oes2018Sp1: after latest updates I lose nss functionality

[ChasR]

We are running 2 servers with Oes2018 version 2018.1 Sp1, and after the latest online updates, I lose the nss volumes together with nssmu failing to work. The nss partitions are still there, but something is broken. I probably have missed something in the documentation regarding this issue, but would be grateful of any pointers to resolve this problem.

Regards

ChasR.

[mathiasbraun]

As i don't see any issues reg. NSS volumes running current code:

Did by chance your certificates expire? If this has happened you'd likely have problems (at least on the first boot) which people tend to misinterprete as caused by the update (i.e. updated code) while they're just triggered by the reboot in course of the update.

[MarkDissington]

I had exactly that after doing an OES upgrade for a customer, server had been up for a long time and was running fine, certs had expired. After reboot, eDirectory wouldn't start and that stopped NSS volumes from mounting.

Mark.

[ChasR]

Hi,

No joy regarding certificates, all after 2025, so none out of date. When I run nssmu, I get the following:

Either admin volume not found or you don't have the rights to it. Everything works fine until the upgrade.

Both servers are vm's and I have a test host machine to try things out on so nothing gets mangled before I find the solution.

Anyone got any other ideas please?

ChasR.

[MarkDissington]

Is the Internal Certificate Authority still in date as well? IIRC, they default to 10 years so depending upon server migrations over time you may be pointing to an old out of date CA.

Mark

[ChasR]

Hi, no problems there it is dated 2028.

Thanks for the reply

ChasR.

[mathiasbraun · Accepted solution]

Assuming the nds daemon is really running fine:

check /var/log/messages for the keyword "startnss.bsh", this will likely provide info 'bout where stuff starts failing. Doublecheck that there's no antivirus dillidally running, we've seen instances where it locked contents of _admin which will cause issues like those you encounter.

You might also review the content of /etc/opt/novell/nss/nssstart.cfg. While chances are low that it's been corrupted on two boxes at the same time its processing is very picky about typos.

What do you see on

mount |grep nssadmin

[ChasR]

Thanks for your help. I checked the certificate of authority, and they were OK, but I did not check the server certificates, which were out of date. Once I then created default server certificates (overwriting the old ones) I got things working again.

Once again, thanks for your assistance,

ChasR.