If you setup an agent and server to use SSL encryption, then shut the agent down, unzip an entirely new agent and start it up the agent will fail to start with the following: Failed to start the agent java.lang.RuntimeException: Failed to create keystore [Command Response: isSuccessful=[tr ; cmd-in-response=[true]; config=[{}]; params=[{arguments=[Ljava.lang.String;@153f67e, pr a\jdk1.5.0_13\jre\bin, captureOutput=false, waitForExit=30000, programExecutable=keytool. exception was null <<]] with arguments [[-genkey, -alias, rhq, -dname, CN=RHQ, OU=RedHat, usr\tmp\ftp-JBossOn\agent2\jon-agent-2.0.0.GA\data\keystore.dat, -storepass, rhqpwd, -key ty, 36500]] at org.rhq.enterprise.communications.util.SecurityUtil.createKeyStore(SecurityUti at org.rhq.enterprise.agent.AgentMain.createServerRemoteCommunicator(AgentMain.ja at org.rhq.enterprise.agent.AgentMain.createClientCommandSender(AgentMain.java:14 at org.rhq.enterprise.agent.AgentMain.startCommServices(AgentMain.java:1272) at org.rhq.enterprise.agent.AgentMain.start(AgentMain.java:409) at org.rhq.enterprise.agent.AgentMain.main(AgentMain.java:297) The problem is that we're trying to get the keytool to create a brand new keystore in the ./data directory but that directory doesn't exist yet in a fresh agent install
Workaround: 1) mkdir ./data when unzipping the new agent 2) start the new agent with --clean and re-enter your settings
Fix would be to add something like the following to SecurityUtil.createKeyStore File keystoreFolder = keystore.getParentFile(); // if the keystore is living in a folder, e.g. ./data, make sure it exists // before we ask keytool to write to it if (keystoreFolder != null && !keystoreFolder.exists()) { boolean canCreateFolder= keystoreFolder.mkdirs(); if (!canCreateFolder) { throw new RuntimeException("Folder which keystore is to be written to [" + keystoreFolder + "] does not exist and cannot be created."); } }
Thinking about this further, this is not just an upgrade issue. If you tried to configure SSL between server and agent when you were setting up a new agent for the very first time then you would hit this problem too (no ./data directory)
Well actually you wouldn't hit this on first install, because you would have no preferences it would be the same as doing --clean, so a new ./data directory would get created for you before the keytool needed it.
The upgrade scripts specified in RHQ-617 should do as another workaround for this issue.
charles, if the upgrade scripts go away in 1.1, what are the remaining available work-arounds? what if the agent, as part of its startup process, created the data dir before anything else had a chance to read/write files from/to it -- would that be enough? this way, even if the user needs to (or accidentally) deletes the data dir, when the agent starts up / is restarted things should "just work"?
Thats pretty much what my comment above (http://jira.rhq-project.org/browse/RHQ-591?focusedCommentId=11356#action_11356) was aimed at, making sure the directory exists before it gets written too. We could do it in SecurityUtil.createKeyStore or elsewhere during agent startup.
svn rev 2397 adds charle's code in SecurityUtil. But there is something else we need to do. In the new agent-auto-update stuff, we need to transfer over the keystores to the newly updated agent. Leaving this issue open so I remember to add the necessary code in the update stuff to do this.
Added this to the agent update script so any data/*truststore* and data/*keystore* files get copied over to the newly updated agent. This requires people either put their key/truststores in the data/ directory with "keystore" or "truststore" in the filenames or store them in a directory outside of the agent install directories. + <!-- make sure we retain any SSL keystores or truststores that we can find --> + <echo>Copy existing keystore and truststore files from the old agent to the new agent</echo> + <copy todir="${_update.tmp.dir}/rhq-agent/data" + failonerror="false"> + <fileset dir="${rhq.agent.update.update-agent-dir}/data"> + <include name="*keystore*"/> + <include name="*truststore*"/> + </fileset> + </copy>
This bug was previously known as http://jira.rhq-project.org/browse/RHQ-591