Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1216089

Summary:	fixes for null termination needed, and allowing secrets retrieval post-init-phase
Product:	Red Hat Enterprise Linux 7	Reporter:	Jan Kurik <jkurik>
Component:	nuxwdog	Assignee:	Ade Lee <alee>
Status:	CLOSED ERRATA	QA Contact:	Asha Akkiangady <aakkiang>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.1	CC:	alee, arubin, jherrman, mharmsen, nkinder, pm-eus, rpattath
Target Milestone:	rc	Keywords:	Rebase, ZStream
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	nuxwdog-1.0.1-11.el7_1	Doc Type:	Bug Fix
Doc Text:	When using the Dogtag Certificate System version 10, retrieving a stored password with the nuxwdog daemon previously caused the password not to be correctly null-terminated. This update fixes the underlying code, and the password is null-terminated as expected in the described scenario. In addition, it is now possible to use nuxwdog to prompt for passwords for programs or daemons started by the systemd service.	Story Points:	---
Clone Of:	1214838	Environment:
Last Closed:	2015-06-23 08:46:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1214838
Bug Blocks:

Description Jan Kurik 2015-04-28 13:12:41 UTC

This bug has been copied from bug #1214838 and has been proposed
to be backported to 7.1 z-stream (EUS).

Comment 5 Ade Lee 2015-05-12 02:59:01 UTC

https://brewweb.devel.redhat.com/buildinfo?buildID=434522

Fix in the above build. See the SRPM for patches.

Comment 7 Roshni 2015-05-21 17:37:52 UTC

Need more clarification on the verification steps. Tried to execute as explained in https://fedorahosted.org/pki/ticket/1230#comment:4 but with the latest nuxwdog and tomcatjss there was no nuxwdog.conf file under the ca instance. Neither did /usr/sbin/pki-server-nuxwdog

Please provide more information on how this bug can be verified.

Comment 8 Ade Lee 2015-05-26 15:03:18 UTC

Roshni, the files you are mentioning above exist in the pki-core packages.  You need to test using the latest CS 9 packages.

Steps:

1, Install the latest Dogtag packages -- ie. CS 10.2.4
2. Configure a CA as normal, and then stop the instance.
3. Convert the CA to use nuxwdog

   pki-server instance-nuxwdog-enable <instance_name>

4. Restart the instance using:

   systemctl restart pki-tomcatd-nuxwdog@<instance_name>.service

   You should be prompted for various passwords and the instance should start 
   successfully.

5.  You can restore the previous config by doing:

   systemctl stop pki-tomcatd-nuxwdog@<instance_name>.service

   pki-server instance-nuxwdog-disable <instance_name>

   systemctl start pki-tomcatd@<instance_name>.service

Comment 9 Roshni 2015-05-28 16:38:21 UTC

(In reply to Ade Lee from comment #8)
> Roshni, the files you are mentioning above exist in the pki-core packages. 
> You need to test using the latest CS 9 packages.
> 
> Steps:
> 
> 1, Install the latest Dogtag packages -- ie. CS 10.2.4
> 2. Configure a CA as normal, and then stop the instance.
> 3. Convert the CA to use nuxwdog
> 
>    pki-server instance-nuxwdog-enable <instance_name>
> 
> 4. Restart the instance using:
> 
>    systemctl restart pki-tomcatd-nuxwdog@<instance_name>.service

Failed with the following error:

[root@spider ~]# systemctl status pki-tomcatd-nuxwdog -l
pki-tomcatd-nuxwdog - PKI Tomcat Server pki-tomcat Started by Nuxwdog
   Loaded: loaded (/usr/lib/systemd/system/pki-tomcatd-nuxwdog@.service; enabled)
   Active: failed (Result: exit-code) since Thu 2015-05-28 11:04:13 EDT; 35s ago
  Process: 2054 ExecStartPre=/usr/bin/pkidaemon start tomcat %i (code=exited, status=1/FAILURE)

May 28 11:04:13 spider.idmqe.lab.eng.bos.redhat.com pkidaemon[2054]: WARNING:  Symbolic link '/etc/systemd/system/pki-tomcatd.target.wants/pki-tomcatd' does NOT exist!
May 28 11:04:13 spider.idmqe.lab.eng.bos.redhat.com pkidaemon[2054]: INFO:  Attempting to create '/etc/systemd/system/pki-tomcatd.target.wants/pki-tomcatd' -> '/lib/systemd/system/pki-tomcatd@.service' . . .
May 28 11:04:13 spider.idmqe.lab.eng.bos.redhat.com pkidaemon[2054]: ln: failed to create symbolic link ‘/etc/systemd/system/pki-tomcatd.target.wants/pki-tomcatd’: Permission denied
May 28 11:04:13 spider.idmqe.lab.eng.bos.redhat.com pkidaemon[2054]: ERROR:  Failed to create '/etc/systemd/system/pki-tomcatd.target.wants/pki-tomcatd' -> '/lib/systemd/system/pki-tomcatd@.service'!
May 28 11:04:13 spider.idmqe.lab.eng.bos.redhat.com systemd[1]: pki-tomcatd-nuxwdog: control process exited, code=exited status=1
May 28 11:04:13 spider.idmqe.lab.eng.bos.redhat.com systemd[1]: Failed to start PKI Tomcat Server pki-tomcat Started by Nuxwdog.
May 28 11:04:13 spider.idmqe.lab.eng.bos.redhat.com systemd[1]: Unit pki-tomcatd-nuxwdog entered failed state.
> 
>    You should be prompted for various passwords and the instance should
> start 
>    successfully.
> 
> 5.  You can restore the previous config by doing:
> 
>    systemctl stop pki-tomcatd-nuxwdog@<instance_name>.service
> 
>    pki-server instance-nuxwdog-disable <instance_name>
> 
>    systemctl start pki-tomcatd@<instance_name>.service

Comment 10 Roshni 2015-05-29 13:09:09 UTC

[root@spider ~]# rpm -qi pki-ca
Name        : pki-ca
Version     : 10.2.4
Release     : 1.el7
Architecture: noarch
Install Date: Thu 28 May 2015 10:57:13 AM EDT
Group       : System Environment/Daemons
Size        : 2425471
License     : GPLv2
Signature   : (none)
Source RPM  : pki-core-10.2.4-1.el7.src.rpm
Build Date  : Wed 27 May 2015 04:29:55 PM EDT
Build Host  : x86-036.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : http://pki.fedoraproject.org/
Summary     : Certificate System - Certificate Authority

[root@spider ~]# rpm -qi nuxwdog
Name        : nuxwdog
Version     : 1.0.1
Release     : 11.el7_1
Architecture: x86_64
Install Date: Thu 28 May 2015 10:56:44 AM EDT
Group       : System Environment/Libraries
Size        : 119113
License     : LGPLv2 and (GPL+ or Artistic)
Signature   : (none)
Source RPM  : nuxwdog-1.0.1-11.el7_1.src.rpm
Build Date  : Mon 11 May 2015 10:34:47 PM EDT
Build Host  : x86-020.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : http://www.redhat.com/certificate_system
Summary     : Watchdog server to start and stop processes, and prompt for passwords

[root@spider ~]# rpm -qi tomcatjss
Name        : tomcatjss
Version     : 7.1.0
Release     : 6.el7_1
Architecture: noarch
Install Date: Thu 28 May 2015 10:43:33 AM EDT
Group       : System Environment/Libraries
Size        : 49694
License     : LGPLv2+
Signature   : (none)
Source RPM  : tomcatjss-7.1.0-6.el7_1.src.rpm
Build Date  : Mon 11 May 2015 06:07:59 PM EDT
Build Host  : x86-021.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : http://pki.fedoraproject.org/
Summary     : JSSE implementation using JSS for Tomcat

Verification steps:

1. pkispawn CA with default parameters

[root@spider ~]# systemctl stop pki-tomcatd
[root@spider ~]# pki-server instance-nuxwdog-enable pki-tomcat
----------------------------------------
Nuxwdog enabled for instance pki-tomcat.
----------------------------------------

[root@spider ~]# systemctl restart pki-tomcatd-nuxwdog
[pki-tomcat] Please provide the password for internal: ************
[pki-tomcat] Please provide the password for internaldb: *********
[pki-tomcat] Please provide the password for replicationdb: ***********
[root@spider ~]# systemctl status pki-tomcatd-nuxwdog
pki-tomcatd-nuxwdog - PKI Tomcat Server pki-tomcat Started by Nuxwdog
   Loaded: loaded (/usr/lib/systemd/system/pki-tomcatd-nuxwdog@.service; enabled)
   Active: active (running) since Fri 2015-05-29 08:59:04 EDT; 8s ago
  Process: 5732 ExecStart=/bin/nuxwdog -f /etc/pki/%i/nuxwdog.conf (code=exited, status=0/SUCCESS)
  Process: 5594 ExecStartPre=/usr/bin/pkidaemon start tomcat %i (code=exited, status=0/SUCCESS)
 Main PID: 5733 (nuxwdog)
   CGroup: /system.slice/system-pki\x2dtomcatd\x2dnuxwdog.slice/pki-tomcatd-nuxwdog
           ├─5733 /bin/nuxwdog -f /etc/pki/pki-tomcat/nuxwdog.conf
           └─5734 java -DRESTEASY_LIB=/usr/share/java/resteasy-base -Djava.li...

May 29 08:59:04 spider.idmqe.lab.eng.bos.redhat.com systemd[1]: Started PKI T...
Hint: Some lines were ellipsized, use -l to show in full.
[root@spider ~]# systemctl stop pki-tomcatd-nuxwdog
[root@spider ~]# pki-server instance-nuxwdog-disable pki-tomcat
-----------------------------------------
Nuxwdog disabled for instance pki-tomcat.
-----------------------------------------

[root@spider ~]# systemctl start pki-tomcatd
[root@spider ~]# systemctl status pki-tomcatd
pki-tomcatd - PKI Tomcat Server pki-tomcat
   Loaded: loaded (/lib/systemd/system/pki-tomcatd@.service; enabled)
   Active: active (running) since Fri 2015-05-29 09:00:19 EDT; 5s ago
  Process: 5833 ExecStartPre=/usr/bin/pkidaemon start tomcat %i (code=exited, status=0/SUCCESS)
 Main PID: 5975 (java)
   CGroup: /system.slice/system-pki\x2dtomcatd.slice/pki-tomcatd
           └─5975 java -DRESTEASY_LIB=/usr/share/java/resteasy-base -classpat...

May 29 09:00:23 spider.idmqe.lab.eng.bos.redhat.com server[5975]: at org.apac...
May 29 09:00:23 spider.idmqe.lab.eng.bos.redhat.com server[5975]: at org.apac...
May 29 09:00:23 spider.idmqe.lab.eng.bos.redhat.com server[5975]: at org.apac...
May 29 09:00:23 spider.idmqe.lab.eng.bos.redhat.com server[5975]: at org.apac...
May 29 09:00:23 spider.idmqe.lab.eng.bos.redhat.com server[5975]: at java.uti...
May 29 09:00:23 spider.idmqe.lab.eng.bos.redhat.com server[5975]: at java.uti...
May 29 09:00:23 spider.idmqe.lab.eng.bos.redhat.com server[5975]: at java.uti...
May 29 09:00:23 spider.idmqe.lab.eng.bos.redhat.com server[5975]: at java.lan...
May 29 09:00:23 spider.idmqe.lab.eng.bos.redhat.com server[5975]: May 29, 201...
May 29 09:00:23 spider.idmqe.lab.eng.bos.redhat.com server[5975]: INFO: Deplo...
Hint: Some lines were ellipsized, use -l to show in full.

This bug was verified by using a workaround explained in https://bugzilla.redhat.com/show_bug.cgi?id=1226025#c2

Comment 12 errata-xmlrpc 2015-06-23 08:46:10 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1150.html