From: "Goswin von Brederlow" <brederlo@q-leap.de>
To: "QLUSTAR General" <qlustar-general@qlustar.org>
Sent: Wednesday, 13 November, 2019 13:42:41
Subject: [Qlustar-General] Re: First time authentication

Hello,

Alain EMPAIN wrote:
> Hello,
>
> I installed the new qlustar version 11.0.2 and tried to start qluman-qt : I cannot pass
> the first admin authentication step.
>
> 2019-11-13 11:35:17,207 DEBUG client.qt.ClusterWindow
> ClusterWindow.on_qlumand_online(True)
> 2019-11-13 11:35:17,208 DEBUG client.qt.ClusterWindow ClusterWindow.authenticate():
> checking authentication
> 2019-11-13 11:35:17,208 DEBUG client.qt.ClusterWindow one time token
> 2019-11-13 11:35:17,208 DEBUG client.qt.MainWindow
> ServerWidget[b'Qlumand'].online_changed(True)
> 2019-11-13 11:35:17,213 DEBUG client.qt.ClusterWindow msg = error {
> text: "Authentication failed"
> }
>
> 2019-11-13 11:35:55,552 DEBUG client.qt.ClusterWindow one time token failed
> 2019-11-13 11:35:55,552 DEBUG client.qt.ClusterWindow ClusterWindow.closeEvent()
> 2019-11-13 11:35:55,576 DEBUG client.qt.ClusterWindow
> ClusterWindow.count_messages(force=True)
> 2019-11-13 11:35:55,576 DEBUG client.qt.ClusterWindow
> ClusterWindow._count_messages(force=True)
> 2019-11-13 11:35:55,576 DEBUG client.qt.ClusterWindow check_components(): components = []
>
> 2019-11-13 11:35:55,576 DEBUG client.qt.MainWindow
> ServersWidget.cluster_activated(<client.qt.ClusterWindow.ClusterWindow object at
> 0x7fcdf8e4bfc8>)
> 2019-11-13 11:35:55,577 DEBUG client.qt.MainWindow no change
> 2019-11-13 11:35:55,582 DEBUG client.qt.ClusterWindow ClusterWindow.closeEvent(): all
> closed
> 2019-11-13 11:35:56,585 DEBUG client.qt.ClusterWindow ClusterWindow.closeEvent(): done
>
> I found the token files created at '/usr/lib/python3/dist-packages/qluman-11'.
> I erased them, to restart from a fresh state, but it does not help, I circle around the
> problem .
>
> When I installed the 10.x version, it worked immediately, but perhaps by chance ;-)
>
> Is it possible to reverse the 'first try procedure' to a sane state ? I suppose
> that my various attemps left some scories to be removed for a correct procedure.

I'm not sure what you think you found in /usr/lib/python3/dist-packages/qluman-11 but anything you deleted there probably destroyed something. It's best if you reinstall the qluman packages to restore the missing files using:

    apt install --reinstall qluman-server qluman-common qluman-common-11 qluman-bin qluman-dhcpscanner qluman-execd qluman-router

In case of slurm also include qluman-slurmd.

Note that this will not overwrite any of your configuration or reset any state. It simply restores the files that should be there from the packages.


The qluman-qt client and qlumand use a public/private key method for authentication. This is set up the first time the qluman-qt client connects. The public/private keypair is generated on the qluman-qt client and only the public key is send to the qlumand so that even if qlumand is compromised the private key of each client remains safe.

For the first time login the client is given a one-time-token that can only be used exactly once and only for a limited time (48 hours). The token is part of the certificate generated by "qluman-cli --gencert". So if you waited to long between creating the certificate and using it or if something went wrong the first time you used it the one-time-token will have been invalidated and no longer function. So retrying again on the client is futile.

Now to make a long story short: You have to generate a new certificate on the server by running

    qluman-cli --gencert

This will completly reset the authentication for the admin account on the server. In Qluman-qt, to start completly fresh, select "edit" on the connection dialog, delete the cluster and then add the new certificate. This can be done any time and as often as necessary provided you use a new certificate every time.

> By the way, I copied the new 11.0.3 iso version on a USB key drive, with the classical
> command 'dd if=the.ISO of=/dev/sdb bs=...' but the server BIOS do not detect it as
> a bootable device. (I do this kind of operation routinely, nromally without any problem)
>
> Thanks for any advice,
>
> Alain

The 3 most likely causes for this are:

1) Legacy BIOS support is not enable in UEFI
2) the USB stick has data corruption
3) the download has data corruption

You wrote "the server BIOS" so I assume you have taken care of cause 1 already.

Cause 3 is faster to check so run "sha256sum qlustar-installer-11.0.0-3.iso" and make sure the checksum is 68b494fae0d3258c85bcdfd2a385632c8030382b76ebfda2d48f9b05f23fedb1 as listed on the webpage.

To check the USB stick read the image back and check the checksum:

    dd if=/dev/sdb bs=1k count=583222 | sha256sum

I hope that fixes the problem,
Goswin von Brederlow
_______________________________________________
Qlustar-General mailing list -- qlustar-general@qlustar.org
To unsubscribe send an email to qlustar-general-leave@qlustar.org