-ca/
which should be just fine.

[philmills]

is there any difference in that regard if installing ebox on an existing ubuntu system or installing from an ebox 1.3 iso ?

[Andy]

@philmills:
It seems you have an other error.
Look at this file:

Code: [Select]

/usr/share/perl5/EBox/CGI/ServiceModule/ConfigureModuleController.pm line 74
Maybe it helps if you deactivate Replication when activating UsersAndGroups. Perhaps Replication causes the error.

@isaac:
I think the granted rights are OK, but for activating UsersAndGroups you have to grant rw-rights for ./ssl  on the slave.
In this dir this module tries to create file. But with the default rights creating the file fails.
Don't forget to write down the default rights and set them back when the module UsersAndGroups was activated.

[philmills]

as far as i understand, replication is what tells the slave to get the user accounts from ldap on the master. How would i deactivate it anyway?

[Andy]

@philmills:
I did a

Code: [Select]

ps ax | grep rep on both servers and only on the slave I found the

Code: [Select]

/etc/ldap/slapd-replica.d running.

You should try this, too.

I think you're right that replication is needed for the LDAP.
But note, that you've had another error so its necessary to investigate for the line with the command that fails.

Did you have a look for

Code: [Select]

/usr/share/perl5/EBox/CGI/ServiceModule/ConfigureModuleController.pm line 74?

[philmills]

Well, that would make sense that a replication service is running on the slave...

line 74 is this:

Code: [Select]

            throw EBox::Exceptions::Internal("Failed to enable: " .
which appears in the else statement of the following:

Code: [Select]

sub _process
{
    my ($self) = @_;

    $self->_requireParam('module');
    my $modName = $self->param('module');
    my $manager = new EBox::ServiceManager();
    my $module = EBox::Global->modInstance($modName);

    $module->setConfigured(1);
    $module->enableService(1);
    $manager->updateModuleDigests($modName);

    try {
        $module->enableActions();
    } otherwise {
        my ($excep) = @_;
        $module->setConfigured(undef);
        $module->enableService(undef);
        if ($excep->isa("EBox::Exceptions::External")) {
            throw EBox::Exceptions::External("Failed to enable: " .
                $excep->stringify());
        } else {
            throw EBox::Exceptions::Internal("Failed to enable: " .
                $excep->stringify());
        }
    };

    $manager->updateModuleDigests($modName);


    $self->{redirect} = "ServiceModule/StatusView";

}

I'm a bit of a newb when it comes to this kinda stuff...
sorry

[philmills]

i opened a ticket for this one now:
http://trac.ebox-platform.com/ticket/1671

[Andy]

Sorry, but I'm also a newbie when it comes to that scripting stuff.
Now I'm on my next problem: activating Email on the slave...

[peterr]

I got this as well

Code: [Select]

A really nasty bug has occurred
Exception
Failed to enable: Replication failed
Trace
Failed to enable: Replication failed at /usr/share/perl5/EBox/CGI/ServiceModule/ConfigureModuleController.pm line 74
EBox::CGI::ServiceModule::ConfigureModuleController::_process('EBox::CGI::ServiceModule::ConfigureModuleController=HASH(0xa7...') called at /usr/share/perl5/EBox/CGI/Base.pm line 262
EBox::CGI::Base::run('EBox::CGI::ServiceModule::ConfigureModuleController=HASH(0xa7...') called at /usr/share/perl5/EBox/CGI/Run.pm line 120
EBox::CGI::Run::run('EBox::CGI::Run', 'ServiceModule/ConfigureModuleController', 'EBox') called at /usr/share/ebox/cgi/ebox.cgi line 19
ModPerl::ROOT::ModPerl::Registry::usr_share_ebox_cgi_ebox_2ecgi::handler('Apache2::RequestRec=SCALAR(0xa794d8c)') called at /usr/lib/perl5/ModPerl/RegistryCooker.pm line 204
eval {...} called at /usr/lib/perl5/ModPerl/RegistryCooker.pm line 204
ModPerl::RegistryCooker::run('ModPerl::Registry=HASH(0xa7b8aac)') called at /usr/lib/perl5/ModPerl/RegistryCooker.pm line 170
ModPerl::RegistryCooker::default_handler('ModPerl::Registry=HASH(0xa7b8aac)') called at /usr/lib/perl5/ModPerl/Registry.pm line 31
ModPerl::Registry::handler('ModPerl::Registry', 'Apache2::RequestRec=SCALAR(0xa794d8c)') called at -e line 0
eval {...} called at -e line 0
I wonder if it is because I tried to run the master with several services not just users and groups - I was guessing this restriction had long since gone as we are quite close to the release date for 1.4 but maybe I am wrong.
I was running a web server as master (so it only had usersandgroups) but the three servers all fell over, to various degrees on upgrade to 12 or 13 so I started again.  I wanted my egroupware and PDC server to be master as I had been unable to use it before to authenticate linux clients (seemed slaves could not manage this)
Whatever the reason by master seems to be running ok and the slave won't play ball (even after the file permission change mentioned)

[peterr]

tried to purge usersandgroups from web server, autoremove and purge everything then updated then reinstalled usersandgroups.
Thsi failed - system remembered it was a master (so purge did not remove all config) and it does not work now