CAcert System Admins discussion list

[Wytze van der Raay <wytze AT cacert.org>]

On 01.09.2011 10:56, Wytze van der Raay wrote:
> Following up on the system upgrade of the webdb server to Debian Lenny
> at the end of December 2010, the CAcert chroot application environment
> has now also been upgraded to match the current Debian Lenny release.
> This upgrade has been performed using the mkchrootenv script found in:
>   https://svn.cacert.org/CAcert/SystemAdministration/webdb/mkchrootenv
> 
> A full log of the upgrade has been preserved in
>   /var/log/CHROOT-UPGRADE-20110901.log
> 
> During the upgrade, the regular web service has been interrupted for
> 4 minutes (10:18 - 10:22 CEST).

Unfortunately, following up on this upgrade I notice only around 22:15 in
the evening that signing requests were no longer processed after the
upgrade (it would have been nice if someone had reported it earlier ...).

This was caused by the fact that we have changed the uid/gid under which
the webserver is running. In the old setup this was the rather weird
setting 'identd/Debian-exim' (due to confusion of uid/gid's between
the regular environment and the chroot environment). In the new setup
the webserver is running under the (Debian) default of www-data/www-data.
But I forgot to change the ownership of the subdirectories in which the
webserver needs to store CSR's submitted by CAcert users for signing.
Hence the storing of the CSR in the location required to sign it failed,
and no signing was performed for those CSR's.

This situation lasted from 10:22 CEST until about 22:30 CEST. At 22:30
the ownership on the directories mentioned above (and any other files
owned by 'identd/Debian-exim') had been changed to the correct value.
During this period approximately 140 signing requests have been rejected.
The number of affected users is much smaller, since many of them tried
to subit the same CSR several times (a reasonable thing to do when you
get an unexpected error). As of September 1, 22:30 CEST, the full system
has been restored to correct operation.

I apologize for the reduced service during the first 12 hours after the
upgrade; a significant amount of time and care has been invested in
preparing this long overdue upgrade, but this point was missed.

Regards,
-- wytze

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature