RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1487418 - When nuxwdog is enabled pkidaemon status shows instances as stopped.
Summary: When nuxwdog is enabled pkidaemon status shows instances as stopped.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pki-core
Version: 7.9
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 7.9
Assignee: Dinesh Prasanth
QA Contact: Asha Akkiangady
Florian Delehaye
URL:
Whiteboard:
Depends On:
Blocks: 1732981
TreeView+ depends on / blocked
 
Reported: 2017-08-31 20:58 UTC by Asha Akkiangady
Modified: 2022-03-13 14:25 UTC (History)
6 users (show)

Fixed In Version: pki-core-10.5.18-1.el7
Doc Type: Bug Fix
Doc Text:
.The `pkidaemon` tool now reports the correct status of PKI instances when `nuxwdog` is enabled Previously, the `pkidaemon status` command would not report the correct status for PKI server instances that have the `nuxwdog` watchdog enabled. With this update, `pkidaemon` detects whether `nuxwdog` is enabled and reports the correct status of the PKI server.
Clone Of:
: 1732981 (view as bug list)
Environment:
Last Closed: 2020-09-29 20:00:58 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github dogtagpki pki issues 2926 0 None None None 2020-10-04 21:35:59 UTC
Red Hat Product Errata RHBA-2020:3941 0 None None None 2020-09-29 20:01:16 UTC

Description Asha Akkiangady 2017-08-31 20:58:00 UTC 
Description of problem:
When nuxwdog is enabled pkidaemon status shows instances as stopped.

Version-Release number of selected component (if applicable):
pki-server-10.4.1-13.el7_4.noarch

How reproducible:


Steps to Reproduce:
1. pkicreate a CA instance.
2. # pkidaemon status
Status for rhcs92-CA-aakkiang: rhcs92-CA-aakkiang is running ..

    [CA Status Definitions]
    Unsecure URL        = http://example.redhat.com:8080/ca/ee/ca
    Secure Agent URL    = https://example.redhat.com:8443/ca/agent/ca
    Secure EE URL       = https://example.redhat.com:8443/ca/ee/ca
    Secure Admin URL    = https://example.redhat.com:8443/ca/services
    PKI Console Command = pkiconsole https://example.redhat.com:8443/ca
    Tomcat Port         = 8005 (for shutdown)

    [CA Configuration Definitions]
    PKI Instance Name:   rhcs92-CA-aakkiang

    PKI Subsystem Type:  Root CA (Security Domain)

    Registered PKI Security Domain Information:
    ==========================================================================
    Name:  Example-rhcs92-CA
    URL:   https://example.redhat.com:8443
    ==========================================================================

3. systemctl stop pki-tomcatd
4. If you have configured CA with HSM add the following parameter to CS.cfg.
cms.tokenList=<TOKEN_NAME> 
5.Move the password file from /var/lib/pki/rhcs92-CA-aakkiang/conf/password.conf  another safe location. 
6. # pki-server nuxwdog-enable
---------------------------
Nuxwdog enabled for system.
---------------------------
7. # systemctl start pki-tomcatd-nuxwdog
[rhcs92-CA-aakkiang] Please provide the password for internal: ************
[rhcs92-CA-aakkiang] Please provide the password for hardware-<Token-Name>: **********
[rhcs92-CA-aakkiang] Please provide the password for internaldb: **********
[rhcs92-CA-aakkiang] Please provide the password for replicationdb: **********

8. # pkidaemon status
Status for rhcs92-CA-aakkiang: rhcs92-CA-aakkiang is stopped

Actual results:
pkidaemon status shows rhcs92-CA-aakkiang instance as stopped.

Expected results:
pkidaemon status should show rhcs92-CA-aakkiang instance as running with valid urls as in step #2.

Additional info:
pkidaemon may need enhancement to take into account nuxwdog instances.
Comment 2 Matthew Harmsen 2017-10-25 16:23:28 UTC 
[20171025] - RHEL 7.5 / RHCS 9.3 pre-Alpha Offline Triage ==> 7.6
Comment 3 Matthew Harmsen 2018-05-02 22:59:16 UTC 
alee: didn't we fix something like this?
Comment 4 Asha Akkiangady 2018-05-04 13:53:00 UTC 
No. This issue is not fixed.
Comment 5 Matthew Harmsen 2018-07-04 00:30:54 UTC 
Moved to RHEL 7.7.
Comment 6 Dinesh Prasanth 2019-07-16 21:23:57 UTC 
Possible Solution:
==================

This bug exists simply because `pkidaemon` checks status of `pki-tomcatd` instead of `pki-tomcatd-nuxwdog`.

https://github.com/dogtagpki/pki/blob/DOGTAG_10_5_BRANCH/base/server/scripts/pkidaemon#L32

The logic is to check whether the nuxwdog is enabled or not in the system and replace this variable appropriately.
Comment 8 Dinesh Prasanth 2020-02-15 01:08:24 UTC 
The fix has been merged to DOGTAG_10_5_BRANCH via PR: https://github.com/dogtagpki/pki/pull/319

Commit information
==================
commit 0033bb6900673e099661703332aab17e4fcea6a7 (HEAD -> DOGTAG_10_5_BRANCH, origin/DOGTAG_10_5_BRANCH)
Author: Dinesh Prasanth M K <SilleBille.github.com>
Date:   Fri Feb 14 19:58:32 2020 -0500

    Fix pkidaemon status when nuxwdog is enabled (#319)

    - Target the right systemd file, based on whether the
      nuxwdog is enabled.
    - Add status of nuxwdog configuration to the pkidaemon
      output

    Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1487418

    Signed-off-by: Dinesh Prasanth M K <dmoluguw>

Test Case
=========
Follow the steps mentioned by OP in the BZ description

Documentation
=============
pkidaemon correctly reports the status of the running instance when nuxwdog is configured.
Comment 11 shalini 2020-05-13 09:30:37 UTC 
THe bugzilla has been verified by follwoing the steps mentioned in description on following bits on RHEL79:
pki-ca-10.5.18-3.el7.noarch
pki-server-10.5.18-3.el7.noarch

>>> Test steps :
CA, KRA, OCSP in discrete tomcat installation in Non_HSM machine.
I followed enabling the nuxwdog and restarted the CA instance as mentioned in description steps.
And following is the output of `pkidaemon status` command.

[root@pki1 certdb]# pkidaemon status
REPORT STATUS OF 'tomcat' INSTANCE(S):

Instance topology-03-CA is configured to use nuxwdog: true
Status for topology-03-CA: topology-03-CA is running ..

    [CA Status Definitions]
    Secure Agent URL    = https://pki1.example.com:20443/ca/agent/ca
    Secure EE URL       = https://pki1.example.com:20443/ca/ee/ca
    Secure Admin URL    = https://pki1.example.com:20443/ca/services
    PKI Console Command = pkiconsole https://pki1.example.com:20443/ca
    Tomcat Port         = 20005 (for shutdown)

    [CA Configuration Definitions]
    PKI Instance Name:   topology-03-CA

    PKI Subsystem Type:  Root CA (Security Domain)

    Registered PKI Security Domain Information:
    ==========================================================================
    Name:  topology-03_Foobarmaster.org
    URL:   https://pki1.example.com:20443
    ==========================================================================

Instance topology-03-KRA is configured to use nuxwdog: true
Status for topology-03-KRA: topology-03-KRA is stopped

Instance topology-03-OCSP is configured to use nuxwdog: true
Status for topology-03-OCSP: topology-03-OCSP is stopped

WARNING:  2 of 3 'tomcat' instances reported status failures!

FINISHED REPORTING STATUS OF 'tomcat' INSTANCE(S).


>>> Above output shows KRA and OCSP as stopped whereas both the instances are up and running. 
>>> I tried running key archival while generating a crmf type certificate and as visible in following output, It is up and running. Key archival is successful.


[root@pki1 certdb]# systemctl | grep pki
pki-tomcatd-nuxwdog                                                                                     loaded active running   PKI Tomcat Server topology-03-CA Started by Nuxwdog
pki-tomcatd                                                                                            loaded active running   PKI Tomcat Server topology-03-KRA
pki-tomcatd                                                                                           loaded active running   PKI Tomcat Server topology-03-OCSP




[root@pki1 certdb]# pki -d . -c SECret.123 -n 'PKI KRA Administrator for Example.Org' -p 21080 -P http kra-key-find
----------------
0 key(s) matched
----------------
----------------------------
Number of entries returned 0
----------------------------
[root@pki1 certdb]# pki -d . -c SECret.123 -n 'PKI CA Administrator for Example.Org' -p 20080 -P http client-cert-request 'uid=shal' --transport ~/transport.cert --type crmf
-----------------------------
Submitted certificate request
-----------------------------
  Request ID: 20
  Type: enrollment
  Request Status: pending
  Operation Result: success
[root@pki1 certdb]# pki -d . -c SECret.123 -n 'PKI CA Administrator for Example.Org' -p 20080 -P http ca-cert-request-review 20 --action approve
-------------------------------
Approved certificate request 20
-------------------------------
  Request ID: 20
  Type: enrollment
  Request Status: complete
  Operation Result: success
  Certificate ID: 0x14
[root@pki1 certdb]# pki -d . -c SECret.123 -n 'PKI KRA Administrator for Example.Org' -p 21080 -P http kra-key-find
----------------
1 key(s) matched
----------------
  Key ID: 0x1
  Algorithm: 1.2.840.113549.1.1.1
  Size: 1024
  Owner: UID=shal
----------------------------
Number of entries returned 1
----------------------------



>>> Observation: [NeedInfo]

For CA, it shows correct status in `pkidaemon status` command. But the command shows wrong output for other sub-systems.
As it checks the USE_NUXWDOG in /etc/sysconfig/topology-03-KRA which shows 'true'. Whereas the instances are working without nuwxdog enabled.

Either the command should show the correct status of other subsystems or the subsystems should not be running after enabling nuwxdog in system.
Comment 12 Dinesh Prasanth 2020-05-13 16:21:48 UTC 
(In reply to shalini from comment #11)
> >>> Observation: [NeedInfo]
> 
> For CA, it shows correct status in `pkidaemon status` command. But the
> command shows wrong output for other sub-systems.
> As it checks the USE_NUXWDOG in /etc/sysconfig/topology-03-KRA which shows
> 'true'. Whereas the instances are working without nuwxdog enabled.
> 

The `pkidaemon status` checks for /etc/sysconfig/<instance_name> to see if
the nuxwdog has been enabled. What you observe seems to be right from the code
logic.


> Either the command should show the correct status of other subsystems or the
> subsystems should not be running after enabling nuwxdog in system.

I assume you ran `pki-server nuxwdog-enable`. This enables nuxwdog for ALL
instances in the system. Have you tried using `pki-server instance-nuxwdog-enable <instance>`?
This allows you to enable nuxwdog only for the intended instance.

As per the documentation [1][2], to enable nuxwdog you need to STOP running instance
and then restart using `pki-tomcatd-nuxwdog` unit file. Note that `pki-tomcatd@<inst>`
and `pki-tomcatd-nuxwdog@<inst>` are 2 different service unit files from OS perspective.
So, since you ENABLED nuxwdog for ALL instances but then performed the config steps only
for CA. The other 2 subsystems (KRA and OCSP) are impartially configured to use nuxwdog
and so you see the incorrect status.


[1] https://access.redhat.com/documentation/en-us/red_hat_certificate_system/9/html/administration_guide/using_the_watchdog_service
[2] https://www.dogtagpki.org/wiki/Nuxwdog#Configuration
Comment 13 shalini 2020-05-14 07:20:24 UTC 
By disabling the KRA and OCSP instance for nuxwdog using below command:

pki-server instance-nuxwdog-disable topology-03-OCSP
pki-server instance-nuxwdog-disable topology-03-KRA


Output shows:


[root@pki1 ~]# pkidaemon status
REPORT STATUS OF 'tomcat' INSTANCE(S):

Instance topology-03-CA is configured to use nuxwdog: true
Status for topology-03-CA: topology-03-CA is running ..

    [CA Status Definitions]
    Secure Agent URL    = https://pki1.example.com:20443/ca/agent/ca
    Secure EE URL       = https://pki1.example.com:20443/ca/ee/ca
    Secure Admin URL    = https://pki1.example.com:20443/ca/services
    PKI Console Command = pkiconsole https://pki1.example.com:20443/ca
    Tomcat Port         = 20005 (for shutdown)

    [CA Configuration Definitions]
    PKI Instance Name:   topology-03-CA

    PKI Subsystem Type:  Root CA (Security Domain)

    Registered PKI Security Domain Information:
    ==========================================================================
    Name:  topology-03_Foobarmaster.org
    URL:   https://pki1.example.com:20443
    ==========================================================================

Instance topology-03-KRA is configured to use nuxwdog: false
Status for topology-03-KRA: topology-03-KRA is running ..

    [KRA Status Definitions]
    Secure Admin URL    = https://pki1.example.com:21443/kra/services
    PKI Console Command = pkiconsole https://pki1.example.com:21443/kra
    Tomcat Port         = 21005 (for shutdown)

    [KRA Configuration Definitions]
    PKI Instance Name:   topology-03-KRA

    PKI Subsystem Type:  KRA

    Registered PKI Security Domain Information:
    ==========================================================================
    Name:  topology-03_Foobarmaster.org
    URL:   https://pki1.example.com:20443
    ==========================================================================

Instance topology-03-OCSP is configured to use nuxwdog: false
Status for topology-03-OCSP: topology-03-OCSP is running ..

    [OCSP Status Definitions]
    Secure Agent URL    = https://pki1.example.com:22443/ocsp/agent/ocsp
    Secure EE URL       = https://pki1.example.com:22443/ocsp/ee/ocsp/<ocsp request blob>
    Secure Admin URL    = https://pki1.example.com:22443/ocsp/services
    PKI Console Command = pkiconsole https://pki1.example.com:22443/ocsp
    Tomcat Port         = 22005 (for shutdown)

    [OCSP Configuration Definitions]
    PKI Instance Name:   topology-03-OCSP

    PKI Subsystem Type:  OCSP

    Registered PKI Security Domain Information:
    ==========================================================================
    Name:  topology-03_Foobarmaster.org
    URL:   https://pki1.example.com:20443
    ==========================================================================

FINISHED REPORTING STATUS OF 'tomcat' INSTANCE(S).


Marking this bugzilla verified.
Comment 17 errata-xmlrpc 2020-09-29 20:00:58 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (pki-core bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3941
Note You need to log in before you can comment on or make changes to this bug.