Re: [HTCondor-users] condor_ce_host_network_check says host cert ificate does not match

["Chun-Yu Lin" <1203036@xxxxxxxxxxxxxx>]

Hi Thomas, the VM has one private IPs and one public IPs.

The public one is "floated" and not shown in the system:

$ ip addr show dev eth0

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000

    link/ether fa:16:3e:64:43:63 brd ff:ff:ff:ff:ff:ff

    inet 192.168.1.2/24 brd 192.168.1.255 scope global dynamic noprefixroute eth0

       valid_lft 76267sec preferred_lft 76267sec

From that, I doubt condor identify only the private IP, as the MasterLog shows:

$ cat /var/log/condor-ce/MasterLog

03/22/23 17:35:23 DaemonCore: private command socket at <192.168.1.2:0?alias=ui.grid.NCHC.org.tw&sock=master_95700_045e>

even if I enforce "CONDOR_HOST = 140.110.26.138" in /etc/condor-ce/condor_config.

As a result, condor_ce_trace on the same node is OK, but looks like going only thru the private IPs:

$ condor_ce_trace 140.110.26.138

...

Spooling cluster 16 files to schedd <192.168.1.2:9619?addrs=192.168.1.2-9619&alias=ui.grid.NCHC.org.tw&noUDP&sock=schedd_99490_a44f>

...

while tracing from remote host is halt and show "Testing HTCondor-CE authorization..."

Is such setup of condor cluster (with also CE at head node) supported in this cloud enviorment?

Many thanks,

Chun-yu  

Quoted from  "Thomas Hartmann" <thomas.hartmann@xxxxxxx>ï

 Hi Chun-yu,

does the VM has more IPs or does it have a private IP while the public
IP is a floating one from OpenStack?
As far as I see, `condor_ce_host_network_check` does a DNS lookup and a
reverse lookup (which look both fine to me [1]) - but probably it is
taking the internal private IP for the reverse lookup, and gets confused
by another name?

Cheers,
  Thomas


[1]
> dig +short A ui.grid.nchc.org.tw
140.110.26.138
> dig +short -x  140.110.26.138
ui.grid.nchc.org.tw.


On 22/03/2023 05.17, Chun-Yu Lin wrote:
> Dear all,
>
> I try to install CE / condor custer on the virtual cluster (on our
> private OpenStack).
> The CE is the only node reachable from outside.
> Strangely, "condor_ce_host_network_check" complains the hostname doesn't
> match with the certificate.
> Yet everything looks fine.
> Below are four basic tests contradict with the errors. Anything I miss ?
>
> # condor_ce_host_network_check
> Starting analysis of host networking for HTCondor-CE
> System hostname: ui.grid.nchc.org.tw
> FQDN matches hostname
> Host certificate (subject=C = TW, O = NCHC, OU = GRID, CN =
> ui.grid.nchc.org.tw) does not match HTCondor-CE hostname ui.grid.nchc.org.tw
> Host network configuration not expected to work with HTCondor-CE.
>
> # openssl x509 -in /etc/grid-security/hostcert.pem -text | grep Subject:
>          Subject: C = TW, O = NCHC, OU = GRID, CN = ui.grid.nchc.org.tw
>
> # nslookup ui.grid.nchc.org.tw
> Name:   ui.grid.NCHC.org.tw
> Address: 140.110.26.138
>
> # nslookup 140.110.26.138
> 138.26.110.140.in-addr.arpa     name = ui.grid.nchc.org.tw.
>
> Many thanks,
> Chun-yu
>
> _______________________________________________
> HTCondor-users mailing list
> To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
> subject: Unsubscribe
> You can also unsubscribe by visiting
> https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users
>
> The archives can be found at:
> https://lists.cs.wisc.edu/archive/htcondor-users/

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/