CS.cfg cleared?

[pki-bot]

This issue was migrated from Pagure Issue #714. Originally filed by pbbunny on 2013-08-22 16:26:56:

• Closed as Fixed
• Assigned to vakwetu (@vakwetu)

---

After performing the following tasks, the process restart seemed to have wiped the content of the CS.cfg:

1. cp /etc/pki/pki-district/server.xml /etc/pki/pki-district/server.xml.orig
2. modify the content with the following data:
   ORIGINAL
   MODIFIED

<!-- This Realm uses the UserDatabase configured in the global JNDI

resources under the key "UserDatabase". Any edits

that are performed against this UserDatabase are immediately

available for use by the Realm. -->

<Realm className="org.apache.catalina.realm.UserDatabaseRealm"

resourceName="UserDatabase"/>

  <Realm className="org.apache.catalina.realm.JNDIRealm"
      connectionURL="ldap://OURSERVER:389"
      userPattern="uid={0},o=ca"
      roleBase="ou=groups,o=ca"
      roleName="cn"
    roleSearch="(uniqueMember={0})"
  />

3. cp /var/lib/pki/pki-district/webapps/ca/WEB-INF/web.xml /var/lib/pki/pki-district/webapps/ca/WEB-INF/web.xml.orig

4. modify the content with the following data:
   ORIGINAL
   
   Certificate Authority
   

   *

MODIFIED

Certificate Authority

*

BASIC PKI Certificate Authority * EE Services /ee/ca/* * CONFIDENTIAL

5. Restarted the service: systemctl restart pki-tomcatd.target & systemctl restart pki-tomcatd@pki-district.services

After performing the restarted, I started getting an HTTP 500 within the subsystem's admin and EE pages.

Turns out, the CS.cfg was wiped, it is completely empty. I'm attaching the catalina.out FYI.

[pki-bot]

Comment from pbbunny at 2013-08-22 16:29:14

The original catalina.out, prior to a clean restart of dir and ca services, and the new catalina.out created after performing a dir and ca services restart.
catalina.out.zip

[pki-bot]

Comment from vakwetu (@vakwetu) at 2013-09-03 04:19:45

Applied patch to not write to CS.cfg on startup/shutdown:

To ssh://vakwetu@git.fedorahosted.org/git/pki.git
9d70b93..05ff18e master -> master

To ssh://vakwetu@git.fedorahosted.org/git/pki.git
0beaa10..265f790 DOGTAG_10_0_BRANCH -> DOGTAG_10_0_BRANCH

[pki-bot]

Comment from pbbunny at 2017-02-27 14:02:02

Metadata Update from @pbbunny:

• Issue assigned to vakwetu
• Issue set to the milestone: 10.0.5