<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>there are somethign like these:<br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><span></span><span>type=AVC msg=audit(1346710042.243:56): avc: denied { execute } for pid=4243 comm="gdm" name="arch" dev=dm-0 ino=786829 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file<br>type=AVC msg=audit(1346710042.243:57): avc: denied { execute } for pid=4243 comm="gdm" name="arch" dev=dm-0 ino=786829 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file<br></span></div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new
york,times,serif; background-color: transparent; font-style: normal;">and some others like these:</div><div>type=AVC msg=audit(1346838993.154:2567): avc: denied { search } for pid=17155 comm="java" name="gridengine" dev=dm-0 ino=391879 scontext=unconfined_u:system_r:pki_ca_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir<br>type=AVC msg=audit(1346838993.154:2568): avc: denied { search } for pid=17155 comm="java" name="gridengine" dev=dm-0 ino=391879 scontext=unconfined_u:system_r:pki_ca_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir<br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">And yes, I did yum update
recently.</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">Where else should I look?</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">Thanks,</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">George</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size:
12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Rob Crittenden <rcritten@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> george he <george_he7@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> Ade Lee <alee@redhat.com>; "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, September 5, 2012 8:40 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] ipa host-del<br> </font> </div> <br>
george he wrote:<br>> here are the new errors:<br>> # rm /var/log/pki-ca/*<br>> # service dirsrv restart<br>> # service pki-cad restart<br>> # grep -i error /var/log/pki-ca/*<br>> /var/log/pki-ca/catalina.2012-09-05.log:WARNING: Error while removing<br>> context [/ca]<br>> /var/log/pki-ca/catalina.2012-09-05.log:SEVERE: Error initializing<br>> socket factory<br>> /var/log/pki-ca/catalina.2012-09-05.log:java.lang.ClassNotFoundException: Error<br>> loading SSL Implementation<br>> org.apache.tomcat.util.net.jss.JSSImplementation<br>> :java.lang.ClassNotFoundException: org.mozilla.jss.ssl.SSLSocket<br>> /var/log/pki-ca/catalina.2012-09-05.log:LifecycleException: Protocol<br>> handler initialization failed: java.lang.ClassNotFoundException: Error<br>> loading SSL Implementation<br>> org.apache.tomcat.util.net.jss.JSSImplementation<br>> :java.lang.ClassNotFoundException:
org.mozilla.jss.ssl.SSLSocket<br>> /var/log/pki-ca/catalina.2012-09-05.log:SEVERE: Error deploying web<br>> application directory ca<br>> /var/log/pki-ca/catalina.out:SEVERE: Error initializing socket factory<br>> /var/log/pki-ca/catalina.out:java.lang.ClassNotFoundException: Error<br>> loading SSL Implementation<br>> org.apache.tomcat.util.net.jss.JSSImplementation<br>> :java.lang.ClassNotFoundException: org.mozilla.jss.ssl.SSLSocket<br>> /var/log/pki-ca/catalina.out:LifecycleException: Protocol handler<br>> initialization failed: java.lang.ClassNotFoundException: Error loading<br>> SSL Implementation org.apache.tomcat.util.net.jss.JSSImplementation<br>> :java.lang.ClassNotFoundException: org.mozilla.jss.ssl.SSLSocket<br>> /var/log/pki-ca/catalina.out:SEVERE: Error deploying web application<br>> directory ca<br>> /var/log/pki-ca/catalina.out:SEVERE: Error initializing socket factory<br>>
/var/log/pki-ca/catalina.out:java.lang.ClassNotFoundException: Error<br>> loading SSL Implementation<br>> org.apache.tomcat.util.net.jss.JSSImplementation<br>> :java.lang.ClassNotFoundException: org.mozilla.jss.ssl.SSLSocket<br>> /var/log/pki-ca/catalina.out:LifecycleException: Protocol handler<br>> initialization failed: java.lang.ClassNotFoundException: Error loading<br>> SSL Implementation org.apache.tomcat.util.net.jss.JSSImplementation<br>> :java.lang.ClassNotFoundException: org.mozilla.jss.ssl.SSLSocket<br><br>Hmm. Is there any additional information in the debug log? Any AVCs in <br>/var/log/audit/audit.log?<br><br>Have you updated any packages recently? I'm not sure why dogtag would be <br>throwing this exception.<br><br>rob<br><br>><br>> ------------------------------------------------------------------------<br>> *From:* Rob Crittenden <<a ymailto="mailto:rcritten@redhat.com"
href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>><br>> *To:* george he <<a ymailto="mailto:george_he7@yahoo.com" href="mailto:george_he7@yahoo.com">george_he7@yahoo.com</a>><br>> *Cc:* John Dennis <<a ymailto="mailto:jdennis@redhat.com" href="mailto:jdennis@redhat.com">jdennis@redhat.com</a>>; "<a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>"<br>> <<a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><br>> *Sent:* Tuesday, September 4, 2012 9:49 PM<br>> *Subject:* Re: [Freeipa-users] ipa host-del<br>><br>> george he wrote:<br>> > both of the commands "service dirsrv restart" and "service pki-cad<br>> > restart" reported:<br>>
> stopping ... OK<br>> > starting ... OK<br>> > but host-del still has the same error.<br>> > More suggestions?<br>><br>> Check the logs again. The service starting does not mean it kept<br>> running.<br>><br>> rob<br>><br>> > Thanks,<br>> > George<br>> ><br>> ><br>> ------------------------------------------------------------------------<br>> > *From:* Rob Crittenden <<a ymailto="mailto:rcritten@redhat.com" href="mailto:rcritten@redhat.com">rcritten@redhat.com</a><br>> <mailto:<a ymailto="mailto:rcritten@redhat.com" href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>><br>> >
*To:* george he <<a ymailto="mailto:george_he7@yahoo.com" href="mailto:george_he7@yahoo.com">george_he7@yahoo.com</a><br>> <mailto:<a ymailto="mailto:george_he7@yahoo.com" href="mailto:george_he7@yahoo.com">george_he7@yahoo.com</a>>><br>> > *Cc:* John Dennis <<a ymailto="mailto:jdennis@redhat.com" href="mailto:jdennis@redhat.com">jdennis@redhat.com</a><br>> <mailto:<a ymailto="mailto:jdennis@redhat.com" href="mailto:jdennis@redhat.com">jdennis@redhat.com</a>>>; "<a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>> <mailto:<a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>>"<br>> > <<a ymailto="mailto:freeipa-users@redhat.com"
href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> <mailto:<a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>>><br>> > *Sent:* Tuesday, September 4, 2012 4:20 PM<br>> > *Subject:* Re: [Freeipa-users] ipa host-del<br>> ><br>> > george he wrote:<br>> > > I'm running centos 6.3<br>> > > # uname -r<br>> > > 2.6.32-279.5.2.el6.x86_64<br>> > ><br>> > > pki-ca: unrecognized service<br>> > ><br>> > >
There are tons of errors in /var/log/pki-ca/*, some of<br>> them are:<br>> > > /var/log/pki-ca/system:11605.main - [30/Aug/2012:16:34:56 EDT]<br>> > [3] [3]<br>> > > Cannot build CA chain. Error<br>> java.security.cert.CertificateException:<br>> > > Certificate is not a PKCS #11 certificate<br>> > > /var/log/pki-ca/system:11605.main - [30/Aug/2012:16:34:56 EDT]<br>> > [13] [3]<br>> > > authz instance DirAclAuthz initialization failed and skipped,<br>> > > error=Property internaldb.ldapconn.port missing value<br>> >
> /var/log/pki-ca/system:11605.http-9445-1 -<br>> [30/Aug/2012:16:35:01 EDT]<br>> > > [3] [3] Cannot build CA chain. Error<br>> > > java.security.cert.CertificateException: Certificate is not a<br>> > PKCS #11<br>> > > certificate<br>> > > /var/log/pki-ca/system:11605.http-9445-1 -<br>> [30/Aug/2012:16:35:10 EDT]<br>> > > [3] [3] CASigningUnit: Object certificate not found. Error<br>> > > org.mozilla.jss.crypto.ObjectNotFoundException<br>> > > /var/log/pki-ca/system:3281.main - [31/Aug/2012:17:54:28<br>> EDT]
[8]<br>> > [3] In<br>> > > Ldap (bound) connection pool to host<br>> cushing.psych.yale.edu port<br>> > 7389,<br>> > > Cannot connect to LDAP server. Error:<br>> netscape.ldap.LDAPException:<br>> > > failed to connect to server<br>> ldap://cushing.psych.yale.edu:7389 (91)<br>> > ><br>> > > /var/log/pki-ca/catalina.2012-09-03.log:SEVERE: Error<br>> initializing<br>> > > socket factory<br>> > ><br>> ><br>>
/var/log/pki-ca/catalina.2012-09-03.log:java.lang.ClassNotFoundException:<br>> > Error<br>> > > loading SSL Implementation<br>> > > org.apache.tomcat.util.net.jss.JSSImplementation<br>> > > :java.lang.ClassNotFoundException:<br>> org.mozilla.jss.ssl.SSLSocket<br>> > ><br>> /var/log/pki-ca/catalina.2012-09-03.log:LifecycleException: Protocol<br>> > > handler initialization failed:<br>> java.lang.ClassNotFoundException:<br>> > Error<br>> > > loading SSL Implementation<br>> > >
org.apache.tomcat.util.net.jss.JSSImplementation<br>> > > :java.lang.ClassNotFoundException:<br>> org.mozilla.jss.ssl.SSLSocket<br>> > > /var/log/pki-ca/catalina.2012-09-03.log:SEVERE: Error<br>> deploying web<br>> > > application directory ca<br>> ><br>> > The problem looks to be that the dogtag 389-ds instance is not<br>> started.<br>> > I'd try: service dirsrv restart PKI-IPA<br>> ><br>> > Then service pki-cad restart<br>> ><br>> > rob<br>> ><br>> ><br>>
><br>> ><br>><br>><br>><br><br><br><br> </div> </div> </blockquote></div> </div></body></html>