Cockpit: НС ΡƒΠ΄Π°Π»ΠΎΡΡŒ Π·Π°ΠΏΡƒΡΡ‚ΠΈΡ‚ΡŒ Cockpit ΠΈΠ·-Π·Π° ошибки Π·Π°Π³Ρ€ΡƒΠ·ΠΊΠΈ сСртификатов

Π‘ΠΎΠ·Π΄Π°Π½Π½Ρ‹ΠΉ Π½Π° 21 мая 2020  Β·  5ΠšΠΎΠΌΠΌΠ΅Π½Ρ‚Π°Ρ€ΠΈΠΈ  Β·  Π˜ΡΡ‚ΠΎΡ‡Π½ΠΈΠΊ: cockpit-project/cockpit

ВСрсия ΠΊΠ°Π±ΠΈΠ½Ρ‹: 251-1 amd64
ОБ: Ubuntu 20.20 Linux gen8 5.4.0-26-generic #30-Ubuntu SMP Mon Apr 20 16:58:30 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

Π― установил ΠΊΠ°Π±ΠΈΠ½Ρƒ Π½Π° Gen8 с Ρ‚Π΅Ρ… ΠΏΠΎΡ€, ΠΊΠ°ΠΊ Π±Ρ‹Π» установлСн Π½ΠΎΠ²Ρ‹ΠΉ Ubuntu 20.20, ΠΈ запускал ΠΊΠ°Π±ΠΈΠ½Ρƒ с ошибкой SSL. ΠŸΠΎΡΡ‚ΠΎΠΌΡƒ я попытался ΠΏΠ΅Ρ€Π΅ΡƒΡΡ‚Π°Π½ΠΎΠ²ΠΈΡ‚ΡŒ ΠΊΠ°Π±ΠΈΠ½Ρƒ, Ρ‡Ρ‚ΠΎΠ±Ρ‹ ΠΈΡΠΏΡ€Π°Π²ΠΈΡ‚ΡŒ эту ΠΎΡˆΠΈΠ±ΠΊΡƒ нСдопустимого сСртификата. Но послС этого я большС Π½Π΅ ΠΌΠΎΠ³Ρƒ Π·Π°ΠΏΡƒΡΠΊΠ°Ρ‚ΡŒ ΠΊΠ°Π±ΠΈΠ½Ρƒ с sudo systemctl start cockpit .

$ sudo systemctl status cockpit

● cockpit.service - Cockpit Web Service
     Loaded: loaded (/lib/systemd/system/cockpit.service; static; vendor preset: enabled)
     Active: failed (Result: exit-code) since Thu 2020-05-21 04:06:34 UTC; 7min ago
TriggeredBy: ● cockpit.socket
       Docs: man:cockpit-ws(8)
    Process: 563960 ExecStartPre=/usr/sbin/remotectl certificate --ensure --user=root --group=cockpit-ws --selinux-type= (code=exited, status=0/SUCCESS)
    Process: 563961 ExecStart=/usr/lib/cockpit/cockpit-tls (code=exited, status=1/FAILURE)
   Main PID: 563961 (code=exited, status=1/FAILURE)

May 21 04:06:34 gen8 systemd[1]: cockpit.service: Main process exited, code=exited, status=1/FAILURE
May 21 04:06:34 gen8 systemd[1]: cockpit.service: Failed with result 'exit-code'.
May 21 04:06:34 gen8 systemd[1]: Starting Cockpit Web Service...
May 21 04:06:34 gen8 systemd[1]: Started Cockpit Web Service.
May 21 04:06:34 gen8 cockpit-tls[563961]: cockpit-tls: Could not locate server certificate: Error loading certificates from /etc/cockpit/ws-certs.d: Permission denied
May 21 04:06:34 gen8 systemd[1]: cockpit.service: Main process exited, code=exited, status=1/FAILURE
May 21 04:06:34 gen8 systemd[1]: cockpit.service: Failed with result 'exit-code'.
May 21 04:06:34 gen8 systemd[1]: cockpit.service: Start request repeated too quickly.
May 21 04:06:34 gen8 systemd[1]: cockpit.service: Failed with result 'exit-code'.
May 21 04:06:34 gen8 systemd[1]: Failed to start Cockpit Web Service.
$ journalctl -u cockpit

-- Logs begin at Mon 2020-05-04 05:17:32 UTC, end at Thu 2020-05-21 04:24:00 UTC. --
May 15 14:09:28 gen8 systemd[1]: Starting Cockpit Web Service...
May 15 14:09:28 gen8 remotectl[527778]: Generating temporary certificate using: sscg --quiet --lifetime 3650 --key-strength 2048 --cert-key-file /etc/cockpit/ws-certs.d/0-self-signed.cert --cert-file /etc/cockpit/ws-certs.d/0-self-signed>
May 15 14:09:28 gen8 remotectl[527778]: Error generating temporary dummy cert using sscg, falling back to openssl
May 15 14:09:28 gen8 remotectl[527778]: Generating temporary certificate using: openssl req -x509 -days 36500 -newkey rsa:2048 -keyout /etc/cockpit/ws-certs.d/0-self-signed.347AK0.tmp -keyform PEM -nodes -out /etc/cockpit/ws-certs.d/0-se>
May 15 14:09:28 gen8 systemd[1]: Started Cockpit Web Service.
May 15 14:10:58 gen8 systemd[1]: cockpit.service: Succeeded.
May 15 14:19:34 gen8 systemd[1]: Starting Cockpit Web Service...
May 15 14:19:34 gen8 systemd[1]: Started Cockpit Web Service.
May 15 14:19:57 gen8 systemd[1]: Stopping Cockpit Web Service...
May 15 14:19:57 gen8 systemd[1]: cockpit.service: Succeeded.
May 15 14:19:57 gen8 systemd[1]: Stopped Cockpit Web Service.
May 15 14:23:23 gen8 systemd[1]: Starting Cockpit Web Service...
May 15 14:23:23 gen8 systemd[1]: Started Cockpit Web Service.
May 15 14:24:53 gen8 systemd[1]: cockpit.service: Succeeded.
May 15 14:24:56 gen8 systemd[1]: Starting Cockpit Web Service...
May 15 14:24:56 gen8 systemd[1]: Started Cockpit Web Service.
May 15 14:25:15 gen8 cockpit-tls[529527]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:25:46 gen8 cockpit-tls[529527]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:25:46 gen8 cockpit-tls[529527]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:27:16 gen8 systemd[1]: cockpit.service: Succeeded.
May 15 14:38:02 gen8 systemd[1]: Starting Cockpit Web Service...
May 15 14:38:02 gen8 systemd[1]: Started Cockpit Web Service.
May 15 14:38:02 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:38:03 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:38:03 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:38:03 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:38:11 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:38:11 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:38:11 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:39:24 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: Decryption has failed.
May 15 14:39:28 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: Decryption has failed.
May 15 14:39:32 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: Decryption has failed.
May 15 14:39:37 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:39:37 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:40:40 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:40:40 gen8 cockpit-tls[530315]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
May 15 14:42:10 gen8 systemd[1]: cockpit.service: Succeeded.
May 20 07:34:15 gen8 systemd[1]: Starting Cockpit Web Service...
May 20 07:34:15 gen8 systemd[1]: Started Cockpit Web Service.
May 20 07:35:53 gen8 systemd[1]: cockpit.service: Succeeded.
May 20 07:40:42 gen8 systemd[1]: Starting Cockpit Web Service...
May 20 07:40:42 gen8 systemd[1]: Started Cockpit Web Service.
May 20 07:42:12 gen8 systemd[1]: cockpit.service: Succeeded.
May 20 07:45:38 gen8 systemd[1]: Starting Cockpit Web Service...
May 20 07:45:38 gen8 systemd[1]: Started Cockpit Web Service.
May 20 07:47:39 gen8 systemd[1]: cockpit.service: Succeeded.
May 20 08:03:05 gen8 systemd[1]: Starting Cockpit Web Service...
May 20 08:03:05 gen8 systemd[1]: Started Cockpit Web Service.
May 20 08:03:12 gen8 cockpit-tls[559075]: cockpit-tls: gnutls_handshake failed: Decryption has failed.
May 20 08:03:42 gen8 cockpit-tls[559075]: cockpit-tls: gnutls_handshake failed: Decryption has failed.
May 20 08:05:12 gen8 systemd[1]: cockpit.service: Succeeded.
May 20 08:09:23 gen8 systemd[1]: Starting Cockpit Web Service...
May 20 08:09:23 gen8 systemd[1]: Started Cockpit Web Service.
May 20 08:10:53 gen8 systemd[1]: cockpit.service: Succeeded.
$ sudo ls -al /etc/cockpit
drwx------   2 root root 4096 May 21 04:04 ws-certs.d
$ sudo ls -al /etc/cockpit/ws-certs.d
-rw-r----- 1 root cockpit-ws 2853 May 21 04:04 0-self-signed.cert

Π― Π΄ΡƒΠΌΠ°ΡŽ, Ρ‡Ρ‚ΠΎ с ΠΌΠΎΠ΅ΠΉ ΠΏΠ°ΠΏΠΊΠΎΠΉ / etc / cockpit Ρ‡Ρ‚ΠΎ-Ρ‚ΠΎ странно, Π½ΠΎ понятия Π½Π΅ имСю, Ρ‡Ρ‚ΠΎ с Π½Π΅ΠΉ Π΄Π΅Π»Π°Ρ‚ΡŒ.

Π‘Π°ΠΌΡ‹ΠΉ ΠΏΠΎΠ»Π΅Π·Π½Ρ‹ΠΉ ΠΊΠΎΠΌΠΌΠ΅Π½Ρ‚Π°Ρ€ΠΈΠΉ

@kxxoling : синтаксичСски это Π΄Π΅ΠΉΡΡ‚Π²ΠΈΡ‚Π΅Π»ΡŒΠ½Ρ‹ΠΉ сСртификат, Π½ΠΎ, ΠΊΠ°ΠΊ слСдуСт ΠΈΠ· названия, ΠΎΠ½ самоподписанный. Π’Π°ΠΊΠΈΠΌ ΠΎΠ±Ρ€Π°Π·ΠΎΠΌ, curl (ΠΊΠ°ΠΊ ΠΈ ваш Π±Ρ€Π°ΡƒΠ·Π΅Ρ€) Π½Π΅ ΠΏΡ€ΠΈΠ½ΠΈΠΌΠ°Π΅Ρ‚ Π΅Π³ΠΎ ΠΏΠΎ ΡƒΠΌΠΎΠ»Ρ‡Π°Π½ΠΈΡŽ. Π’Ρ‹ ΠΌΠΎΠΆΠ΅Ρ‚Π΅ Π² любом случаС ΠΏΡ€ΠΈΠ½ΡΡ‚ΡŒ Π΅Π³ΠΎ ( curl -k ΠΈΠ»ΠΈ Π½Π°ΠΆΠ°Ρ‚ΡŒ ΠΊΠ½ΠΎΠΏΠΊΡƒ Π² Π±Ρ€Π°ΡƒΠ·Π΅Ρ€Π΅) ΠΈΠ»ΠΈ, Ρ‡Ρ‚ΠΎ Π»ΡƒΡ‡ΡˆΠ΅, Π΄ΠΎΠ±Π°Π²ΠΈΡ‚ΡŒ свой собствСнный .

ВсС 5 ΠšΠΎΠΌΠΌΠ΅Π½Ρ‚Π°Ρ€ΠΈΠΉ

@kxxoling : Π’Π΅Ρ€Π½ΠΎ, ΠΏΠ°ΠΏΠΊΠ° /etc/cockpit/ws-certs.d/ доступна Ρ‚ΠΎΠ»ΡŒΠΊΠΎ для root. Π­Ρ‚ΠΎ Π΄ΠΎΠ»ΠΆΠ½ΠΎ Π±Ρ‹Ρ‚ΡŒ 0755. ΠŸΠ°Ρ…Π½Π΅Ρ‚ ΠΊΠ°ΠΊΠΎΠΉ-Ρ‚ΠΎ ΠΏΡ€ΠΎΠ±Π»Π΅ΠΌΠΎΠΉ umask - Ρƒ вас ΠΎΡ‡Π΅Π½ΡŒ тугая для root, Π½Π°ΠΏΡ€ΠΈΠΌΠ΅Ρ€ 077?

@martinpitt Π― попытался чисто ΠΏΠ΅Ρ€Π΅ΡƒΡΡ‚Π°Π½ΠΎΠ²ΠΈΡ‚ΡŒ /etc/cockpit ΠΏΠ°ΠΏΠΊΠ° machines.d ΠΏΠΎΠ΄ /etc/cockpit рядом с ws-certs.d . И Ρ‚Π΅ΠΏΠ΅Ρ€ΡŒ cockpit-ws запускаСтся Ρ…ΠΎΡ€ΠΎΡˆΠΎ, Π·Π° ΠΈΡΠΊΠ»ΡŽΡ‡Π΅Π½ΠΈΠ΅ΠΌ ΠΏΡ€ΠΎΠ±Π»Π΅ΠΌΡ‹ https:

$ curl https://localhost:9090
curl: (60) SSL certificate problem: self signed certificate

Π Π°Π·Π²Π΅ 0-self-signed.cert являСтся ΡŽΡ€ΠΈΠ΄ΠΈΡ‡Π΅ΡΠΊΠΈΠΌ сСртификатом CA? Или я Π΄ΠΎΠ»ΠΆΠ΅Π½ сам ΠΏΠΎΠ΄Π΄Π΅Ρ€ΠΆΠΈΠ²Π°Ρ‚ΡŒ сСртификат?

@kxxoling : синтаксичСски это Π΄Π΅ΠΉΡΡ‚Π²ΠΈΡ‚Π΅Π»ΡŒΠ½Ρ‹ΠΉ сСртификат, Π½ΠΎ, ΠΊΠ°ΠΊ слСдуСт ΠΈΠ· названия, ΠΎΠ½ самоподписанный. Π’Π°ΠΊΠΈΠΌ ΠΎΠ±Ρ€Π°Π·ΠΎΠΌ, curl (ΠΊΠ°ΠΊ ΠΈ ваш Π±Ρ€Π°ΡƒΠ·Π΅Ρ€) Π½Π΅ ΠΏΡ€ΠΈΠ½ΠΈΠΌΠ°Π΅Ρ‚ Π΅Π³ΠΎ ΠΏΠΎ ΡƒΠΌΠΎΠ»Ρ‡Π°Π½ΠΈΡŽ. Π’Ρ‹ ΠΌΠΎΠΆΠ΅Ρ‚Π΅ Π² любом случаС ΠΏΡ€ΠΈΠ½ΡΡ‚ΡŒ Π΅Π³ΠΎ ( curl -k ΠΈΠ»ΠΈ Π½Π°ΠΆΠ°Ρ‚ΡŒ ΠΊΠ½ΠΎΠΏΠΊΡƒ Π² Π±Ρ€Π°ΡƒΠ·Π΅Ρ€Π΅) ΠΈΠ»ΠΈ, Ρ‡Ρ‚ΠΎ Π»ΡƒΡ‡ΡˆΠ΅, Π΄ΠΎΠ±Π°Π²ΠΈΡ‚ΡŒ свой собствСнный .

@martinpitt Π― понял. ВмСсто этого я ΠΏΠΎΠΏΡ€ΠΎΠ±ΡƒΡŽ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ подписанный Let's Encrypt. Π­Ρ‚ΠΎ ΠΌΠΎΠΆΠ΅Ρ‚ Ρ€Π΅ΡˆΠΈΡ‚ΡŒ ΠΏΡ€ΠΎΠ±Π»Π΅ΠΌΡƒ с сСртификатом.

Ошибка запуска слуТбы ΠΌΠΎΠΆΠ΅Ρ‚ Π±Ρ‹Ρ‚ΡŒ Π²Ρ‹Π·Π²Π°Π½Π° ΠΌΠΎΠ΅ΠΉ ΡΠ»ΡƒΡ‡Π°ΠΉΠ½ΠΎΡΡ‚ΡŒΡŽ, Π½ΠΎ полная пСрСустановка ΠΌΠΎΠΆΠ΅Ρ‚ Ρ€Π΅ΡˆΠΈΡ‚ΡŒ Π΅Π΅. Π’Π°ΠΊ Ρ‡Ρ‚ΠΎ Π·Π°ΠΊΡ€ΠΎΡŽ этот выпуск.

Бпасибо Π·Π° ΠΏΠΎΠΌΠΎΡ‰ΡŒ! @martinpitt : D

Π‘Ρ‹Π»Π° Π»ΠΈ эта страница ΠΏΠΎΠ»Π΅Π·Π½ΠΎΠΉ?
0 / 5 - 0 Ρ€Π΅ΠΉΡ‚ΠΈΠ½Π³ΠΈ