Dotaz: skript spuštěný cronem - problém

[Petr Veselý]

Ahoj, nevíte, kde může být problém, když mi nějaký příkaz neproběhne, když je spuštěný rootovo cronem, ale když ho spustím ručně, je vše ok? Nevím, kde (v jakém logu) hledat chybu, tak se ptám takhle obecně.

---

---

Odpovědi

[Peter Golis]

Log z cron-u sa obvykle zasiela poštou.

[Petr Veselý]

Našel jsem log, když je spuštěno cronem a neproběhne to:

2016-05-02 08:40:03,982:DEBUG:letsencrypt.main:Root logging level set at 30
2016-05-02 08:40:03,983:INFO:letsencrypt.main:Saving debug log to /var/log/letsencrypt/letsencrypt.log
2016-05-02 08:40:03,985:DEBUG:letsencrypt.main:letsencrypt version: 0.5.0
2016-05-02 08:40:03,985:DEBUG:letsencrypt.main:Arguments: ['--apache', '--renew-by-default', '--tls-sni-01-port', '8443', '--domains', 'example.net, www.example.net']
2016-05-02 08:40:03,986:DEBUG:letsencrypt.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#apache,PluginEntryPoint#webroot,PluginEntryPoint#null,PluginEntryPoint#manual,PluginEntryPoint#standalone)
2016-05-02 08:40:03,993:DEBUG:letsencrypt.plugins.selection:Requested authenticator apache and installer apache
2016-05-02 08:40:04,005:DEBUG:letsencrypt.plugins.disco:No installation (PluginEntryPoint#apache):
Traceback (most recent call last):
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt/plugins/disco.py", line 104, in prepare
    self._initialized.prepare()
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt_apache/configurator.py", line 152, in prepare
    raise errors.NoInstallationError
NoInstallationError
2016-05-02 08:40:04,006:DEBUG:letsencrypt.plugins.selection:No candidate plugin
2016-05-02 08:40:04,006:DEBUG:letsencrypt.plugins.selection:No candidate plugin
2016-05-02 08:40:04,007:DEBUG:letsencrypt.plugins.selection:Selected authenticator None and installer None
2016-05-02 08:40:04,007:INFO:letsencrypt.main:Could not choose appropriate plugin: The apache plugin is not working; there may be problems with your existing configuration.
The error was: NoInstallationError()
2016-05-02 08:40:04,009:DEBUG:letsencrypt.main:Exiting abnormally:
Traceback (most recent call last):
  File "/root/.local/share/letsencrypt/bin/letsencrypt", line 11, in <module>
    sys.exit(main())
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt/main.py", line 692, in main
    return config.func(config, plugins)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt/main.py", line 500, in obtain_cert
    installer, auth = plug_sel.choose_configurator_plugins(config, plugins, "certonly")
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt/plugins/selection.py", line 196, in choose_configurator_plugins
    diagnose_configurator_problem("authenticator", req_auth, plugins)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt/plugins/selection.py", line 273, in diagnose_configurator_problem
    raise errors.PluginSelectionError(msg)
PluginSelectionError: The apache plugin is not working; there may be problems with your existing configuration.
The error was: NoInstallationError()

Naopak, když to pustím ručně, je to ok:

2016-05-02 10:15:20,061:DEBUG:letsencrypt.main:Root logging level set at 30
2016-05-02 10:15:20,064:INFO:letsencrypt.main:Saving debug log to /var/log/letsencrypt/letsencrypt.log
2016-05-02 10:15:20,066:DEBUG:letsencrypt.main:letsencrypt version: 0.5.0
2016-05-02 10:15:20,067:DEBUG:letsencrypt.main:Arguments: ['--apache', '--renew-by-default', '--tls-sni-01-port', '8443', '--domains', 'example.net, ww
w.example.net']
2016-05-02 10:15:20,069:DEBUG:letsencrypt.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#apache,PluginEntryPoint#webroot,PluginEntryPoint#null,Plu
ginEntryPoint#manual,PluginEntryPoint#standalone)
2016-05-02 10:15:20,077:DEBUG:letsencrypt.plugins.selection:Requested authenticator apache and installer apache
2016-05-02 10:15:21,993:DEBUG:letsencrypt.plugins.selection:Single candidate plugin: * apache
Description: Apache Web Server - Alpha
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: apache = letsencrypt_apache.configurator:ApacheConfigurator
Initialized: <letsencrypt_apache.configurator.ApacheConfigurator object at 0xb64674ac>
Prep: True
2016-05-02 10:15:21,996:DEBUG:letsencrypt.plugins.selection:Single candidate plugin: * apache
Description: Apache Web Server - Alpha
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: apache = letsencrypt_apache.configurator:ApacheConfigurator
Initialized: <letsencrypt_apache.configurator.ApacheConfigurator object at 0xb64674ac>
Prep: True
2016-05-02 10:15:21,996:DEBUG:letsencrypt.plugins.selection:Selected authenticator <letsencrypt_apache.configurator.ApacheConfigurator object at 0xb64674ac
and installer letsencrypt_apache.configurator.ApacheConfigurator object at 0xb64674ac
2016-05-02 10:15:22,267:DEBUG:letsencrypt.main:Picked account: Account(29afbb987f3159b11ee13faaafc47cc9)
2016-05-02 10:15:22,270:DEBUG:root:Sending GET request to https://acme-v01.api.letsencrypt.org/directory. args: (), kwargs: {}
2016-05-02 10:15:22,278:INFO:requests.packages.urllib3.connectionpool:Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
2016-05-02 10:15:22,674:DEBUG:requests.packages.urllib3.connectionpool:"GET /directory HTTP/1.1" 200 263
2016-05-02 10:15:22,681:DEBUG:root:Received Response [200]>. Headers: {'Content-Length': '263', 'Expires': 'Mon, 02 May 2016 10:15:22 GMT', 'Strict-Transpor
t-Security': 'max-age=604800', 'Server': 'nginx', 'Connection': 'keep-alive', 'Pragma': 'no-cache', 'Cache-Control': 'max-age=0, no-cache, no-store', 'Date':
 'Mon, 02 May 2016 10:15:22 GMT', 'X-Frame-Options': 'DENY', 'Content-Type': 'application/json', 'Replay-Nonce': 'Unr1YJ1qx3dn_fqXWMO-9ViPa6oLgtRTK45XqxYsvyQ
'}. Content: '{"new-authz":"https://acme-v01.api.letsencrypt.org/acme/new-authz","new-cert":"https://acme-v01.api.letsencrypt.org/acme/new-cert","new-reg":"h
ttps://acme-v01.api.letsencrypt.org/acme/new-reg","revoke-cert":"https://acme-v01.api.letsencrypt.org/acme/revoke-cert"}'
2016-05-02 10:15:22,682:DEBUG:acme.client:Received response Response [200] (headers: {'Content-Length': '263', 'Expires': 'Mon, 02 May 2016 10:15:22 GMT',
'Strict-Transport-Security': 'max-age=604800', 'Server': 'nginx', 'Connection': 'keep-alive', 'Pragma': 'no-cache', 'Cache-Control': 'max-age=0, no-cache, no
-store', 'Date': 'Mon, 02 May 2016 10:15:22 GMT', 'X-Frame-Options': 'DENY', 'Content-Type': 'application/json', 'Replay-Nonce': 'Unr1YJ1qx3dn_fqXWMO-9ViPa6o
LgtRTK45XqxYsvyQ'}): '{"new-authz":"https://acme-v01.api.letsencrypt.org/acme/new-authz","new-cert":"https://acme-v01.api.letsencrypt.org/acme/new-cert","new
-reg":"https://acme-v01.api.letsencrypt.org/acme/new-reg","revoke-cert":"https://acme-v01.api.letsencrypt.org/acme/revoke-cert"}'
2016-05-02 10:15:22,730:INFO:letsencrypt.renewal:Auto-renewal forced with --force-renewal...
2016-05-02 10:15:22,732:DEBUG:root:Requesting fresh nonce
2016-05-02 10:15:22,732:DEBUG:root:Sending HEAD request to https://acme-v01.api.letsencrypt.org/acme/new-authz. args: (), kwargs: {}
2016-05-02 10:15:22,736:INFO:requests.packages.urllib3.connectionpool:Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
2016-05-02 10:15:23,067:DEBUG:requests.packages.urllib3.connectionpool:"HEAD /acme/new-authz HTTP/1.1" 405 0
2016-05-02 10:15:23,073:DEBUG:root:Received Response [405]>. Headers: {'Content-Length': '78', 'Pragma': 'no-cache', 'Expires': 'Mon, 02 May 2016 10:15:23 G
MT', 'Server': 'nginx', 'Connection': 'keep-alive', 'Allow': 'POST', 'Cache-Control': 'max-age=0, no-cache, no-store', 'Date': 'Mon, 02 May 2016 10:15:23 GMT
', 'Content-Type': 'application/problem+json', 'Replay-Nonce': 'Eua1Dq9flYnENAY3KENmtWi_zcZNxx8259HLLTNXl5w'}. Content: ''
2016-05-02 10:15:23,075:DEBUG:acme.client:Storing nonce: '\x12\xe6\xb5\x0e\xaf_\x95\x89\xc44\x067(Cf\xb5h\xbf\xcd\xc6M\xc7\x1f6\xe7\xd1\xcb-3W\x97\x9c'

atd...

[1john2]

jsou spravne nastavene systemove cesty pri startu z cronu?

Bezi skript pod stejnym uzivatelem?

jak startujete z cronu a jak "rucne"?

Prvni odkaz z google, mozna pomuze:

https://github.com/letsencrypt/letsencrypt/issues/1833

[Petr Veselý]

jsou spravne nastavene systemove cesty pri startu z cronu? Řekl bych, že to bude ten problém. Vše jede pod rootem

20 02 * * 1 /usr/local/sbin/le-renew example.net >> /var/log/letsencrypt/le-renew-example.net.log

# cat /usr/local/sbin/le-renew
#!/bin/bash
#================================================================
# Let's Encrypt renewal script for Apache on Ubuntu/Debian
# @author Erika Heidi
# Usage: ./le-renew.sh [base-domain-name]
# More info: http://do.co/1mbVihI
#================================================================
domain=$1
le_path='/opt/letsencrypt'
le_conf='/etc/letsencrypt'
exp_limit=30;

get_domain_list(){
        certdomain=$1
        config_file="$le_conf/renewal/$certdomain.conf"
        
	if [ ! -f $config_file ] ; then
                echo "[ERROR] The config file for the certificate $certdomain was not found."
                exit 1;
        fi

        domains=$(grep --only-matching --perl-regex "(?<=domains \= ).*" "${config_file}")
        last_char=$(echo "${domains}" | awk '{print substr($0,length,1)}')

        if [ "${last_char}" = "," ]; then
                domains=$(echo "${domains}" |awk '{print substr($0, 1, length-1)}')
        fi

        echo $domains;
}

if [ -z "$domain" ] ; then
        echo "[ERROR] you must provide the domain name for the certificate renewal."
        exit 1;
fi

cert_file="/etc/letsencrypt/live/$domain/fullchain.pem"

if [ ! -f $cert_file ]; then
	echo "[ERROR] certificate file not found for domain $domain."
	exit 1;
fi

exp=$(date -d "`openssl x509 -in $cert_file -text -noout|grep "Not After"|cut -c 25-`" +%s)
datenow=$(date -d "now" +%s)
days_exp=$(echo \( $exp - $datenow \) / 86400 |bc)

echo "Checking expiration date for $domain..."

if [ "$days_exp" -gt "$exp_limit" ] ; then
	echo "The certificate is up to date, no need for renewal ($days_exp days left)."
	exit 0;
else
	echo "The certificate for $domain is about to expire soon. Starting renewal request..."
	domain_list=$( get_domain_list $domain )
	"$le_path"/letsencrypt-auto certonly --apache --renew-by-default --tls-sni-01-port 8443 --domains "${domain_list}"
	echo "Restarting Apache..."
	/usr/sbin/service apache2 reload
	echo "Renewal process finished for domain $domain"
	exit 0;
fi

[k3dAR]

nejaky duvod proc nepouzijes na "more info" url uvedene:

30 2 * * 1 /opt/letsencrypt/letsencrypt-auto renew >> /var/log/le-renew.log

?

[Petr Veselý]

už si nepamatuju, proč to mám takhle.. ale potřebuju dělat každou doménu zvlášť, abych měl pro každou vlastní certifikát

[1john2]

rekl bych ze k3radar tim myslel co je v logu "/var/log/letsencrypt/le-renew-example.net.log"

[1john2]

a jeste co je v:

/var/log/letsencrypt/letsencrypt.log

[Petr Veselý]

Log je postnul nahoře

[k3dAR]

ne, myslel sem co Petr pochopil :) ten script ma v hlavicce "More info: http://do.co/1mbVihI", na te URL je postup jak to dat do cronu, coz sem postnul :)

[Petr Veselý]

:D jo takhle.. ale vždyť to tak v cronu mam...

[k3dAR]

tak ja tam nevidim zadnej skript z /usr/local jako mas ty :) ale to uz si vysvetlil ze to mas pro kazdou domenu vlast, ja to nestudoval co kterej script a proc dela, jen me napadlo zkusit variantu co uvadi autor :)

[javeline]

Prosím zajisti, aby skript volaný cronem, načetl $HOME/.profile (naplnil proměnné PATH,USER,SHELL, ...) uživatele, pod kterým cron běží.

[Fanda]

Prosím zajisti... JAK?

[mess]

source $HOME/.profile

[Fanda]

Do toho scriptu? To se nedá ošetřit přímo v crontabu?

[mess]

Co vím, tak to cron neumí. Musíš to dát do toho scriptu.