| 1 | #!/bin/sh |
|---|---|
| 2 | |
| 3 | # ------------------------------------------------------------- |
| 4 | # Auth Grove |
| 5 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
| 6 | # Author: Sébastien Santoro aka Dereckson |
| 7 | # Project: Nasqueron |
| 8 | # Created: 2016-05-21 |
| 9 | # Description: SSO for Nasqueron services. |
| 10 | # Image: nasqueron/auth-grove |
| 11 | # Services used: MySQL server (acquisitariat) |
| 12 | # Docker volume (/data/notifications/storage) |
| 13 | # ------------------------------------------------------------- |
| 14 | |
| 15 | # ------------------------------------------------------------- |
| 16 | # Container parameters |
| 17 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
| 18 | |
| 19 | INSTANCE_NAME=login |
| 20 | PORT=25080 |
| 21 | MYSQL_INSTANCE=acquisitariat |
| 22 | STORAGE=/data/login/storage |
| 23 | CANONICAL_URL=http://login.nasqueron.org |
| 24 | |
| 25 | # ------------------------------------------------------------- |
| 26 | # Database parameters |
| 27 | # |
| 28 | # Get credentials from zr |
| 29 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
| 30 | |
| 31 | MYSQL_HOST=mysql |
| 32 | MYSQL_USER=`ssh -4 -i /root/.ssh/id_zr zr@ysul.nasqueron.org getcredentials 67 username` |
| 33 | MYSQL_PASS=`ssh -4 -i /root/.ssh/id_zr zr@ysul.nasqueron.org getcredentials 67` |
| 34 | MYSQL_DB=$INSTANCE_NAME |
| 35 | |
| 36 | # ------------------------------------------------------------- |
| 37 | # Run the container |
| 38 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
| 39 | |
| 40 | # Checks container isn't running |
| 41 | docker-container-status $INSTANCE_NAME > /dev/null |
| 42 | if [ "$?" -lt 2 ]; then |
| 43 | echo "Container is already running." |
| 44 | echo "To force relaunch, try docker stop $INSTANCE_NAME ; docker rm $INSTANCE_NAME ; $0" |
| 45 | exit 1 |
| 46 | fi |
| 47 | |
| 48 | mkdir -p $STORAGE |
| 49 | chcon -Rt svirt_sandbox_file_t $STORAGE |
| 50 | chown 431:433 $STORAGE |
| 51 | docker run -t -d \ |
| 52 | --link $MYSQL_INSTANCE:$MYSQL_HOST \ |
| 53 | -p $PORT:80 \ |
| 54 | -e DB_HOST=$MYSQL_HOST \ |
| 55 | -e DB_DATABASE=$MYSQL_DB \ |
| 56 | -e DB_USERNAME=$MYSQL_USER \ |
| 57 | -e DB_PASSWORD=$MYSQL_PASS \ |
| 58 | -e CANONICAL_URL="$CANONICAL_URL" \ |
| 59 | --name $INSTANCE_NAME nasqueron/auth-grove |
| 60 | |
| 61 | echo "Deployment done at `date`." |
| 62 | exit 0 |
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed Advanced Search
Advanced Search
Advanced Search
May 23 2016
May 23 2016
May 22 2016
May 22 2016
dereckson closed T839: Current URL detection code in views aren't coherent, a subtask of T271: Deploy Auth Grove to login.nasqueron.org, as Resolved.
May 21 2016
May 21 2016
dereckson closed T838: Disable gulp-notify, a subtask of T271: Deploy Auth Grove to login.nasqueron.org, as Resolved.
Dwellers
$ mysql-acquisitariat-client Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 25258597 Server version: 5.7.11 MySQL Community Server (GPL)
dereckson added a revision to T271: Deploy Auth Grove to login.nasqueron.org: D376: 502 for login.nasqueron.org.
dereckson moved T271: Deploy Auth Grove to login.nasqueron.org from Backlog to Working on on the Servers board.
dereckson moved T271: Deploy Auth Grove to login.nasqueron.org from Backlog to Working on on the Nasqueron Docker deployment squad board.
Done, Let's encrypt certificates renewd successfully for mail servers (now independant certificates).
May 17 2016
May 17 2016
May 13 2016
May 13 2016
Sandlayth removed a revision from T768: Create a HE tunnel for Eglide: Restricted Differential Revision.
Sandlayth added a revision to T826: Create a systemd timer to renew letsencrypt certificat on Dwellers: Restricted Differential Revision.
Sandlayth added a revision to T768: Create a HE tunnel for Eglide: Restricted Differential Revision.
May 12 2016
May 12 2016
dereckson raised the priority of T826: Create a systemd timer to renew letsencrypt certificat on Dwellers from Normal to High.
We need that before June, the next renewal time window.
dereckson updated the task description for T826: Create a systemd timer to renew letsencrypt certificat on Dwellers.
I've ran letsencrypt renew on Dwellers, then reloaded nginx.
dereckson added a project to T825: Renew Let's encrypt certificate for notifications.nasqueron.org: Servers.
dereckson added a revision to T824: Tests for SuEXEC on Ysul: D371: Check if Apache is up and SuEXEC installed on Ysul.
dereckson removed a revision from T823: Missing suexec on ysul: D371: Check if Apache is up and SuEXEC installed on Ysul.
dereckson removed a revision from T818: Add banner on Eglide: D371: Check if Apache is up and SuEXEC installed on Ysul.
dereckson added a revision to T823: Missing suexec on ysul: D371: Check if Apache is up and SuEXEC installed on Ysul.
dereckson added a revision to T818: Add banner on Eglide: D371: Check if Apache is up and SuEXEC installed on Ysul.
May 10 2016
May 10 2016
Sandlayth added a revision to T768: Create a HE tunnel for Eglide: D370: Salt configuration for IPv6 for Debian.
May 6 2016
May 6 2016
Probably deinstalled during Apache update. Or maybe they don't ship
SuEXEC at all in the binary package:
May 5 2016
May 5 2016
amj added projects to T822: SSL certificates: migrate from Startcom to Let's encrypt: security, Servers.
May 4 2016
May 4 2016
Apr 28 2016
Apr 28 2016
Trying a Python script to ask Jenkins to start a job:
Apr 22 2016
Apr 22 2016
Sandlayth closed T778: DNS configuration for eglide.org, a subtask of T767: Run a shell service allowing IRC connections, as Resolved.
Okay, looks good.
Apr 21 2016
Apr 21 2016
IPv6 configured:
*.eglide.org 300 IN A 212.47.244.42 @ 300 IN A 212.47.244.42 www.eglide.org 300 IN A 212.47.244.42 eglide.org 10800 IN AAAA 2001:470:1f13:896:0:c0de:15:11fe eglide.org 10800 IN SSHFP 1 1 23d53659502c8926754b8adb2784279db14b8b24 eglide.org 10800 IN SSHFP 1 2 bf0cbd68b0e7b25b28f81f5c3bf5bf135e1846f5435a258a71055533d9fcb750 eglide.org 10800 IN SSHFP 2 1 a5f162fd1a969f0cf6517b987baabd5e622790e1 eglide.org 10800 IN SSHFP 2 2 2f1ef927f698c751a5d199d2eaacea675cf1e81db917e8daa14a6957e32d9daa eglide.org 10800 IN SSHFP 3 1 44d267dc76fcf634f178aba0c54c56dc9d79f70f eglide.org 10800 IN SSHFP 3 2 1547976c85f83babc2534fbb82b1475e7bf230f29fd5ffec1de83bf55bf60bc5 eglide.org 10800 IN SSHFP 4 1 165403ebd193c90af5223a196c2cd150daa0be0a eglide.org 10800 IN SSHFP 4 2 d2d38e7e7ffd0cb6968d2711df9843fa0c8825c8636fde0ab3d69c22e59fe81c
SSHFP configured:
Apr 20 2016
Apr 20 2016
So the issue was this nginx block, which deny access to .well-known like anything else starting with a dot:
$ letsencrypt renew [...] ------------------------------------------------------------------------------- Processing /usr/local/etc/letsencrypt/renewal/www.espace-win.org.conf ------------------------------------------------------------------------------- 2016-04-20 22:10:33,464:WARNING:letsencrypt.renewal:Attempting to renew cert from /usr/local/etc/letsencrypt/renewal/www.espace-win.org.conf produced an unexpected error: Failed authorization procedure. dropbox.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://dropbox.espace-win.org/.well-known/acme-challenge/AFcGawsTLFqpJwWWZDmMh4LHjMVRkIbAfbq13_6qM40 [212.83.187.132]: 403, files.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://files.espace-win.org/.well-known/acme-challenge/43QDyWupIPxeAlNMyXgvDezCIMf-6kGxvAn2SzBIrak [212.83.187.132]: 403, forum.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://forum.espace-win.org/.well-known/acme-challenge/rHPn1p3iNsjXBzgAC0Hk-npvdCRF1qmJTrohgFkmugM [212.83.187.132]: 403, espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://espace-win.org/.well-known/acme-challenge/o_7sf9acLUEuHzVQNOHBcHvTG73l7xlP8mMX6nhx22c [212.83.187.132]: 403, pastebin.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://pastebin.espace-win.org/.well-known/acme-challenge/QCzu4WhOSjhRPzH6BvjMgAn2tggV1qbBW0q9tdyYACs [212.83.187.132]: 403, assets.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://assets.espace-win.org/.well-known/acme-challenge/LU-KuSB2bzPYmxw2vACtLu6yZj8ygXkAZiPxwHOMcHE [212.83.187.132]: 403, excel.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://excel.espace-win.org/.well-known/acme-challenge/5iaG0F-_T5a2TKlFWDxTqvBxg6GD50B_YfY5sxolNQ0 [212.83.187.132]: 403, www.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.espace-win.org/.well-known/acme-challenge/Pw6LYupam92EIy330xYlAuHuKvNKpp6unoVU8UAOrmw [212.83.187.132]: 403, gd.espace-win.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://gd.espace-win.org/.well-known/acme-challenge/SP1gRHzjZR39Ai9lZXQvEsTi9i7f0dYSL2bbR_bPOY4 [212.83.187.132]: 403. Skipping.
Apr 10 2016
Apr 10 2016
eglide.org has address 212.47.244.42 eglide.org mail is handled by 10 spool.mail.gandi.net. eglide.org mail is handled by 50 fb.mail.gandi.net.
dereckson moved T809: Scale roles/shellserver/users/ to support several users account from Backlog to Pending review on the Servers board.
dereckson changed the visibility for T809: Scale roles/shellserver/users/ to support several users account.
dereckson added a comment to T795: Allow through sudo users from salt group to run commands as salt user on Ysul.
So finally we use a specific salt group instead of using wheel.
dereckson renamed T795: Allow through sudo users from salt group to run commands as salt user on Ysul from Allow through sudo users from wheel group to run commands as salt user on Ysul to Allow through sudo users from salt group to run commands as salt user on Ysul.
dereckson closed D352: Allow salt group's users to run salt commands by committing rOPS7d36cf5c0110: Allow salt group's users to run salt commands (authored by Sandlayth).
dereckson closed T795: Allow through sudo users from salt group to run commands as salt user on Ysul, a subtask of T156: Kickstart Salt Nasqueron infrastructure, as Resolved.
- %wheel → %salt
- added rc script
A specific group for salt will be better.
dereckson retitled D352: Allow salt group's users to run salt commands from Allow wheel group's users to use docker commands to Allow salt group's users to run salt commands.
Apr 9 2016
Apr 9 2016
I stopped the systemd service, then launched manually with debug mode (rsyslog -dn) and can't repro the issue.
Apr 8 2016
Apr 8 2016
Apr 2 2016
Apr 2 2016
This works:
Apr 1 2016
Apr 1 2016
$ mkdir /var/tmp/whom/paladox $ chown paladox:shell /var/tmp/whom/paladox $ chmod 1777 /var/tmp/whom
Hmmm, we need to recompile another OpenSSH server to be able to change the PAM service name
dereckson moved T795: Allow through sudo users from salt group to run commands as salt user on Ysul from Backlog to Working on on the Servers board.
dereckson moved T801: Review skel to provision new accounts on Ysul from Backlog to Pending review on the Servers board.
dereckson raised the priority of T783: Run an extra SSH server on Ysul for OTP/Yubikey from Low to Normal.
New users are puzzled by the prompt.
dereckson closed T802: Allow to get notifications for new mail on Ysul, a subtask of T298: Validate devserver operational state, as Wontfix.
Actually, we have fewer users on Ysul than on Grip, and we can offer them support to upgrade if needed.
dereckson added a parent task for T801: Review skel to provision new accounts on Ysul: T298: Validate devserver operational state.
dereckson updated the task description for T757: Create ports for each piece of software in /usr/local/bin on Ysul.
dereckson added a comment to T757: Create ports for each piece of software in /usr/local/bin on Ysul.
misc/binclock has been committed upstream: https://svnweb.freebsd.org/ports?view=revision&revision=412060
Mar 31 2016
Mar 31 2016
Mar 28 2016
Mar 28 2016
SSHFP records are also missing.
Sandlayth reopened T795: Allow through sudo users from salt group to run commands as salt user on Ysul, a subtask of T156: Kickstart Salt Nasqueron infrastructure, as Open.
Sandlayth closed T795: Allow through sudo users from salt group to run commands as salt user on Ysul, a subtask of T156: Kickstart Salt Nasqueron infrastructure, as Resolved.
dereckson updated the task description for T415: Allowed ops@ and dereckson@ to sudo docker or lxc-* commands on Dwellers.
We are preparing the list of notifications to remove:
dereckson moved T275: Nginx proxies request with 127.0.0.1 as IP address from Backlog to Config on the DevCentral board.
Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator