LDAP configuration for mongo throws permission denied - java

I'm fairly new to MongoDB and LDAP. I'm trying to use LDAP to authenticate users to mongo. these are the steps I have done so far.
Created a saslauthd.conf file inside /etc folder which contains the following line:
ldap_servers: ldap://com.myldap.server
ldap_use_sasl: yes
ldap_mech: DIGEST-MD5
ldap_auth_method: fastbind
created a muxdir inside /var/run/saslauthd which now looks like /var/run/saslauthd/mux
set the permission to 755 using sudo chmod 755 /var/run/saslauthd
Modified the /etc/sysconfig/saslauthd to have the following
MECH=ldap
Uncommented the line on the same file which says:
DAEMONOPTS=--user saslauth
Now when i tried to test the authentication mechanism using the following command:
testsaslauthd -u username -p password -f /var/run/saslauthd/mux
I'm getting the following message:
connect(): Permission Denied
my work is based on this and this
Could anyone point out what i'm missing here? thanks in advance.
UPDATE:
I tried the test command with sudo like below:
sudo testsaslauthd -u username -p password -f /var/run/saslauthd/mux
And I'm getting the following:
connect() : Connection refused

Thanks for your question. I've enjoyed setting up my environment to try to reproduce the error. You'll be glad to heard that I don't think it's a difficult problem to overcome. However, I've probably spent more time than I desired setting up MongoDB, cyrus-sasl-md5, settings permissions, etc. when nothing is actually related with your problem, at least at a first glance.
Your problem (and I'm 90% sure) is either your saslauthd daemon is not running or it's not properly configured. Let's take a look at the following:
Check the service status. The output of service saslauthd status should be similar to mine, pasted below. Note some key values such as the location of the init script, /etc/init.d/saslauthd/ in my case; and the socket, /var/run/saslauthd/mux, the same file location you need to put in testsaslauthd [...] -f /var/run/saslauthd/mux command.
root#hectorvp-pc:~# service saslauthd status
● saslauthd.service - LSB: saslauthd startup script
Loaded: loaded (/etc/init.d/saslauthd)
Active: active (running) since Tue 2016-04-26 12:04:59 BST; 1s ago
Docs: man:systemd-sysv-generator(8)
Process: 11569 ExecStop=/etc/init.d/saslauthd stop (code=exited, status=0/SUCCESS)
Process: 11586 ExecStart=/etc/init.d/saslauthd start (code=exited, status=0/SUCCESS)
Memory: 2.0M
CGroup: /system.slice/saslauthd.service
├─11606 /usr/sbin/saslauthd -a ldap -c -m /var/run/saslauthd -n 5
├─11607 /usr/sbin/saslauthd -a ldap -c -m /var/run/saslauthd -n 5
├─11608 /usr/sbin/saslauthd -a ldap -c -m /var/run/saslauthd -n 5
├─11609 /usr/sbin/saslauthd -a ldap -c -m /var/run/saslauthd -n 5
└─11610 /usr/sbin/saslauthd -a ldap -c -m /var/run/saslauthd -n 5
Apr 26 12:04:59 hectorvp-pc systemd[1]: Starting LSB: saslauthd startup script...
Apr 26 12:04:59 hectorvp-pc saslauthd[11586]: * Starting SASL Authentication Daemon saslauthd
Apr 26 12:04:59 hectorvp-pc saslauthd[11606]: detach_tty : master pid is: 11606
Apr 26 12:04:59 hectorvp-pc saslauthd[11606]: ipc_init : listening on socket: /var/run/saslauthd/mux
Apr 26 12:04:59 hectorvp-pc systemd[1]: Started LSB: saslauthd startup script.
Apr 26 12:04:59 hectorvp-pc saslauthd[11586]: ...done.
If the service is not running, just start it with service saslauthd start and check the status again (service saslauthd status) to check any possible upstream error.
It's also likely your ldap server is not running or missconfigured. You can take a look to the service status as above (service slapd status).
Please, try this and tell us about the outcome.
EDIT (26/04/2016): From the conversation in the comments of this answer, I've extracted some more steps. Please, apologize for the extensive conversation below the answer, its summarized here:
Debug saslauthd service: As indicated here, this service uses the system logs. In my case (Ubuntu) those logs are in /var/log/syslog but they might be in /var/log/messages in your case. At least by default. Look at this logs at the time you try to start the service and see if you see any error message that might give you some further insights about what the problem is.
The error appearing in /var/logs/messages was: could not bind to socket : /var/run/saslauthd/mux , bind: address already in use.
We checked the mux socket using the file command: file /var/run/saslauthd/mux and the output said it was a directory. It should be a socket. Then we removed it and restarted the service. Now the service works.

Related

Why can't I start my camel3 fat-jar route as systemd service on raspberry pi?

I have created a fat-jar for my apache camel 3 route. I put that on my raspberry pi (bullseye) in /opt/myhome and could start it successfully with java 17 (also works with sudo):
/usr/bin/java -jar /opt/myhome/myhome-1.0-SNAPSHOT-jar-with-dependencies.jar
Then I have added /lib/systemd/system/myhome.service as:
[Unit]
Description=My home automation with apache camel 3.
After=network.target
[Service]
ExecStart=/usr/bin/java -jar /opt/myhome/myhome-1.0-SNAPSHOT-jar-with-dependencies.jar > /var/log/myhome.log 2>&1
[Install]
WantedBy=network.target
Then I did:
sudo systemctl daemon-reload
sudo systemctl enable myhome.service
sudo systemctl start myhome.service
After starting and waiting for some seconds I executed
systemctl status myhome.service
Which displays me
● myhome.service - My home automation with apache camel 3.
Loaded: loaded (/lib/systemd/system/myhome.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Fri 2022-10-07 18:28:52 CEST; 1h 18min ago
Process: 18159 ExecStart=/usr/bin/java -jar /opt/myhome/myhome-1.0-SNAPSHOT-jar-with-dependencies.jar > /var/>
Main PID: 18159 (code=exited, status=0/SUCCESS)
CPU: 10.174s
systemd[1]: Started My home automation with apache camel 3..
java[18159]: WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance.
java[18159]: Apache Camel Runner takes the following options
java[18159]: -h or -help = Displays the help screen
java[18159]: -r or -routers <routerBuilderClasses> = Sets the router builder classes which will be loaded while starting the camel context
java[18159]: -d or -duration <duration> = Sets the time duration (seconds) that the application will run for before terminating.
java[18159]: -dm or -durationMaxMessages <durationMaxMessages> = Sets the duration of maximum number of messages that the application will process before terminating.
java[18159]: -di or -durationIdle <durationIdle> = Sets the idle time duration (seconds) duration that the application can be idle before terminating.
java[18159]: -t or -trace = Enables tracing
java[18159]: -ts or -traceStandby = Enables tracing standby
java[18159]: -e or -exitcode <exitcode> = Sets the exit code if duration was hit
java[18159]: -pl or -propertiesLocation <propertiesLocation> = Sets location(s) to load properties, such as from classpath or file system.
systemd[1]: myhome.service: Succeeded.
systemd[1]: myhome.service: Consumed 10.174s CPU time.
So this means the process was started, but then not the same as when starting the jar manually happens, but a help message seems to appear.
So the question is, why did the jar behaves differently as when started manually?
I also tested to change the code in myhome.service to:
/usr/bin/java -jar /opt/myhome/myhome-1.0-SNAPSHOT-jar-with-dependencies.jar -e 10 -d 60 -r de.powerstat.camel.homeautomation.HomeautomationRouteBuilder > /var/log/myhome.log 2>&1
Which results in the same as above. So no different exit code because of a timeout, or a not found route class.
What point did I miss here?
Update 1:
Completed the systemctl status output. Looks like this comes from org.apache.camel.main.MainCommandLineSupport
So the question is still why this shows up when starting in systemd context and not when starting within the bash?
Within my jar file the META-INF/MANIFEST.MF looks like:
Manifest-Version: 1.0
Archiver-Version: Plexus Archiver
Created-By: Apache Maven
Built-By: PowerStat
Build-Jdk: 17.0.2
Main-Class: de.powerstat.camel.homeautomation.MainApp
while the MainApp class is defined as follows:
public class HomeautomationRouteBuilder extends RouteBuilder
After some research I found out that "> /var/log/myhome.log 2>&1" will be passed as three parameters to args. Because these parameters are not recognized results in the shown help message.

How can I deploy cloudfoundry-uaa as a docker image based on tomcat?

We were using the cf-uaa's gradle tasks to create a docker image but those have been removed in the latest version. I've loaded the war in a recent version, but the service does not seem to be starting correctly.
I've been building the war from the v74 tag, adding it to tomcat:8.5.45-jdk12-openjdk-oracle or tomcat:9.0.24-jdk12-openjdk-oracle, and setting the various env vars that we were passing in to the previous image. I'm not seeing any log entries after the initial tomcat output stating that my war has been deployed and the server startup time.
The Dockerfile is basically just an adaptation of what was being passed in the previous image:
FROM tomcat:8.5.45-jdk12-openjdk-oracle
#FROM tomcat:9.0.24-jdk12-openjdk-oracle
ENV LOGIN_CONFIG_URL WEB-INF/classes/required_configuration.yml
ENV UAA_CONFIG_PATH /uaa
RUN bash -c "rm -r /usr/local/tomcat/webapps/ROOT"
RUN bash -c "rm -r /usr/local/tomcat/webapps/host-manager"
RUN bash -c "rm -r /usr/local/tomcat/webapps/manager"
RUN bash -c "rm -r /usr/local/tomcat/webapps/examples"
RUN bash -c "rm -r /usr/local/tomcat/webapps/docs"
ADD *.war /usr/local/tomcat/webapps/uaa.war
RUN bash -c "echo $LOGIN_CONFIG_URL"
EXPOSE 8080
I would expect to see the service responding to my requests, or some errors in the log indicating that the war failed to deploy. I am not currently getting any log output generated from the application code. When I send a request to the service, the response is a 500 with the an error header from the service.
X-Cf-Uaa-Error:Server failed to start. Possible configuration error.
update: I've located the uaa logs within .../tomcat/logs/uaa.log I'm not seeing anything indicating that the service failed to deploy, but I am also not seeing anything to indicate that it is picking up the env vars I have set in the container. I recreated the service using the war from the original setup which started successfully using the uaa.yml which I mounted as a volume. Comparing the logs, the original setup's first log entry is YamlProcessor which does not show up in the v75 logs at all. In fact, no debug entries show up at all, which suggests to me that my LOG_LEVEL env var is not propagating either.
Update 2: We reverted the image base to FROM tomcat:8.5-jre8 and started seeing flyway errors in the uaa.log. Our previous datasource url format was url: jdbc:postgresql://${POSTGRES_NAME}:5432/${DB}?currentSchema=uaa which caused a flyway exception. After removing the schema reference, it created the tables in the public schema. By creating the uaa schema manually before starting the service, it was able to run with the original format. The flyway version has updated, so perhaps there something new that needs to be set.
The application seems to be running, but when I try to get a token at /uaa/oauth/token I get a 500 with this error in the logs: Caused by: java.lang.NoSuchMethodError: java.nio.CharBuffer.limit(I)Ljava/nio/CharBuffer;
Since Jan 2021, UAA server docker images is now be available on cloudfoundry/uaa dockerhub repository.
docker pull cloudfoundry/uaa:75.0.0
See its Dockerfile for more details.
Can you try following ?
https://github.com/hortonworks/docker-cloudbreak-uaa
This works very well.

Unable to configure ActiveMQ web console in Ubuntu 18.x

I followed this tutorial https://howtoprogram.xyz/2017/08/09/how-to-install-activemq-on-ubuntu-16-04-lts-xenial-xerus/ to install ActiveMQ manually and everything worked fine and i was even able to access the webhost on http://127.0.0.1:8161. But I tried the sudo apt-get install automatic option out of curiosity and though it was also successful, I cannot access the web console for both installations now though I am able to start them. Below are snippets of the output:
● activemq.service - LSB: ActiveMQ instance
Loaded: loaded (/etc/init.d/activemq; generated)
Active: active (running) since Thu 2019-03-28 22:52:17 GMT; 3s ago
Docs: man:systemd-sysv-generator(8)
Process: 14696 ExecStop=/etc/init.d/activemq stop (code=exited, status=0/SUCCE
Process: 15233 ExecStart=/etc/init.d/activemq start (code=exited, status=0/SUC
Tasks: 31 (limit: 4915)
CGroup: /system.slice/activemq.service
└─15265 /usr/lib/jvm/default-java//bin/java -Xms512M -Xmx512M -Dorg.a
Mar 28 22:52:11 sys-abj systemd[1]: Starting LSB: ActiveMQ instance...
Mar 28 22:52:11 sys-abj activemq[15233]: * Starting ActiveMQ instance activemq
Mar 28 22:52:17 sys-abj activemq[15233]: ...done.
Mar 28 22:52:17 sys-abj systemd[1]: Started LSB: ActiveMQ instance.
and a netstat to the transportConnector tells it's listening by yielding this result:
tcp6 0 0 127.0.0.1:61616 :::* LISTEN 15265/java
However, any time I point to 127.0.0.1:8161, I get no feed back.
I stumbled upon this How to install or config activemq admin cosole(jetty) use apt-get command? link but I still can't wrap my head around how to configure the web console.
Any help would be much appreciated
I have been able to fix it!
I deleted ActiveMQ and its accompanying dependencies by running sudo apt-get remove --auto-remove activemq, downloaded the zip file again from https://activemq.apache.org/download.html and unzipped it to my preferred destination.
I wouldn't recommend anyone running the sudo apt-get install activemq command if you're not sure of what you're doing

Spring-Boot apps installed as Service in linux cannot share postgresql database

I have two different runnable Spring-Boot applications that share the same local postgresql database schema. If I start one while the other is running, the previous one crashes and stops immediatelly.
Both applications are runnable Spring-Boot Thymeleaf web applications. Application1 generates content and saves it into the database. Application2 reads it from the same database and generates export files.
Each application connects itself to the database with different credentials. User1 has the ownership of the tables and all privileges. User2 has all privileges on all the tables.
Both are also configured to run in different ports.
Application1 - application.yml
spring:
datasource:
url: jdbc:postgresql://localhost:5432/database-name
username: application1-user
password: application1-password
server:
port: 8000
Application2 - application.yml
spring:
datasource:
url: jdbc:postgresql://localhost:5432/database-name
username: application2-user
password: application2-password
server:
port: 8002
Each one of them is owned in the file system by user1 and user2 respectively.
When I run each of them in different terminals with their specific user through the command line they start gracefully, access the tables inside the database and work as expected.
Application1 - terminal 1
sudo su user1
java -jar application1
Application2 - terminal 2
sudo su user2
java -jar application2
They are both succcessfully installed as a Service on a Linux Debian server. Both of them can start individually as Service flawlessly. But when I run one as a Service while the other is already running as a Service, the active one crashes and stops completely.
sudo service application1 start
sudo service application1 status *(active)*
sudo service application2 start
sudo service application2 status *(active, application2 stops immediatelly)*
When the first application crashes and stops, no new line is written on the log, so I cannot know the reason why it stops or read any exception that might be thrown. However, my guess is that it has something to do with Linux and not with the applications themselves.
This is the only information I could find out from the Service log.
sudo service application1 status
(...)
Aug 06 07:02:07 server application1.jar[18990]: /var/apps/application1/application1.jar: line 214: 19001 Killed "$javaexe" "${arguments[#]}"
Aug 06 07:02:07 server systemd[1]: application1.service: main process exited, code=exited, status=137/n/a
Aug 06 07:02:07 server systemd[1]: Unit application1.service entered failed state.
This is the code I wrote inside the systemctl files.
Application1 - application1.service
[Unit]
Description=application1
After=syslog.target
[Service]
User=user1
ExecStart=/var/apps/application1/application1.jar
SuccessExitStatus=143
[Install]
WantedBy=multi-user.target
Application2 - application2.service
[Unit]
Description=application2
After=syslog.target
[Service]
User=user2
ExecStart=/var/apps/application2/application2.jar
SuccessExitStatus=143
[Install]
WantedBy=multi-user.target
How can I achieve running both at the same time as a Service? Is there something I am missing?
Thank you very much in advance for your time.
Based on the information you provided, it could just be that they are both launched with the default port, thus conflicting ?
add this to one application:
server.port = 8081

"Uncaught Could not connect" error when using Openshift to deploy .war for PHP/Java bridge

Problem: Recieve 'Could not connect' error when using Openshift to deploy .war for PHP/Java bridge
Below I describe every step I've taken to get to this error, thanks in advance.
Full error: (IP concealed)
"Fatal error: Uncaught Could not connect to the JEE server W.X.Y.Z:8080. Please start it. Or define('JAVA_HOSTS',9267); define('JAVA_SERVLET',false); before including 'Java.inc' and try again. Error message: Connection refused (111) thrown in /home/stevenw1/public_html/softwareProject/real/inc/Java.inc on line 989"
Players: "Java_Bridge.war" = my java .war file that php will use to call methods from
"W.X.Y.Z" = Unchanging IP address of deployed .war file
"GUIProfile" = a Java class with #WebServlet("/GUIProfile") as public class GUIProfile extends HttpServlet
"tomcattest.php" = test file that calls GUIProfile's static method 'validate'
Deployed Java_Bridge.war and tomcattest.php work fine on my local tomcat, just not yet on Openshift.
Senario:
0. followed command line steps from Openshift 2012 java tomcat application
1. Using Openshift's rhc I have created my first app using "rhc app create -a tomcat6 -t jbossews-1.0"
2. cd ~/tomcat6/; git rm -rf ./src/ pom.xml
3. cp ~/Java_Bridge.war ./webapps/; git add ./webapps/Java_Bridge.war; git commit -m "first try"; git push
//notable output includes:
remote: Stopping jbossews cartridge
remote: Sending SIGTERM to jboss:386662 ...
remote: Skipping Maven build due to absence of pom.xml
remote: Preparing build for deployment
remote: Deployment id is bd83d6eb
remote: Activating deployment
remote: + '[' Java_Bridge.war ']'
remote: Starting jbossews cartridge
remote: Found W.X.Y.Z:8080 listening port //(not actual IP)
remote: Git Post-Receive Result: success
remote: Activation status: success
remote: Deployment completed with status: success
to ssh://thisisnottheactualuser#tomcat6-notthenamehereeither.rhcloud.com
4. Thinking the .war was deployed I ran a tomcattest.php that calls a java method 'validate', from java class GUIProfile that extends httpservlet, using the php/java bridge Java.inc
//of course using the same IP from above...
cat tomcattest.php;
<?php
define("JAVA_HOSTS", "W.X.Y.Z:8080");
define("JAVA_SERVLET", "/Java_Bridge/GUIProfile");
require_once("Java.inc");
$valiationOutput = java_context()->getServlet()->validate("hello");
echo $valiationOutput;
?>
EDIT: later tried this also in all instances: same results exactly
cat alternatetest.php
<?php
define("JAVA_HOSTS", "W.X.Y.Z:8080");
require_once("Java.inc");
echo java("java.lang.System")->getProperties();
?>
The output of calling tomcattest.php is the 'Fatal error' you see at the top.
Double Check:
5. ssh thisisnottheactualuser#tomcat6-notthenamehereeither.rhcloud.com
6. env | grep "IP"
OPENSHIFT_JBOSSEWS_IP=W.X.Y.Z
7. env | grep "PORT"
OPENSHIFT_JBOSSEWS_HTTP_PORT=8080
OPENSHIFT_JBOSSEWS_JPDA_PORT=8787
8. changed port in tomcattest.php to 8787, didn't change a thing of course.
9. restarted from the top, this time keeping ./src/ & pom.xml, same 'Deployment completed with status: success', same error using tomcattest.php with new listening IP...
10. tried solution from 'openshift youtube vid 2012' seemingly outdated. Followed step by step:
onced ssh'ed, no "tomcat" dir, I used cd $OPENSHIFT_DATA_DIR instead to access data dir
wget tomcat, changed ports to >15000, sh startup.sh && tail -f ../logs/*
notable errors in the result include:
SEVERE: Failed to initialize connector [Connector[AJP/1.3-15009]]
org.apache.catalina.LifecycleException: Failed to initialize component
[Connector[AJP/1.3-15009]] SEVERE: Failed to initialize connector
[Connector[AJP/1.3-15009]] org.apache.catalina.LifecycleException:
Failed to initialize component [Connector[AJP/1.3-15009]] SEVERE:
Failed to initialize end point associated with ProtocolHandler
["ajp-bio-15009"] java.net.BindException: Permission denied
:15009 SEVERE: Failed to initialize end point associated with
ProtocolHandler ["ajp-bio-15009"] java.net.BindException: Permission
denied :15009
11. restarted step 6, this time left IP's as they were, changing only localhost to tomcat-stevenwernercs.rhcloud.com, same result but with original IP's
12. ran out of options online, then I posed this question...
13. then I edited it a lot...
14. patiently wait :)
That is everything I have done, I am not sure why php isnt finding Java.
I looked at previous questions didn't find anything helpful.
Open to anything, thank you
Gears in a non-scable application are not allowed to communicate on any non http/ws port. So if your php java bridge is trying to communicate with the tomcat instance on 15009 (from what i see above) that is not going to work. You could only make requests on 80/443/8000/8443. Can you verify what port the java bridge works over?
Alternate solution: https://bitnami.com/cloud
I got it working using Bitnami with Amazon AWS, it provides free service for 1 year, documentation that is easy to follow, and plentiful and up to date, It took less than an hour.
Disclaimer: Using ssh tunnel for port 8080 i configured tomcat as if on localhost, and moved my hosted .php to the
same microserver that also hosted the tomcat. (I gave up on trying to host php and tomcat separately.)
I have hosted tomcat separately before on my university's tomcat server. But that was a node I had full access to.
I would still like to try Openshifts free solution, although the current resources and methods I've seen seem to no longer be valid. And unfortunately the workarounds are not intuitive enough and are currently over my head. Thank you.

Categories