Red Hat Summit Red Hat SummitSupportoConsoleSviluppatoriInizia una provaContatti

Questo contenuto non è disponibile nella lingua selezionata.

13.9. Running Self-Tests

The Certificate System has the added functionality to allow self-tests of the server. The self-tests are run at start up and can also be run on demand. The startup self-tests run when the server starts and keep the server from starting if a critical self-test fails. The on-demand self-tests are run by clicking the self-tests button in the subsystem console.

13.9.1. Running Self-Tests
Copia collegamento

The on-demand self-test for the CA, OCSP, KRA, or TKS subsystems are run from the console. The on-demand self-tests for the TPS system are run from the web services page.

13.9.1.1. Running Self-Tests from the Console
Copia collegamento

  1. Log into the Console. 
    pkiconsole https://server.example.com:admin_port/subsystem_type
    Copy to Clipboard Toggle word wrap
  2. Select the subsystem name at the top of the left pane.
    View larger image
  3. Select the Self Tests tab.
  4. Click Run.
    The self-tests that are configured for the subsystem will run. If any critical self-tests fail, the server will stop.
  5. The On-Demand Self Tests Results window appears, showing the logged events for this run of the self-tests.

13.9.1.2. Running TPS Self-Tests
Copia collegamento

To run TPS self-tests from the command-line interface (CLI):
  • pki tps-selftest-find
  • pki tps-selftest-run
  • pki tps-selftest-show

13.9.2. Self-Test Logging
Copia collegamento

A separate log, selftest.log, is added to the log directory that contains reports for both the start up self-tests and the on-demand self-tests. This log is configured by changing the setting for the log in the CS.cfg file. For more information, see Modifying Self-Test Configuration.

13.9.3. Configuring POSIX System ACLs
Copia collegamento

POSIX system access control rules provide finer granularity over system user permissions. These ACLs must be set for each instance after it is fully configured. For more details on ACLs, see Configuring ACLs.

13.9.3.1. Setting POSIX System ACLs for the CA, KRA, OCSP, TKS, and TPS
Copia collegamento

Modern file systems like ext4 and XFS enable ACLs by default, and are most likely used on modern Red Hat Enterprise Linux installations.
  1. Stop the instance. 
    systemctl stop pki-tomcatd@instance_name.service
    Copy to Clipboard Toggle word wrap
  2. Set the group readability to the pkiadmin group for the instance's directories and files. 
    # setfacl -R -L -m g:pkiadmin:r,d:g:pkiadmin:r /var/lib/pki/instance_name
    Copy to Clipboard Toggle word wrap
  3. Apply execute (x) ACL permissions on all directories: 
    # find -L /var/lib/pki/instance_name -type d -exec setfacl -L -n -m g:pkiadmin:rx,d:g:pkiadmin:rx {} \;
    Copy to Clipboard Toggle word wrap
  4. Remove group readability for the pkiadmin group from the instance's signedAudit/ directory and its associated files: 
    # setfacl -R -L -x g:pkiadmin,d:g:pkiadmin /var/lib/pki/instance_name/logs/signedAudit
    Copy to Clipboard Toggle word wrap
  5. Set group readability for the pkiaudit group for the instance's signedAudit/ directory and its associated files: 
    # setfacl -R -L -m g:pkiaudit:r,d:g:pkiaudit:r /var/lib/pki/instance_name/logs/signedAudit
    Copy to Clipboard Toggle word wrap
  6. Re-apply execute (x) ACL permissions on the signedAudit/ directory and all of its subdirectories: 
    # find -L /var/lib/pki/instance_name/logs/signedAudit -type d -exec setfacl -L -n -m g:pkiaudit:rx,d:g:pkiaudit:rx {} \;
    Copy to Clipboard Toggle word wrap
  7. Start the instance. 
    systemctl start pki-tomcatd@instance_name.service
    Copy to Clipboard Toggle word wrap
  8. Confirm that the file access controls were properly applied by using the getfacl command to show the current ACL settings: 
    # getfacl /var/lib/pki/instance_name /var/lib/pki/instance_name/subsystem_type/logs/signedAudit/
getfacl: Removing leading '/' from absolute path names
# file: var/lib/pki/instance_name
# owner: pkiuser
# group: pkiuser
user::rwx
group::rwx
group:pkiadmin:r-x
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:pkiadmin:r-x
default:mask::rwx
default:other::r-x

# file: var/lib/pki/instance_name/logs/signedAudit
# owner: pkiuser
# group: pkiaudit
user::rwx
group::rwx
group:pkiaudit:r-x
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:group:pkiaudit:r-x
default:mask::rwx
default:other::---
    Copy to Clipboard Toggle word wrap
Torna in cima
Red Hat logoGithubredditYoutubeTwitter

Formazione

Prova, acquista e vendi

Community

Informazioni sulla documentazione di Red Hat

Aiutiamo gli utenti Red Hat a innovarsi e raggiungere i propri obiettivi con i nostri prodotti e servizi grazie a contenuti di cui possono fidarsi. Esplora i nostri ultimi aggiornamenti.

Rendiamo l’open source più inclusivo

Red Hat si impegna a sostituire il linguaggio problematico nel codice, nella documentazione e nelle proprietà web. Per maggiori dettagli, visita il Blog di Red Hat.

Informazioni su Red Hat

Forniamo soluzioni consolidate che rendono più semplice per le aziende lavorare su piattaforme e ambienti diversi, dal datacenter centrale all'edge della rete.

Theme

© 2025 Red Hat