Novell expired certificate/CA renew

 If you do not reboot your Novell for a long time (2+ years) on the next boot a lot of services do not start.

novell-os:~ # service --status-all|grep -i failed

namcd.service                                                                              loaded failed     failed       Novell Linux User Management(LUM)
novell-idsd.service                                                                        loaded failed     failed       Driver Store Daemon
novell-ipsmd.service                                                                       loaded failed     failed       Print Manager Daemon
novell-nss.service                                                                         loaded failed     failed       Novell Storage Services (NSS) file system.
novell-xregd.service                                                                       loaded failed     failed       Xtier registry daemon for OES
novell-xsrvd.service                                                                       loaded failed     failed       Xtier services daemon for OES
oes-cis-agent.service                                                                      loaded failed     failed       CIS agent for OES
oes-cis-recall-agent.service                                                               loaded failed     failed       CIS recall agent for OES
oes-cis-scanner.service                                                                    loaded failed     failed       CIS scanner for OES
smartd.service                                                                             loaded failed     failed       Self Monitoring and Reporting Technology (SMART) Daemon

Namcd could not be started:

novell-os:~ # service namcd restart
Job for namcd.service failed because the control process exited with error code. See "systemctl status namcd.service" and "journalctl -xe" for details.
novell-os:~ # systemctl status namcd.service
● namcd.service - Novell Linux User Management(LUM)
   Loaded: loaded (/usr/lib/systemd/system/namcd.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Thu 2022-06-09 10:03:14 EEST; 6s ago
     Docs: man:namcd
           man:namconfig
  Process: 30651 ExecStopPost=/usr/bin/rm -f /var/lib/novell-lum/.flush_check_file (code=exited, status=0/SUCCESS)
  Process: 30679 ExecStart=/usr/sbin/namcd (code=exited, status=1/FAILURE)
  Process: 30675 ExecStartPre=/usr/bin/rm -f /var/lib/novell-lum/.flush_check_file (code=exited, status=0/SUCCESS)
  Process: 30671 ExecStartPre=/usr/bin/rm -f /var/lib/novell-lum/.refresh_info (code=exited, status=0/SUCCESS)
  Process: 30667 ExecStartPre=/usr/bin/rm -f /var/lib/novell-lum/.user_info.* (code=exited, status=0/SUCCESS)
  Process: 30663 ExecStartPre=/usr/bin/rm -f /var/lib/novell-lum/.group_info.* (code=exited, status=0/SUCCESS)
  Process: 30659 ExecStartPre=/usr/bin/rm -f /var/lib/novell-lum/.namcdnotloaded (code=exited, status=0/SUCCESS)
  Process: 30655 ExecStartPre=/usr/bin/rm -f /var/lib/novell-lum/.namcdloaded (code=exited, status=0/SUCCESS)
    Tasks: 0 (limit: 512)

Most probably this is due to expired Certificate of Authority and/or server certificates. You can check certificate validity via iManager

If it says 'expired' then you will need to recreate all certificates
The problem is that if you do not delete old CA, you will always get error.

Here is how to delete server CA.



After that you can run this command to recreate all needed certificates:

novell-os:~ # ndsconfig upgrade

[1] Instance at /etc/opt/novell/eDirectory/conf/nds.conf:  novell-os.OU=Servers.O=STEMO_LTD.STEMOCO

Upgrading NetIQ eDirectory server with the following parameters, Please wait...
  Tree Name             : STEMOCO
  Server DN             : novell-os.OU=Servers.O=STEMO_LTD

  Configuration File    : /etc/opt/novell/eDirectory/conf/nds.conf
  Instance Location     : /var/opt/novell/eDirectory/data
  DIB Location          : /var/opt/novell/eDirectory/data/dib

/var/opt/novell/eDirectory/data/nds-http
Current env file will be backed-up in format env.current_date, any customizations done to env file need to be copied back to new env file from backed-up file.

Checking if server is ready to service requests... Done
Enter admin name with context[admin.org]:admin.stemo_context
Enter the password for admin.stemo_context:

Performing eDirectory health check...

Extending schema...
Done
For more details view schema extension logfile: /var/opt/novell/eDirectory/log/schema.log

Configuring HTTP service... Done
Configuring LDAP service... Done
Configuring SNMP service... Done
Configuring SAS service... Failed to configure SAS service: no such attribute err=-603
An error has occured while configuring the NetIQ eDirectory Server. Please look /var/opt/novell/eDirectory/log/ndsd.log file for more information.

The instance at /etc/opt/novell/eDirectory/conf/nds.conf is upgraded successfully.

ERROR: /opt/novell/eDirectory/bin/ndsconfig return value = 74.

If you get this error it is because of expired and not deleted CA. If is says 'done' just restart your Novell server and everything is up and running again.

dh key too small solution

When using latest version ot openssl for TLS connection gives the following error:

139640766993728:error:141A318A: SSL routines:tls_process_ske_dhe:dh key too small:../ssl/statem/statem_clnt.c:2156:

or with qmail + TLS patch

qmail deferral: TLS_connect_failed:_error:141A318A: SSL_routines:tls_process_ske_dhe:dh_key_too_small...

Edit your openssl.cnf file (Debian - /etc/ssl/openssl.cnf):

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=2

change CipherString default to 1:

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=1

Less secure but it works.

Configuring OpenVPN with Ed25519 certificates and TLS 1.3

Creating certificates with Elliptic Curves: 

Requirements: OpenSSL 1.1.x, OpenVPN 2.5.x, EasyRSA 3.0.x

Initializing PKI environment

# easyrsa init-pki

Creating the Certificate of Authority (CA)

# easyrsa --use-algo=ed --curve=ed25519 build-ca

Creating Certificate Request

# easyrsa --use-algo=ed --curve=ed25519 --req-c=BG --req-city=Gabrovo --req-org=Horizon9 --req-email=geroy@horizon9.org --dn-mode=org gen-req horizon9

Singning the CA request

# easyrsa sign-req server horizon9

Creating OpenVPN server keys

# easyrsa build-server-full horizon9 nopass

Creating OpenVPN client keys

# easyrsa build-client-full client1 nopass

 

OpenVPN config file:

local 10.1.1.1 # put your IP address here
port 1194
proto tcp
dev tun
ca /path/to/ca.crt
cert /path/to/horizon9.crt
key /path/to/horizon9.key
server 10.1.11.0 255.255.255.0 # your OpenVPN network IP addresses
push "route 10.1.12.0 255.255.255.0" # your local network here
push "dhcp-option DNS 10.1.12.1"
keepalive 5 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append  /var/log/openvpn.log
verb 4

#data channel cipher
cipher AES-128-GCM

#don't negotiate ciphers, we know what we want
ncp-disable

# TLS 1.3 encryption settings
tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

# TLS 1.2 encryption settings
tls-cipher TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256

#disable static Diffie-Hellman parameters since we're using ECDHE
dh none

# use this curve
ecdh-curve secp384r1

#this tells OpenVPN which side of the TLS handshake it is
tls-server

#tls-client # uncomment this on the client side

Converting CVS to GIT repositories

You need cvs-fast-export tool in your path
All projects in old CVS repositories are listed in all-projects.txt file and it is in you old cvs repos folder.

for a in `cat all-projects.txt`
do
    cd $a
    find .|cvs-fast-export > ~/separate-projects/$a.cfe
    cd ..
done

This will export every project folder as single file in /home/username/separate-projects/ 

Now to import it as git repositories

cd ~/separate-projects/
for a in `ls *.cfe`
do
    adir=`echo $a|sed s/".cfe"/""/g`
    git init "$adir".git
    cd "$adir".git
    git fast-import < ../$a
    cd ..

done

 

DHCP server listen on alias interface (eth0:1)

Linux server with more than one IP address on the same interface.

eth0 - 192.168.0.1/24
eth0:1 - 10.1.42.1/24

We want DHCP server to serve IP addresses only from 10.1.42.0/24 . If we do this in config file like this:

 subnet 10.1.42.0 netmask 255.255.255.0 {
                range 10.1.42.30 10.1.42.90;
                option broadcast-address 10.1.42.255;
                option routers 10.1.42.1;
        }

it will fail to start and produce the following error:

dhcpd: No subnet declaration for eth0 (192.168.0.1).

The correct configuration is to use shared-network parameter and define all the networks of the physical interface inside it.

shared-network horizon9net {

        subnet 192.168.0.0 netmask 255.255.255.0 {
        }

        subnet 10.1.42.0 netmask 255.255.255.0 {
                range 10.1.42.30 10.1.42.90;
                option broadcast-address 10.1.42.255;
                option routers 10.1.42.1;
        }
}

Novell OES 11.1 shell commands hang without reason

Novell OES 11 linux shell commands hang for a very long time. It happened to me and I was able to fix it without restarting the whole server.

Server release info:

Novell Open Enterprise Server 11 (x86_64)
VERSION = 11.1
PATCHLEVEL = 1

Symptoms:

# strace -p26881
Process 26881 attached - interrupt to quit
connect(146, {sa_family=AF_FILE, path="/var/run/novell-lum/.nam_nss_sock"}, 35^C <unfinished ...>

All http services that are not using linux authentiction are working - iManager works, iMonitor works, Remote Manager is not working because it is for controlling linux services and require linux authentication.

It seems that something went wrong with namcd service. Most linux commands (like cron, id, ssh...) are trying to check through that socket for a user FDN from eDirectory. Linux User Managment (LUM) maps linux users to eDirectory users and every linux program executed is asking namcd (eDirectory Novell Account Management caching daemon) for information about current user. If namcd is not working it will just use local linux user db for that and if is working correctly you can check every user in eDir like this:

Note: admin is not local linux user but eDir user

Working LUM and namcd:

# id admin
uid=602(admin) gid=602 groups=602,601(sms smdr group)

Not working LUM and/or namcd:

# id admin
id: admin: No such user

The problem is when namcd is working but not returning any data through that socket. Then you get every linux command that checks for current user to hang forever.

# id admin
(hangs forever until you press ctrl+c)

Solution is to kill all hanged processes and then restart namcd

# rcnamcd restart

I was able to login via ssh in a strange way - it asks me for password and then hanged and I left it like this and after an hour I pressed ctrl+c and it showed me the desired shell on the remote server.

If you do this and it still does not work properly and you get messages like this in /var/log/messages

Nov 22 10:19:45 storage /usr/sbin/namcd[720]:  GetGIDsGroupListNumberOfGroupsOfWS: Error [32] in LDAP search while trying to find group FDNs with scope=base for cn=UNIX Workstation - storage,o=servers

You need to recreate nam.conf. For more information look here: http://geroyblog.blogspot.com/2013/04/novell-enterprise-linux-server-install.html