Should normally definitively fixed with this:
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Advanced Search
Jun 3 2016
Another thing to test: SuEXEC AP_DOC_ROOT should be /var/wwwroot.
So for reference, we can now customize SuEXEC settings.
docroot switched back to /usr/local/www/data
Still the same error:
Jun 2 2016
May 31 2016
We can have the complete path to the executable through
httpd -V | grep SUEXEC_BIN | grep -o "/.*" | sed 's/.$//'
So far, we've a minimal test checking for hard-coded value /usr/local/sbin/suexec.
That doesn't need any Postfix restart.
May 30 2016
May 23 2016
May 22 2016
| 1 | #!/bin/sh |
|---|---|
| 2 | |
| 3 | # ------------------------------------------------------------- |
| 4 | # Auth Grove |
| 5 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
| 6 | # Author: Sébastien Santoro aka Dereckson |
| 7 | # Project: Nasqueron |
| 8 | # Created: 2016-05-21 |
| 9 | # Description: SSO for Nasqueron services. |
| 10 | # Image: nasqueron/auth-grove |
| 11 | # Services used: MySQL server (acquisitariat) |
| 12 | # Docker volume (/data/notifications/storage) |
| 13 | # ------------------------------------------------------------- |
| 14 | |
| 15 | # ------------------------------------------------------------- |
| 16 | # Container parameters |
| 17 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
| 18 | |
| 19 | INSTANCE_NAME=login |
| 20 | PORT=25080 |
| 21 | MYSQL_INSTANCE=acquisitariat |
| 22 | STORAGE=/data/login/storage |
| 23 | CANONICAL_URL=http://login.nasqueron.org |
| 24 | |
| 25 | # ------------------------------------------------------------- |
| 26 | # Database parameters |
| 27 | # |
| 28 | # Get credentials from zr |
| 29 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
| 30 | |
| 31 | MYSQL_HOST=mysql |
| 32 | MYSQL_USER=`ssh -4 -i /root/.ssh/id_zr zr@ysul.nasqueron.org getcredentials 67 username` |
| 33 | MYSQL_PASS=`ssh -4 -i /root/.ssh/id_zr zr@ysul.nasqueron.org getcredentials 67` |
| 34 | MYSQL_DB=$INSTANCE_NAME |
| 35 | |
| 36 | # ------------------------------------------------------------- |
| 37 | # Run the container |
| 38 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
| 39 | |
| 40 | # Checks container isn't running |
| 41 | docker-container-status $INSTANCE_NAME > /dev/null |
| 42 | if [ "$?" -lt 2 ]; then |
| 43 | echo "Container is already running." |
| 44 | echo "To force relaunch, try docker stop $INSTANCE_NAME ; docker rm $INSTANCE_NAME ; $0" |
| 45 | exit 1 |
| 46 | fi |
| 47 | |
| 48 | mkdir -p $STORAGE |
| 49 | chcon -Rt svirt_sandbox_file_t $STORAGE |
| 50 | chown 431:433 $STORAGE |
| 51 | docker run -t -d \ |
| 52 | --link $MYSQL_INSTANCE:$MYSQL_HOST \ |
| 53 | -p $PORT:80 \ |
| 54 | -e DB_HOST=$MYSQL_HOST \ |
| 55 | -e DB_DATABASE=$MYSQL_DB \ |
| 56 | -e DB_USERNAME=$MYSQL_USER \ |
| 57 | -e DB_PASSWORD=$MYSQL_PASS \ |
| 58 | -e CANONICAL_URL="$CANONICAL_URL" \ |
| 59 | --name $INSTANCE_NAME nasqueron/auth-grove |
| 60 | |
| 61 | echo "Deployment done at `date`." |
| 62 | exit 0 |
May 21 2016
$ mysql-acquisitariat-client Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 25258597 Server version: 5.7.11 MySQL Community Server (GPL)
Done, Let's encrypt certificates renewd successfully for mail servers (now independant certificates).
May 17 2016
May 13 2016
May 12 2016
We need that before June, the next renewal time window.
I've ran letsencrypt renew on Dwellers, then reloaded nginx.
May 10 2016
May 6 2016
Probably deinstalled during Apache update. Or maybe they don't ship
SuEXEC at all in the binary package:
May 5 2016
May 4 2016
Apr 28 2016
Trying a Python script to ask Jenkins to start a job:
Apr 22 2016
Okay, looks good.
Apr 21 2016
IPv6 configured:
*.eglide.org 300 IN A 212.47.244.42 @ 300 IN A 212.47.244.42 www.eglide.org 300 IN A 212.47.244.42 eglide.org 10800 IN AAAA 2001:470:1f13:896:0:c0de:15:11fe eglide.org 10800 IN SSHFP 1 1 23d53659502c8926754b8adb2784279db14b8b24 eglide.org 10800 IN SSHFP 1 2 bf0cbd68b0e7b25b28f81f5c3bf5bf135e1846f5435a258a71055533d9fcb750 eglide.org 10800 IN SSHFP 2 1 a5f162fd1a969f0cf6517b987baabd5e622790e1 eglide.org 10800 IN SSHFP 2 2 2f1ef927f698c751a5d199d2eaacea675cf1e81db917e8daa14a6957e32d9daa eglide.org 10800 IN SSHFP 3 1 44d267dc76fcf634f178aba0c54c56dc9d79f70f eglide.org 10800 IN SSHFP 3 2 1547976c85f83babc2534fbb82b1475e7bf230f29fd5ffec1de83bf55bf60bc5 eglide.org 10800 IN SSHFP 4 1 165403ebd193c90af5223a196c2cd150daa0be0a eglide.org 10800 IN SSHFP 4 2 d2d38e7e7ffd0cb6968d2711df9843fa0c8825c8636fde0ab3d69c22e59fe81c
SSHFP configured:
Apr 20 2016
So the issue was this nginx block, which deny access to .well-known like anything else starting with a dot:
$ letsencrypt renew [...] ------------------------------------------------------------------------------- Processing /usr/local/etc/letsencrypt/renewal/www.espace-win.org.conf ------------------------------------------------------------------------------- 2016-04-20 22:10:33,464:WARNING:letsencrypt.renewal:Attempting to renew cert from /usr/local/etc/letsencrypt/renewal/www.espace-win.org.conf produced an unexpected error: Failed authorization procedure. dropbox.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://dropbox.espace-win.org/.well-known/acme-challenge/AFcGawsTLFqpJwWWZDmMh4LHjMVRkIbAfbq13_6qM40 [212.83.187.132]: 403, files.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://files.espace-win.org/.well-known/acme-challenge/43QDyWupIPxeAlNMyXgvDezCIMf-6kGxvAn2SzBIrak [212.83.187.132]: 403, forum.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://forum.espace-win.org/.well-known/acme-challenge/rHPn1p3iNsjXBzgAC0Hk-npvdCRF1qmJTrohgFkmugM [212.83.187.132]: 403, espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://espace-win.org/.well-known/acme-challenge/o_7sf9acLUEuHzVQNOHBcHvTG73l7xlP8mMX6nhx22c [212.83.187.132]: 403, pastebin.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://pastebin.espace-win.org/.well-known/acme-challenge/QCzu4WhOSjhRPzH6BvjMgAn2tggV1qbBW0q9tdyYACs [212.83.187.132]: 403, assets.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://assets.espace-win.org/.well-known/acme-challenge/LU-KuSB2bzPYmxw2vACtLu6yZj8ygXkAZiPxwHOMcHE [212.83.187.132]: 403, excel.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://excel.espace-win.org/.well-known/acme-challenge/5iaG0F-_T5a2TKlFWDxTqvBxg6GD50B_YfY5sxolNQ0 [212.83.187.132]: 403, www.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.espace-win.org/.well-known/acme-challenge/Pw6LYupam92EIy330xYlAuHuKvNKpp6unoVU8UAOrmw [212.83.187.132]: 403, gd.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://gd.espace-win.org/.well-known/acme-challenge/SP1gRHzjZR39Ai9lZXQvEsTi9i7f0dYSL2bbR_bPOY4 [212.83.187.132]: 403. Skipping.
Apr 10 2016
eglide.org has address 212.47.244.42 eglide.org mail is handled by 10 spool.mail.gandi.net. eglide.org mail is handled by 50 fb.mail.gandi.net.
So finally we use a specific salt group instead of using wheel.
- %wheel → %salt
- added rc script
A specific group for salt will be better.
Apr 9 2016
I stopped the systemd service, then launched manually with debug mode (rsyslog -dn) and can't repro the issue.
Apr 8 2016
Apr 2 2016
This works:
Apr 1 2016
$ mkdir /var/tmp/whom/paladox $ chown paladox:shell /var/tmp/whom/paladox $ chmod 1777 /var/tmp/whom
Hmmm, we need to recompile another OpenSSH server to be able to change the PAM service name