Intro
As usual I ran into a few problems installing the RSA Web agent for a client. With this documentation I hope to jog my memory for my next installation or help someone else out who is experiencing the same problems.
The details
I was installing it on on SLES 11 system, Web Agent version 7.1.
So I ran the CD/install program as root and went through the prompts for the initial setup. I tried to laucnh firefox at the end, which it couldn’t, but I don’t think that is significant. I start up the web server. The error.log file begins to fill up! It looks like this:
acestatus: error while loading shared libraries: libaceclnt.so: cannot open shared object file: No such file or directory rpc_server 2389 started by 2379 RSALogoffCookieService: error while loading shared libraries: libaceclnt.so: cannot open shared object file: No such file o r directory AceShutdown try to kill process 2389 signal 15 received acestatus: error while loading shared libraries: libaceclnt.so: cannot open shared object file: No such file or directory RSALogoffCookieService: error while loading shared libraries: libaceclnt.so: cannot open shared object file: No such file o r directory start child 2403 [Mon Aug 18 16:17:55 2014] [notice] Apache/2.2.27 (Unix) mod_rsawebagent/7.1.0[639] DAV/2 PHP/5.2.14 with Suhosin-Patch con figured -- resuming normal operations Cannot register service: RPC: Authentication error; why = Client credential too weak unable to register (300760, 1).child 2403 end start child 2409 Cannot register service: RPC: Authentication error; why = Client credential too weak unable to register (300760, 1).child 2409 end start child 2410 Cannot register service: RPC: Authentication error; why = Client credential too weak unable to register (300760, 1).child 2410 end start child 2411 Cannot register service: RPC: Authentication error; why = Client credential too weak unable to register (300760, 1).child 2411 end start child 2412 Cannot register service: RPC: Authentication error; why = Client credential too weak unable to register (300760, 1).child 2412 end start child 2413 ... |
Not good.
So I eventually realize that my web server is running as user wwwrun and the RSA web agent stuff I installed as root and its directory, rsawebagent, is owned by userid 40959 – there was no attempt by the installer to match that up to the user the web server runs as. So I try a fix by hand like this:
$ chown -R wwwrun rsawebagent
Success! That succeeds in getting rid of the repeating RPC error. Now the error.log file has only a modest level of errors:
acestatus: error while loading shared libraries: libaceclnt.so: cannot open shared object file: No such file or directory rpc_server 27766 started by 27756 RSALogoffCookieService: error while loading shared libraries: libaceclnt.so: cannot open shared object file: No such file or directory AceShutdown try to kill process 27766 signal 15 received acestatus: error while loading shared libraries: libaceclnt.so: cannot open shared object file: No such file or directory RSALogoffCookieService: error while loading shared libraries: libaceclnt.so: cannot open shared object file: No such file or directory start child 27780 [Mon Aug 18 16:25:00 2014] [notice] Apache/2.2.27 (Unix) mod_rsawebagent/7.1.0[639] DAV/2 PHP/5.2.14 with Suhosin-Patch configured -- resuming normal operations |
But the thing is, it actually, mostly kind of, seems to work. You see a promising Authentication Succeeded screen in your browser after logging in to the home page. But then it directs you back to the RSA login screen. I was actually stuck on this point for a long time.
The error.log file also looks encouraging at this point:
[Mon Aug 18 16:27:28 2014] [notice] Authentication succeeded User: drj. |
My insight today is to tackle the libaceclnt.so problem. I actually ran a trace of the startup to see where it was looking for that file so I could put it there. It was looking in system directories like these:
[pid 31974] open("/usr/lib64/tls/x86_64/libaceclnt.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 31974] stat("/usr/lib64/tls/x86_64", 0x7fff93b721b0) = -1 ENOENT (No such file or directory)
[pid 31974] open("/usr/lib64/tls/libaceclnt.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 31974] stat("/usr/lib64/tls", 0x7fff93b721b0) = -1 ENOENT (No such file or directory)
[pid 31974] open("/usr/lib64/x86_64/libaceclnt.so", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 31974] stat("/usr/lib64/x86_64", 0x7fff93b721b0) = -1 ENOENT (No such file or directory)
[pid 31974] open("/usr/lib64/libaceclnt.so", O_RDONLY) = -1 ENOENT (No such file or directory)
... |
So I decided to make a soft link to it from /usr/lib64 such that:
libaceclnt.so -> /usr/local/apache202/rsawebagent/libaceclnt.so |
Note that my ServerRoot was /usr/local/apache202.
Now when I start up my apache202 instance I have this in error.log:
rpc_server 28874 started by 28860 grep RSALogoffCookieService /proc/*/cmdline | sed 's/\/cmdline.*\/proc\// /g' | sed 's/\/cmdline.*/ /' | sed 's/.*\/proc\// /' | sort -u start child 28877 grep RSALogoffCookieService /proc/*/cmdline | sed 's/\/cmdline.*\/proc\// /g' | sed 's/\/cmdline.*/ /' | sed 's/.*\/proc\// /' | sort -u AceShutdown try to kill process 28874 signal 15 received grep RSALogoffCookieService /proc/*/cmdline | sed 's/\/cmdline.*\/proc\// /g' | sed 's/\/cmdline.*/ /' | sed 's/.*\/proc\// /' | sort -u start child 28913 [Mon Aug 18 16:36:23 2014] [notice] Apache/2.2.27 (Unix) mod_rsawebagent/7.1.0[639] DAV/2 PHP/5.2.14 with Suhosin-Patch configured -- resuming normal operations |
And best of all – it actually works!
I get the RSA authentication page initially. I log on and get redirected to the actual server home page. The access.log file records my username in the access line.
Additional error observed months later
You know that symptom I described above? You see a promising Authentication Succeeded screen in your browser after logging in to the home page. But then it directs you back to the RSA login screen. My web server had been running fine for over a month when all of a sudden it behaved that way again. Confounding. So I put on my big boy pants and did an strace. Nothing popped out at me, but I was struck by frequent access to an htdocs filepath. What’s so unusual about that? I don’t use htdocs in my configurations! So where was that coming from? I re-checked my configuration. OK, this is embarrassing. I have a sweeping include statement in my top-level httpd.conf file:
# pick up all vhosts Include conf/vhosts/*.conf |
It seemed like a good idea at the time. In my conf/vhosts directory I actually had two conf files, my rsaauth.conf but also a dflt.conf!! And the dflt.conf had the references to htdocs, but no references to the RSA authentication. So it was being used to establish the location of the home directory and the other conf file to fix the authentication type, I guess.
I removed the dflt.conf file, restarted and everything began to work once again. Whew!
RPC errors returned after a few months
After a year or so of running the RPC errors mentioned above returned and I never could figure out why and I no longer needed this service so I didn’t pursue it.
Conclusion
A few errors were observed installing RSA Web Agent v 7.1 on SLES Linux. I had had similar problems on Redhat as well. I finally found some solutions and now they’re ready to use it!
References
This write-up is partially related to my blog post of installing multiple apache instances.