Cygwin/ssh connection failing under Oracle EM 12c - ssh
I have got Oracle Enterprise Manager 12c installed on a server (myoemhost), but when I try to add a target manually, it produces the following message :-
Shell path is incorrect or not defined.:C:/cygwin/bin/sh.exe(SH_PATH),-c(SH_ARGS) on host mydbhost.mycompany.co.uk
I added authorised credentials of cyg_server with the correct password, and with no run/as privs (because when I did it wouldn't let me apply).
The log file produces the following results
2014-01-15_15-42-13:INFO:======================================Initialization START ====================================
2014-01-15_15-42-13:INFO:Creating instance of ClusterBase Ops for hostnamemydbhost.mycompany.co.uk
2014-01-15_15-42-13:INFO:Setting security contextSYSMAN
2014-01-15_15-42-13:INFO:Setting locale succeeded in BaseDeployerOps
2014-01-15_15-42-13:INFO:[action name=SSHValidations, action Description=Remote Validations, order=100, skip=false, executeAlways=false, status=null,
2014-01-15_15-42-13:INFO:[action name=SSHSetup, action Description=SSH Setup, order=200, skip=false, executeAlways=false, status=null,
2014-01-15_15-42-13:INFO:skipping ssh setup since its jsch plugin
2014-01-15_15-42-13:INFO: Skipping action SSHSetup based on inputs
2014-01-15_15-42-13:INFO:[action name=CopyAgentImage, action Description=Transferring Agent Software to Destination Host, order=300, skip=false, executeAlways=false, status=null,
2014-01-15_15-42-13:INFO: ACTIONS : SSHValidations
2014-01-15_15-42-13:INFO: ACTIONS : CopyAgentImage
2014-01-15_15-42-13:INFO:============Creating Deployment Vo for key : Initialization and setting status as NOT_EXECUTED
2014-01-15_15-42-13:INFO:=====Creating Action Vo for actionSSHValidations
2014-01-15_15-42-13:INFO:=====Creating Action Vo for actionCopyAgentImage
2014-01-15_15-42-13:INFO:deploymentVo has now status: NOT_EXECUTED
2014-01-15_15-42-14:INFO:Retry Count 5 sleep interval 250
2014-01-15_15-42-14:INFO:==SUDO EXISTS false SUDO PRIV false
2014-01-15_15-42-14:INFO:====CALLING ACTIONdoSSHValidations
2014-01-15_15-42-14:INFO:updating status IN_PROGRESS for action name SSHValidations with key: SSHValidations
2014-01-15_15-42-14:INFO:action:NodesAliveperform:true
2014-01-15_15-42-14:INFO:===VALIDATION===:Checking for Nodes Alive
2014-01-15_15-42-14:INFO:RESULT 0
2014-01-15_15-42-14:INFO:====CALLING ACTIONdoNodesAlive
2014-01-15_15-42-14:INFO:action:RemotePasswordCheckperform:true
2014-01-15_15-42-14:INFO:===VALIDATION===:Checking Password Validity on target nodes
2014-01-15_15-42-14:INFO:NODES=mydbhost.mycompany.co.uk Retry Count 5
2014-01-15_15-42-14:INFO:retry count : 1
2014-01-15_15-42-14:INFO:Running cmd C:/cygwin/bin/true.exe on node mydbhost.mycompany.co.uk
2014-01-15_15-42-14:INFO:ssh connect timeout 60000
2014-01-15_15-42-16:INFO:Exit Code : 1
2014-01-15_15-42-16:INFO:Error :
2014-01-15_15-42-16:INFO:Out:
2014-01-15_15-42-16:INFO:Checking for password validity on target nodes : PASSED
2014-01-15_15-42-16:INFO:RESULT 0
2014-01-15_15-42-16:INFO:====CALLING ACTIONdoRemotePasswordCheck
2014-01-15_15-42-16:INFO:action:ShPathCheckperform:true
2014-01-15_15-42-16:INFO:===VALIDATION===:Checking SH_PATH on target nodes
2014-01-15_15-42-16:INFO:isWrongShPath:remotePathPropertiesLoc:E:/Oracle/Middleware/oms/oui/prov/resources Platform id:233
2014-01-15_15-42-16:INFO:NODES=mydbhost.mycompany.co.uk
2014-01-15_15-42-16:INFO:Running cmd C:/cygwin/bin/sh.exe -c C:/cygwin/bin/true.exe on node mydbhost.mycompany.co.uk
2014-01-15_15-42-16:INFO:Action description Execution of command C:/cygwin/bin/sh.exe -c C:/cygwin/bin/true.exe on host mydbhost.mycompany.co.uk
2014-01-15_15-42-16:INFO:Attempt :1 pty required false with no inputs
2014-01-15_15-42-17:INFO:C:/cygwin/bin/sh.exe -c C:/cygwin/bin/true.exe execution failed on host mydbhost.mycompany.co.uk
2014-01-15_15-42-17:INFO: OUT null
2014-01-15_15-42-17:INFO: ERR null
2014-01-15_15-42-17:INFO: EXIT CODE1
2014-01-15_15-42-17:INFO: ACTION Execution of command C:/cygwin/bin/sh.exe -c C:/cygwin/bin/true.exe on host mydbhost.mycompany.co.uk
2014-01-15_15-42-17:INFO:SH_PATH Error Message:C:/cygwin/bin/sh.exe(SH_PATH),-c(SH_ARGS) on host mydbhost.mycompany.co.uk
2014-01-15_15-42-17:INFO: Jsch Validation Failed Problem :Shell Path validation failed Recommendation: Check the property values in the following files in this order, ssPaths_<plat>.properties or sPaths.properties or Paths.properties, in "E:/Oracle/Middleware/oms/oui/prov/resources" directory. If the property values are correct, then ensure the login user account is enabled for remote logins.For more details, refer to the Oracle Enterprise Manager Basic Installation Guide.
2014-01-15_15-42-17:INFO:Breaking since the jsch validation has failed
2014-01-15_15-42-17:INFO:InvocationTargetException Exception
2014-01-15_15-42-17:INFO:Printing Exception :java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at oracle.sysman.core.agentpush.ui.deployer.BaseDeployerOps.executeActions(BaseDeployerOps.java:1862)
at oracle.sysman.core.agentpush.ui.deployer.InitializationDeployer.deploy(InitializationDeployer.java:421)
at oracle.sysman.core.agentpush.ui.deployfwk.DeploymentWorker.run(DeploymentWorker.java:26)
at oracle.sysman.util.threadPoolManager.WorkerThread.run(Worker.java:311)
Caused by: oracle.sysman.core.agentpush.ui.exception.JschValidationException
at oracle.sysman.core.agentpush.ui.deployer.JschValidationOps.doShPathCheck(JschValidationOps.java:466)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at oracle.sysman.core.agentpush.ui.deployer.InitializationDeployer.doSSHValidations(InitializationDeployer.java:137)
... 8 more
2014-01-15_15-42-17:INFO: Jsch Valdation Failed Problem :Shell Path validation failed Recommendation: Check the property values in the following files in this order, ssPaths_<plat>.properties or sPaths.properties or Paths.properties, in "E:/Oracle/Middleware/oms/oui/prov/resources" directory. If the property values are correct, then ensure the login user account is enabled for remote logins.For more details, refer to the Oracle Enterprise Manager Basic Installation Guide.
2014-01-15_15-42-17:INFO:Updating Action SSHValidationswith Status FAILED and error Message :Shell path is incorrect or not defined.:C:/cygwin/bin/sh.exe(SH_PATH),-c(SH_ARGS) on host mydbhost.mycompany.co.uk and problem Shell Path validation failed and recommendation Check the property values in the following files in this order, ssPaths_<plat>.properties or sPaths.properties or Paths.properties, in "E:/Oracle/Middleware/oms/oui/prov/resources" directory. If the property values are correct, then ensure the login user account is enabled for remote logins.For more details, refer to the Oracle Enterprise Manager Basic Installation Guide.
2014-01-15_15-42-17:INFO:=================action status is not empty FAILED
2014-01-15_15-42-17:INFO:Breaking since the jsch validation has failed
2014-01-15_15-42-17:INFO:Skipping action CopyAgentImage since some previous step has failed
2014-01-15_15-42-17:INFO:The following action failedSSHValidations
2014-01-15_15-42-17:INFO:TIME TAKEN for Initialization on host mydbhost.mycompany.co.uk is 0: hrs 0: mins 4 sec
2014-01-15_15-42-17:INFO:PERF:HOSTNAME:mydbhost.mycompany.co.uk:InitializationDeployer_EXECUTION_TIME:4018
2014-01-15_15-42-17:INFO:HOST:mydbhost.mycompany.co.uk
2014-01-15_15-42-17:INFO:Destroying Logger
2014-01-15_15-42-17:INFO:======================================Initialization END ====================================
2014-01-15_15-42-17:INFO:Clearing EMSecurityContext EMExecutionContext in BaseDeployerOps
Now I admit I am not an expert on ssh or cygwin or even Oracle12c but the section that reads
2014-01-15_15-42-14:INFO:===VALIDATION===:Checking for Nodes Alive
2014-01-15_15-42-14:INFO:RESULT 0
2014-01-15_15-42-14:INFO:====CALLING ACTIONdoNodesAlive
2014-01-15_15-42-14:INFO:action:RemotePasswordCheckperform:true
2014-01-15_15-42-14:INFO:===VALIDATION===:Checking Password Validity on target nodes
2014-01-15_15-42-14:INFO:NODES=mydbhost.mycompany.co.uk Retry Count 5
2014-01-15_15-42-14:INFO:retry count : 1
2014-01-15_15-42-14:INFO:Running cmd C:/cygwin/bin/true.exe on node mydbhost.mycompany.co.uk
2014-01-15_15-42-14:INFO:ssh connect timeout 60000
2014-01-15_15-42-16:INFO:Exit Code : 1
2014-01-15_15-42-16:INFO:Error :
2014-01-15_15-42-16:INFO:Out:
2014-01-15_15-42-16:INFO:Checking for password validity on target nodes : PASSED
2014-01-15_15-42-16:INFO:RESULT 0
suggests that it can contact the remote host (mydbhost.mycompany.co.uk) using the username and password I provided (cyg_server) which suggests the ssh stuff is working.
However the next part
2014-01-15_15-42-16:INFO:====CALLING ACTIONdoRemotePasswordCheck
2014-01-15_15-42-16:INFO:action:ShPathCheckperform:true
2014-01-15_15-42-16:INFO:===VALIDATION===:Checking SH_PATH on target nodes
2014-01-15_15-42-16:INFO:isWrongShPath:remotePathPropertiesLoc:E:/Oracle/Middleware/oms/oui/prov/resources Platform id:233
2014-01-15_15-42-16:INFO:NODES=mydbhost.mycompany.co.uk
2014-01-15_15-42-16:INFO:Running cmd C:/cygwin/bin/sh.exe -c C:/cygwin/bin/true.exe on node mydbhost.mycompany.co.uk
2014-01-15_15-42-16:INFO:Action description Execution of command C:/cygwin/bin/sh.exe -c C:/cygwin/bin/true.exe on host mydbhost.mycompany.co.uk
2014-01-15_15-42-16:INFO:Attempt :1 pty required false with no inputs
2014-01-15_15-42-17:INFO:C:/cygwin/bin/sh.exe -c C:/cygwin/bin/true.exe execution failed on host mydbhost.mycompany.co.uk
2014-01-15_15-42-17:INFO: OUT null
2014-01-15_15-42-17:INFO: ERR null
2014-01-15_15-42-17:INFO: EXIT CODE1
2014-01-15_15-42-17:INFO: ACTION Execution of command C:/cygwin/bin/sh.exe -c C:/cygwin/bin/true.exe on host mydbhost.mycompany.co.uk
2014-01-15_15-42-17:INFO:SH_PATH Error Message:C:/cygwin/bin/sh.exe(SH_PATH),-c(SH_ARGS) on host mydbhost.mycompany.co.uk
2014-01-15_15-42-17:INFO: Jsch Validation Failed Problem :Shell Path validation failed Recommendation: Check the property values in the following files in this order, ssPaths_<plat>.properties or sPaths.properties or Paths.properties, in "E:/Oracle/Middleware/oms/oui/prov/resources" directory. If the property values are correct, then ensure the login user account is enabled for remote logins.For more details, refer to the Oracle Enterprise Manager Basic Installation Guide.
suggests it isn't, because I know that the path (c:\cygwin\bin\sh.exe) is correct and that cyg_server has access to that file (as far as I can tell).
Can anyone point me in the direction I should be going in, because I really have no clue as to what is wrong with this :)
Thanks.
According to the original poster:
Turns out this was caused by a password error - the instructions I followed to install the CYGWIN server were missing a key step that involved recreating the password for the cyg_server user in /etc/passwd and as a result, it was causing the above error (which doesn't mention passwords at all!)
Related
How to configure IBM MQ v9 to use Microsoft AD for user authentication
I'm trying to set up Microsoft AD like user repository for IBM MQ v9 Queue Manager , but without success. I read the document https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.0.0/com.ibm.mq.ref.adm.doc/q085490_.htm, but it's very unclear with all those diagrams, dashes and arrows. My final goal is to have ability to grant or rewoke authorizations based od AD groups. Can someone give me complete commands example how to configure queue manager to use AD for user repository?
IBM MQ is v9.0.0.0 and runs on CentOS v7. Active Directory is on Windows Server 2019 machine.
I tried to set AUTHINFO with MQSC commands. All commands are executed without problems. After that I refreshed security and tried to grant authorizations with setmqaut command, but unsuccessful.
I tried with this below MQSC commands:
DEFINE AUTHINFO(MY.AD.CONFIGURATION) AUTHTYPE(IDPWLDAP) AUTHORMD(SEARCHGRP) FINDGRP(member) CONNAME('192.168.100.100') BASEDNG('OU=Groups,OU=MyCompany,DC=mycompany,DC=us') SHORTUSR('sAMAccountName') LDAPUSER('mybinduser') LDAPPWD('mypassword')
ALTER QMGR CONNAUTH(MY.AD.CONFIGURATION)
REFRESH SECURITY TYPE(CONNAUTH)
setmqaut -m MY.QUEUE.MANAGER -t qmgr -g myadgroup +all
After I execute command:
setmqaut -m MY.QUEUE.MANAGER -t qmgr -g myadgroup +all
This error is displyed i console: AMQ7026: A principal or group name was invalid.
And these below lines are recorded in queue manager log:
AMQ5531: Error locating user or group in LDAP
EXPLANATION:
The LDAP authentication and authorization service has failed in the ldap_search
call while trying to find user or group 'myadgroup '. Returned count is 0.
Additional context is 'rc = 87 (Bad search filter)
[(&(objectClass=groupOfNames)(=myadgroup ))]'.
ACTION:
Specify the correct name, or fix the directory configuration. There may be
additional information in the LDAP server error logs.
----- amqzfula.c : 2489 -------------------------------------------------------
On Active Directory side these lines are recorded in log:
An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: MYADSERVER$
Account Domain: MYDOMAINNAME
Logon ID: 0x3E7
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: mybinduser
Account Domain: MYDOMAINNAME
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC000006A
Process Information:
Caller Process ID: 0x280
Caller Process Name: C:\Windows\System32\lsass.exe
Network Information:
Workstation Name: MYADSERVER
Source Network Address: 192.168.100.101
Source Port: 55592
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
Here beleow is output of the command DIS AUTHINFO(MY.AD.CONFIGURATION) ALL
AMQ8566: Display authentication information details.
AUTHINFO(MY.AD.CONFIGURATION) AUTHTYPE(IDPWLDAP)
ADOPTCTX(NO) DESCR( )
CONNAME(192.168.100.100) CHCKCLNT(REQUIRED)
CHCKLOCL(OPTIONAL) CLASSGRP( )
CLASSUSR( ) FAILDLAY(1)
FINDGRP(MEMBER) BASEDNG(OU=Groups,OU=MyCompany,DC=mycompany,DC=us)
BASEDNU( )
LDAPUSER(CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us)
LDAPPWD( ) SHORTUSR(sAMAccountName)
GRPFIELD( ) USRFIELD( )
AUTHORMD(SEARCHGRP) NESTGRP(NO)
SECCOMM(NO) ALTDATE(2019-07-25)
ALTTIME(08.14.20)
Here below is output from LdapAuthentication.jar tool:
java -jar LdapAuthentication.jar ldap://192.168.100.100:389 CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us mybinduserpassword OU=MyCompany,DC=mycompany,DC=us sAMAccountName adminusername adminpassword
#WMBL3: successful bind
#WMBL3: successfull search Starting Authentication Found the user, DN is CN=adminusername,OU=MyCompany,OU=Users,OU=MyCompany,DC=mycompany,DC=us
#WMBL3 : check if the password is correct
#WMBL3: successful authentication
#WMBL3 : Commands for WebUI ldap authentication :
1. mqsisetdbparms <INodeName> -n ldap::LDAP -u "CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us" -p mybinduserpassword
Or
mqsisetdbparms <INodeName> -n ldap::192.168.100.100 -u "CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us" -p mybinduserpassword
2. mqsichangeproperties <INodeName> -b webadmin -o server -n ldapAuthenticationUri -v \"ldap://192.168.100.100:389/OU=MyCompany,DC=mycompany,DC=us?sAMAccountName\"
3. mqsiwebuseradmin <INodeName> -c -u adminusername -x -r <sysrole for eg: local userid >
Here below is qmanager log after I applied changes in my AUTHINFO what you suggested Jul 25.
AMQ5531: Error locating user or group in LDAP
EXPLANATION:
The LDAP authentication and authorization service has failed in the ldap_search
call while trying to find user or group 'wasadmin'. Returned count is 0.
Additional context is 'rc = 1 (Operations error)
[(&(objectClass=GROUP)(SAMACCOUNTNAME=wasadmin))]'.
ACTION: Specify the correct name, or fix the directory configuration. There may be
additional information in the LDAP server error logs.
This is myadgroup full DN:
CN=myadgroup,OU=System,OU=Groups,OU=MyCompany,DC=mycompany,DC=us
This is output of the setmqaut command with full group DN:
setmqaut -m MY.QUEUE.MANAGER -t qmgr -g 'CN=myadgroup,OU=System,OU=Groups,OU=MyCompany,DC=mycompany,DC=us' +all
AMQ7047: An unexpected error was encountered by a command. Reason code is 2063.
And this is qmanager log after that command was executed:
AMQ5531: Error locating user or group in LDAP
EXPLANATION: The LDAP authentication and authorization service has failed in the ldap_search call while trying to find user or group 'CN=myadgroup,OU=System,OU=Groups,OU=MyCompany,DC=mycompany,DC=us'.
Returned count is 0.
Additional context is 'rc = 1 (Operations error) [(objectClass=groupOfNames)]'.
ACTION:
Specify the correct name, or fix the directory configuration. There may be
additional information in the LDAP server error logs.
If I try with CLASSGRP(GROUP) output of the setmqaut is:
AMQ7047: An unexpected error was encountered by a command. Reason code is 2063.
And qmqnager log is:
AMQ5531: Error locating user or group in LDAP
EXPLANATION: The LDAP authentication and authorization service has failed in the
ldap_search call while trying to find user or group
'CN=myadgroup,OU=System,OU=Groups,OU=MyCompany,DC=mycompany,DC=us'.
Returned count is 0.
Additional context is 'rc = 1 (Operations error) [(objectClass=GROUP)]'.
ACTION:
Specify the correct name, or fix the directory configuration. There may be
additional information in the LDAP server error logs.
Below is my last configured authinfo object:
AMQ8566: Display authentication information details.
AUTHINFO(MY.AD.CONFIGURATION) AUTHTYPE(IDPWLDAP)
ADOPTCTX(YES) DESCR( )
CONNAME(192.168.100.100) CHCKCLNT(OPTIONAL)
CHCKLOCL(OPTIONAL) CLASSGRP(group)
CLASSUSR(USER) FAILDLAY(1)
FINDGRP(member)
BASEDNG(OU=Groups,OU=MyCompany,DC=mycompany,DC=us)
BASEDNU(OU=Users,OU=MyCompany,DC=mycompany,DC=us)
LDAPUSER(CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us)
LDAPPWD( ) SHORTUSR(sAMAccountName)
GRPFIELD(sAMAccountName) USRFIELD(sAMAccountName)
AUTHORMD(SEARCHGRP) NESTGRP(NO)
SECCOMM(NO) ALTDATE(2019-08-07)
ALTTIME(08.44.40)
Based on the your output I noted that you did not set LDAPPWD which is used by MQ to authenticate the LDAPUSER that you specified.
This is supported by the windows error you provided:
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: mybinduser
Account Domain: MYDOMAINNAME
Failure Information:
Failure Reason: Unknown user name or bad password.
In the output of LdapAuthentication.jar it appears that you have the correct password available:
CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us mybinduserpassword
You can either specify the LDAPPWD or you can blank out your LDAPUSER and see if your AD allows anonymous bind (this is rare).
I noted that you have some other fields left blank that probably need to be filled in. I also suggest you always use ADOPTCTX(YES).
Below is my suggested updates to your AUTHINFO object:
ALTER AUTHINFO(MY.AD.CONFIGURATION) +
AUTHTYPE(IDPWLDAP) +
AUTHORMD(SEARCHGRP) +
FINDGRP('member') +
ADOPTCTX(YES) +
CONNAME(192.168.100.100) +
CHCKCLNT(REQUIRED) +
CHCKLOCL(OPTIONAL) +
CLASSGRP(GROUP) +
CLASSUSR(USER) +
FAILDLAY(1) +
BASEDNG('OU=MyCompany,DC=mycompany,DC=us') +
BASEDNU('OU=MyCompany,DC=mycompany,DC=us') +
LDAPUSER('CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us') +
LDAPPWD(mybinduserpassword) +
SHORTUSR(sAMAccountName) +
GRPFIELD(sAMAccountName) +
USRFIELD(sAMAccountName) +
NESTGRP(NO) +
SECCOMM(NO)
*Note I have not tested this against AD, but I have setup IIB to authenticate the WebUI/REST calls against AD and also took inspiration from two presentations/write ups from Mark Taylor from IBM:
MQ Integration with Directory Services - Presented at MQTC v2.0.1.6
MQdev Blog: IBM MQ - Using Active Directory for authorisation in Unix queue managers
yarn application command hangs due to absence of Kerberos ticket
Within a bash script, I am invoking yarn application command in order to get the current applications running on a Cloudera Hadoop cluster secured by Kerberos. In case my application is not running, it is necessary to restart it:
spark_rtp_app_array=( $(yarn application --list -appTypes SPARK -appStates ACCEPTED,RUNNING | awk -F "\t" ' /'my_user'/ && /'my_app'/ {print $1}') )
Whenever the Kerberos ticket has ended I need to invoke kinit command, in order to renew that ticket before calling yarn application --list:
kinit -kt my_keytab_file.keytab my_kerberos_user
Otherwise, I could end with an authentication error which keeps repeating in an undefinite way with the following traces:
19/02/13 15:00:22 WARN ipc.Client: Exception encountered while connecting to the server : javax.security.sasl.SaslException: GSS in\
itiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
19/02/13 15:00:22 WARN security.UserGroupInformation: PriviledgedActionException as:my_kerberos_user (auth:KERBEROS) cause:java.io\
.IOException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechan\
ism level: Failed to find any Kerberos tgt)]
[...]
Is there any way of setting a maximum number of connection retries to YARN?
The bash script is being executed in a cron task, so it should not be hung in any way.
Apache Drill Impersonation
I'm trying to build in security on our Drill (1.6.0) system. I managed to get the security user authentication to work(JPam as explained in the documentation), but the impersonation does not seem to work. It seems to execute and fetch via the the admin user regardless of who has logged in via ODBC.
My drill-override.conf file is configured as follows:
drill.exec: {
cluster-id: "drillbits1",
zk.connect: "localhost:2181",
impersonation: {
enabled: true,
max_chained_user_hops: 3
},
security.user.auth {
enabled: true,
packages += "org.apache.drill.exec.rpc.user.security",
impl: "pam",
pam_profiles: [ "sudo", "login" ]
}
}
We are also only using Drill on one server, therefore I'm running drill-embedded to start things up. Troubleshooting:
root#srv001:/opt/apache-drill-1.6.0# bin/sqlline -u "jdbc:drill:schema=dfs;zk=localhost:2181;impersonation_target=dUser001" -n entryUser -p entryUserPassword
Error: Failure in connecting to Drill: org.apache.drill.exec.rpc.RpcException: Failure setting up ZK for client. (state=,code=0)
java.sql.SQLException: Failure in connecting to Drill: org.apache.drill.exec.rpc.RpcException: Failure setting up ZK for client.
at org.apache.drill.jdbc.impl.DrillConnectionImpl.<init> (DrillConnectionImpl.java:159)
at org.apache.drill.jdbc.impl.DrillJdbc41Factory.newDrillConnection(DrillJdbc41Factory.java:64)
at org.apache.drill.jdbc.impl.DrillFactory.newConnection(DrillFactory.java:69)
at net.hydromatic.avatica.UnregisteredDriver.connect(UnregisteredDriver.java:126)
at org.apache.drill.jdbc.Driver.connect(Driver.java:72)
at sqlline.DatabaseConnection.connect(DatabaseConnection.java:167)
at sqlline.DatabaseConnection.getConnection(DatabaseConnection.java:213)
at sqlline.Commands.connect(Commands.java:1083)
at sqlline.Commands.connect(Commands.java:1015)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at sqlline.ReflectiveCommandHandler.execute(ReflectiveCommandHandler.java:36)
at sqlline.SqlLine.dispatch(SqlLine.java:742)
at sqlline.SqlLine.initArgs(SqlLine.java:528)
at sqlline.SqlLine.begin(SqlLine.java:596)
at sqlline.SqlLine.start(SqlLine.java:375)
at sqlline.SqlLine.main(SqlLine.java:268)
Caused by: org.apache.drill.exec.rpc.RpcException: Failure setting up ZK for client.
at org.apache.drill.exec.client.DrillClient.connect(DrillClient.java:200)
at org.apache.drill.jdbc.impl.DrillConnectionImpl.<init>(DrillConnectionImpl.java:151)
... 18 more
Caused by: java.io.IOException: Failure to connect to the zookeeper cluster service within the allotted time of 10000 milliseconds.
at org.apache.drill.exec.coord.zk.ZKClusterCoordinator.start(ZKClusterCoordinator.java:123)
at org.apache.drill.exec.client.DrillClient.connect(DrillClient.java:198)
... 19 more
Any ideas on this?
I have also looked at doing my own built in security, but I'm not able to retrieve the username from a SQL query. I have tried the following without any luck:
CURRENT_USER()
USER()
SESSION_USER()
Any ideas on this approach?
I suggest to create a different pam profile (say drill) rather than login and sudo. Then create drill file under /etc/pam.d/ directory with the content: #%PAM-1.0 auth include password-auth account include password-auth To get connections run: select * from sys.connections;
OpenDJ Multi-master replication fails(Hangs at Initializing registration information step):: javax.naming.AuthenticationException
I am using OpenDJ-2.4.6 along with Oracle JDK 7.80 and I want to run Multi-master replication on 2 of my servers, the OS for these servers is Amazon Linux. The OpenDJ setup runs perfectly fine; I can start the server too without any errors. It is when I run the "dsreplication" script as follows: ./dsreplication enable --host1 server1.example,com --port1 4444 --bindDN1 "cn=Directory Manager" --bindPassword1 "Passw0rd" --replicationPort1 1388 --host2 server2.example,com --port2 4444 --bindDN2 "cn=Directory Manager" --bindPassword2 "Passw0rd" --replicationPort2 1388 --adminUID admin --adminPassword "Passw0rd" --baseDN "dc=example,dc=com" the script hangs on the following step: Initializing registration information on server server2.example.com:4444 with the contents of server server1.example.com:4444 ..... And on checking the logs, there is no error reported in there. But, when I run the following command: ./dsreplication status -h localhost -p 4444 --adminUID admin --adminPassword "Passw0rd" -X it throws the following error: The displayed information might not be complete because the following errors were encountered reading the configuration of the existing servers: Error on server2.example.com:4444: An error occurred connecting to the server. Details: javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials] Error on server:4444: An error occurred connecting to the server. Details: javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials] Please help me. Thanks in advance.
The error could not be more explicit: "Invalid Credentials" on server 2. Check the bindDN and bindPassword are valid against server 2.
When doing replication with OpenDJ, the hostnames must be resolved and addressable from either machines. Have you checked that this is the case with your Amazon Linux servers ?
DCOM and OpenMPI
I did the DCOMCNFG with both the launch and the remote access permissions, granting my local logon on each node . Have OpenMPI_v1.6.1-x64 installed in root and remote machines. HAve specified the path of .exe in the target node. But while running the .exe from root node with mpirun. I am getting the following error: D:\x64\Release>mpirun -np 2 -hostfile myhostfile.txt MPISample.exe connecting to n1234 username:toney.mathew password:******** Save Credential?(Y/N) n [n1205:04420] Could not connect to namespace cimv2 on node n1234. Error code =-2147023174 -------------------------------------------------------------------------- mpirun was unable to start the specified application as it encountered an error. More information may be available above. -------------------------------------------------------------------------- [n1205:04420] [[28225,0],0] ORTE_ERROR_LOG: A message is attempting to be sent t o a process whose contact information is unknown in file ..\..\..\openmpi-1.6.1\ orte\mca\rml\oob\rml_oob_send.c at line 145 [n1205:04420] [[28225,0],0] attempted to send to [[28225,0],1]: tag 1 [n1205:04420] [[28225,0],0] ORTE_ERROR_LOG: A message is attempting to be sent t o a process whose contact information is unknown in file ..\..\..\openmpi-1.6.1\ orte\orted\orted_comm.c at line 126 and to be more specific, i am using windows7-64bit os in both nodes,with same same user loged in.
turned off firewall, and it worked smoothly.