Webmin / Bugs / #5606 LetsEncrypt contrary verification methods

rj elleray - 2023-01-22

My only suggestion is that you 'slave' the certificates from the master server using sftp or equivalent once a day to your servers.

Or we could hope that a slave cert facility is provided in the fullness of time so that when the letsencrypt 3 monthly cron is activated it triggers a user script to do the above..

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tom MacKenzie - 2023-01-22

I can see that webmin is not looking in the correct place for the certs.

SSL certificate file /etc/ssl/virtualmin/1668215261187717/ssl.cert
SSL private key file /etc/ssl/virtualmin/1668215261187717/ssl.key

Versus where tey are:
Certificate Path: /etc/letsencrypt/live/vav###.com-0001/fullchain.pem
Private Key Path: /etc/letsencrypt/live/vav###.com-0001/privkey.pem

I guess my real ask is, why can I not do HTTP auth for LetsEncrypt in Webmin vs DNS.

Especially since, in Webmin it says:
"Let's Encrypt is a free, automated, and open certificate authority that can be used to generate an SSL certificate for use by Virtualmin.
This page can be used to request a new certificate, which will overwrite any other you currently have configured for this domain. However, the Let's Encrypt service requires that your ownership of the certificate domain be validated by checking that this system hosts the website for the domain. This is done by placing a small temporary file under the website's document directory /home/vav###/public_html."

But it only tries the DNS method when I try to renew.

On the same page containing the abocve statement, it also says:
"Renewal failed due to DNS-based validation failed :"

Last edit: Tom MacKenzie 2023-01-22

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tom MacKenzie - 2023-01-22

One thing that would solve this is immediate distribution to slave DNS from primary. If I could solve that, I wouldn't need to rely on HTTP auth for cert renewal. But I can't get it to do that automatically without logging into the slave DNS servers and applying zone.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tom MacKenzie - 2023-01-22

I would be satisfied if I knew what "Apply Zone" is running on my slave servers and just set up a temporary cron to run a command every 10 seconds until I renew my certs.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Jamie Cameron - 2023-01-22
  
  It runs a command like "rndc reload yourdomain.com"
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
  - Tom MacKenzie - 2023-01-25
    
    That does not work. 30 second timeout while running "rndc reload" every 10 seconds fails. Can you speak without a command "like' and provide the actual command?
    
    Last edit: Tom MacKenzie 2023-01-25
    
    If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
    - Jamie Cameron - 2023-01-26
      
      "rndc reload yourdomain.com" is the actual command, you just have to replace "yourdomain.com" with the actual domain name.
      
      If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
      - Tom MacKenzie - 2023-01-30
        
        I'm sorry for the tone of my post. My personal frustration is never an excuse to be rude. My sincere apologies!
        
        If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tom MacKenzie - 2023-01-25

How do I get rid of scheduled LetsEncrytp certificate renewals. I'm getting bombarded with failures.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tom MacKenzie - 2023-01-28

Let's get back to the original issue. I have a master DNS server and have now added my 2 slave instances as Clustered Slave servers in Webmin. They were successfully added and can connect fine. However, I added a txt record in one of my zones. Despite the following configurations, the Slaves are NOT updating until I Apply Zone on the Slaves.

Zone Defaults -> Also notify slaves. ("Listed": NS1IP, NS2IP)
Zone Defaults -> Notify slaves of changes? Yes

On the Slave instance, I have under the domain zone:
Zone Options -> Notify slaves of changes? Yes
Zone Options -> notify slaves.. NS1IP, NS2IP

Is there something I am missing or have misconfigured? I've now waited about 10 minutes and the Slaves still have not updated.

Important(?) note: If I create a new Zone on the Master, it DOES automatically create the Slave zones.

Last edit: Tom MacKenzie 2023-01-28

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Jamie Cameron - 2023-01-28

It's likely that something is blocking zone transfers. Check the log file /var/log/messages on the slave server and the master to see if anything is logged when you add a record on the master..

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tom MacKenzie - 2023-01-28

OK, found the problem but it only creates a new one:

Jan 28 20:12:33 ns1 named[1081]: zone tommackenzie.com/IN: refused notify from non-master: 70.35.197.230#56950
Jan 28 20:12:33 ns1 named[1081]: client @0x7f8d24039c20 2607:f1c0:1800:802a::7#36678: received notify for zone 'tommackenzie.com'
Jan 28 20:12:33 ns1 named[1081]: zone tommackenzie.com/IN: refused notify from non-master: 2607:f1c0:1800:802a::7#36678

The issue is that Webmin is using a different IP for outgoing connections (not the DHCP IP I thought before)

But my BIND is configured on a different IP, which works when I manually Apply the Zone on the slaves.

I need to talk to my hosting providerr.

Last edit: Tom MacKenzie 2023-01-28

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tom MacKenzie - 2023-01-28

I ALMOST have this working...

Master:

Jan 28 17:05:23 mail named[1269]: client @0x7f8be4067970 2a00:da00:1800:81cf::1#57903 (tommackenzie.com): zone transfer 'tommackenzie.com/IXFR/IN' denied
Jan 28 17:05:23 mail named[1269]: client @0x7f8be4058f10 2a00:da00:1800:81cf::1#60863 (tommackenzie.com): zone transfer 'tommackenzie.com/AXFR/IN' denied

Slave:

Jan 28 22:04:51 ns1 named[1090]: client @0x7f1cd04621d0 70.35.197.230#33735: received notify for zone 'tommackenzie.com'
Jan 28 22:04:51 ns1 named[1090]: zone tommackenzie.com/IN: notify from 70.35.197.230#33735: serial 2023012813
Jan 28 22:04:51 ns1 named[1090]: zone tommackenzie.com/IN: Transfer started.
Jan 28 22:04:51 ns1 named[1090]: transfer of 'tommackenzie.com/IN' from 70.35.197.230#53: connected using 74.208.139.37#59871
Jan 28 22:04:51 ns1 named[1090]: transfer of 'tommackenzie.com/IN' from 70.35.197.230#53: resetting
Jan 28 22:04:51 ns1 named[1090]: transfer of 'tommackenzie.com/IN' from 70.35.197.230#53: connected using 74.208.139.37#46367
Jan 28 22:04:51 ns1 named[1090]: transfer of 'tommackenzie.com/IN' from 70.35.197.230#53: failed while receiving responses: REFUSED
Jan 28 22:04:51 ns1 named[1090]: transfer of 'tommackenzie.com/IN' from 70.35.197.230#53: Transfer status: REFUSED
Jan 28 22:04:51 ns1 named[1090]: transfer of 'tommackenzie.com/IN' from 70.35.197.230#53: Transfer completed: 0 messages, 0 records, 0 bytes, 0.001 secs (0 bytes/sec)
Jan 28 22:04:52 ns1 named[1090]: zone tommackenzie.com/IN: Transfer started.
Jan 28 22:04:52 ns1 named[1090]: transfer of 'tommackenzie.com/IN' from 2607:f1c0:1800:802a::1#53: connected using 2607:f1c0:1801:ef::1#49469
Jan 28 22:04:52 ns1 named[1090]: transfer of 'tommackenzie.com/IN' from 2607:f1c0:1800:802a::1#53: resetting
Jan 28 22:04:52 ns1 named[1090]: transfer of 'tommackenzie.com/IN' from 2607:f1c0:1800:802a::1#53: connected using 2607:f1c0:1801:ef::1#36549
Jan 28 22:04:52 ns1 named[1090]: transfer of 'tommackenzie.com/IN' from 2607:f1c0:1800:802a::1#53: failed while receiving responses: REFUSED
Jan 28 22:04:52 ns1 named[1090]: transfer of 'tommackenzie.com/IN' from 2607:f1c0:1800:802a::1#53: Transfer status: REFUSED
Jan 28 22:04:52 ns1 named[1090]: transfer of 'tommackenzie.com/IN' from 2607:f1c0:1800:802a::1#53: Transfer completed: 0 messages, 0 records, 0 bytes, 0.001 secs (0 bytes/sec)

I am also getting refused trying to Apply Zone on Slave.

Last edit: Tom MacKenzie 2023-01-28

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tom MacKenzie - 2023-01-28

Got it working!!!!!!!!!!!!! Thanks for the time you spent helping.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tom MacKenzie - 2023-01-28

I had tried to set up a non-root user on my slaves and use that before, but despite allowing rpc for that user, it didn't work. Once I used root logins for my clusters, I had a few kinks to work out, but very happy.

You can close this.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Jamie Cameron - 2023-01-29
  
  Ok, great!
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Jamie Cameron - 2023-01-29

status: open --> closed-fixed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Ilia - 2023-01-30

but despite allowing rpc for that user, it didn't work

Tom, how exactly did you allow RPC for that user?

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Tom MacKenzie - 2023-01-30
  
  Webmin -> Webmin Users -> Click username to Edit User -> Permissions for all modules -> Can accept RPC calls?
  Yes
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Ilia - 2023-01-30

@jcameron Jamie, webmin_user_can_rpc doesn't check on $access{'rpc'} == 2, is this expected?

Also, when Permissions for all modules -> Can accept RPC calls? is set to Yes then rpc is set to 1 .. which also should have worked according to our discussion .. how come it didn't?

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Jamie Cameron - 2023-01-31
  
  It does, the fall-through case where 'rpc' is not equal to 1 or 0 is when it's equal to 2.
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

LetsEncrypt contrary verification methods

A web-based interface for system administration of UNIX

Group

Searches

Help

#5606 LetsEncrypt contrary verification methods

Discussion