NetWorker: os comandos authc falham com "unable to find valid certification path"

• O servidor do NetWorker é implementado em um sistema independente (não clusterado).
• Comandos de autenticação do NetWorker (authc_config, authc_mgmt) falha com o seguinte erro relatado:

[root@networker-mc bin]# authc_mgmt -u administrator -e find-all-users
Enter password: 
ERROR [main] (DefaultLogger.java:190) - Error executing command. Failure: I/O error on POST request for https://localhost:9090/auth-server/api/v1/sec/authenticate [localhost]: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

• Esse problema acontece independentemente de usar a autenticação local do NetWorker ou a autenticação externa (LDAP).

Há uma disparidade na assinatura dos certificados emcauthctomcat. O emcauthctomcat é configurado por padrão durante a implementação do NetWorker. Esse certificado existe em três locais:

Linux:

• /nsr/authc/conf/authc.keystore
• /opt/nsr/authc-server/conf/authc.truststore
• /opt/nre/java/latest/lib/security/cacerts

Windows:

• C:\Arquivos de Programas\EMC NetWorker\nsr\authc-server\tomcat\conf\authc.keystore
• C:\Arquivos de Programas\EMC NetWorker\nsr\authc-server\conf\authc.truststore
• C:\Program Files\NRE\java\jre#.#.#_##\lib\security\cacerts

[root@networker-mc bin]# ./keytool -list -keystore /opt/nre/java/latest/lib/security/cacerts -storepass changeit | grep -A1 emcauth 
emcauthctomcat, Oct 7, 2022, trustedCertEntry, 
Certificate fingerprint (SHA-256): 3B:18:1E:DF:39:ED:5B:4B:CF:9F:92:22:E8:D9:96:54:E0:21:A4:EB:06:D6:36:32:03:76:5E:CC:BA:B1:15:6B

[root@networker-mc bin]# ./keytool -list -keystore /opt/nsr/authc-server/conf/authc.truststore  | grep -A1 emcauthctom 
Enter keystore password:  
emcauthctomcat, Oct 7, 2022, trustedCertEntry, 
Certificate fingerprint (SHA-256): 3B:18:1E:DF:39:ED:5B:4B:CF:9F:92:22:E8:D9:96:54:E0:21:A4:EB:06:D6:36:32:03:76:5E:CC:BA:B1:15:6B

[root@networker-mc bin]# ./keytool -list -keystore /nsr/authc/conf/authc.keystore | grep -A1 emcauthctomcat
Enter keystore password: 
emcauthctomcat, Jun 29, 2022, PrivateKeyEntry, 
Certificate fingerprint (SHA-256): 93:97:0D:ED:DF:B1:73:62:D0:E1:95:C9:EB:67:3E:EE:4D:2E:55:9F:D7:9D:5E:FD:CE:81:E3:88:23:8E:0C:C9

Corrija a disparidade do certificado.

1. Crie uma cópia dos arquivos existentes do keystore:
   Linux:

   • /nsr/authc/conf/authc.keystore
   • /opt/nsr/authc-server/conf/authc.truststore
   • /opt/nre/java/latest/lib/security/cacerts

   Windows:

   • C:\Arquivos de Programas\EMC NetWorker\nsr\authc-server\tomcat\conf\authc.keystore
   • C:\Arquivos de Programas\EMC NetWorker\nsr\authc-server\conf\authc.truststore
   • C:\Program Files\NRE\java\jre#.#.#_##\lib\security\cacerts

    

   Nota: O arquivo cacerts é encontrado na instância configurada do JRE do authc. Os caminhos mostrados acima são quando o NetWorker Runtime Environment (NRE) é instalado. Se o Oracle Java JRE estiver instalado, o arquivo cacerts está no caminho de instalação do Java em .. \lib\security\cacerts.

2. No servidor do NetWorker, abra um prompt de comando admin ou root.

3. Interrompa os serviços de servidor do NetWorker:
   Linux: nsr_shutdown
   Windows: net stop nsrd

4. Altere o diretório para o diretório do JRE \bin.

5. Usando a seguinte sintaxe de comando, exclua os certificados emcauthctomcat dos locais do keystore em que a disparidade é observada.

   Linux:
   ./keytool -delete -alias emcauthctomcat -keystore /path/to/keystore -storepass password

   Windows:
   keytool -delete -alias emcauthctomcat -keystore "C:\path\to\keystore" -storepass password

   Nota: A senha do keystore Java, independentemente de NRE ou Oracle jre, é changeit. O keystore do authc é a senha definida pelo usuário do keystore definida ao usar o assistente de instalação do NetWorker (Windows) ou o script /opt/nsr/authc-server/scripts/authc_configure.sh (Linux).

Exemplo:

[root@networker-mc bin]# ./keytool -delete -alias emcauthctomcat -keystore /opt/nre/java/latest/lib/security/cacerts -storepass changeit  

[root@networker-mc bin]# ./keytool -delete -alias emcauthctomcat -keystore /opt/nsr/authc-server/conf/authc.truststore
Enter keystore password:  
[root@networker-mc bin]#

6. O certificado emcauthctomcat padrão deve existir no seguinte local:
   Linux: /nsr/authc/conf/emcauthctomcat.cer
   Windows: C:\Arquivos de Programas\EMC NetWorker\nsr\authc-server\tomcat\conf\emcauthctomcat.cer

7. Importe o certificado emcauthctomcat padrão para os locais do keystore:
   Linux:
   ./keytool -import -alias emcauthctomcat -keystore /path/to/keystore -storepass password -file /nsr/authc/conf/emcauthctomcat.cer

   Windows:
   keytool -import -alias emcauthctomcat -keystore "C:\path\to\keystore" -storepass password -file "C:\Program Files\EMC NetWorker\nsr\authc-server\tomcat\conf\emcauthctomcat.cer"

Exemplo:

[root@networker-mc bin]# ./keytool -import -alias emcauthctomcat -keystore /opt/nsr/authc-server/conf/authc.truststore  -file /nsr/authc/conf/emcauthctomcat.cer
Enter keystore password:  
Owner: CN=networker-mc.emclab.local, OU=NetWorker, O=DELL, L=Round Rock, ST=TX, C=US
Issuer: CN=networker-mc.emclab.local, OU=NetWorker, O=DELL, L=Round Rock, ST=TX, C=US
Serial number: bd1993a1
Valid from: Wed Jun 29 12:16:53 EDT 2022 until: Sun Jun 23 12:16:53 EDT 2047
Certificate fingerprints:
         SHA1: E8:7B:C8:DF:4D:24:57:C4:63:34:1F:E8:6D:AA:1F:84:79:61:92:26
         SHA256: 93:97:0D:ED:DF:B1:73:62:D0:E1:95:C9:EB:67:3E:EE:4D:2E:55:9F:D7:9D:5E:FD:CE:81:E3:88:23:8E:0C:C9
Signature algorithm name: SHA512withRSA
Subject Public Key Algorithm: 3072-bit RSA key
Version: 3

Extensions: 

#1: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: localhost
  IPAddress: 127.0.0.1
  DNSName: networker-mc.emclab.local
]

Trust this certificate? [no]:  y
Certificate was added to keystore
[root@networker-mc bin]# ./keytool -import -alias emcauthctomcat -keystore /opt/nre/java/latest/lib/security/cacerts -file /nsr/authc/conf/emcauthctomcat.cer   
Enter keystore password:  
Certificate already exists in keystore under alias <emcnwuiserv>
Do you still want to add it? [no]:  y
Certificate was added to keystore

8. Use a tecla de keytool -list para confirmar se as assinaturas emcauthctomcat correspondem a cada um dos armazenamentos de chaves:
   Linux: ./keytool -list -keystore /path/to/keystore -storepass password | grep -A1 emcauth
   Windows: keytool -list -keystore "C:\path\to\keystore" -storepass password

9. Inicie os serviços do NetWorker:
   Linux: systemctl start networker
   Windows: net start nsrd

10. Tente usar um authc_config ou authc_mgmt Comando:
    authc_config -u Administrator -e find-all-users

Exemplo:

[root@networker-mc bin]# authc_mgmt -u administrator -e find-all-users
Enter password: 
The query returns 2 records.
User Id User Name           
1000    administrator       
1001    svc_nmc_networker-mc