Meshcentral: Implement GreenLock v3 support

Created on 2 Nov 2019  路  27Comments  路  Source: Ylianst/MeshCentral

Just updated to 0.43-t and something in the last update broke Lets Encrypt.
There is a issue with meshcentral working with the GreenLock module.

node node_modules/meshcentral --cert domain.com

MeshCentral HTTP redirection server running on port 80.
Error: please supply maintainerEmail as a contact for security and critical bug notices
at Object.E. [as NO_MAINTAINER] (/mount/meshcentral/node_modules/@root/greenlock/errors.js:7:19)
at Object.greenlock._create (/mount/meshcentral/node_modules/@root/greenlock/greenlock.js:30:21)
at Object.G.create (/mount/meshcentral/node_modules/@root/greenlock/greenlock.js:449:15)
at Object.module.exports.CreateLetsEncrypt (/mount/meshcentral/node_modules/meshcentral/letsencrypt.js:61:28)
at /mount/meshcentral/node_modules/meshcentral/meshcentral.js:837:38
at Object.obj.GetMeshServerCertificate (/mount/meshcentral/node_modules/meshcentral/certoperations.js:571:43)
at CreateMeshCentralServer.obj.StartEx2 (/mount/meshcentral/node_modules/meshcentral/meshcentral.js:832:35)
at Server. (/mount/meshcentral/node_modules/meshcentral/redirserver.js:122:13)
at Object.onceWrapper (events.js:299:28)
at Server.emit (events.js:210:5)
at emitListeningNT (net.js:1334:10)
at processTicksAndRejections (internal/process/task_queues.js:79:21) {
code: 'NO_MAINTAINER',
context: 'create'
}
ERROR: Unable to setup GreenLock module.
MeshCentral v0.4.3-t, WAN mode.

Fixed - Confirm & Close bug
Source
picture infineonnetworks

Most helpful comment

See Migrating from Greenlock v2 to v3.

picture MailYouLater on 7 Nov 2019
👍2

All 27 comments

It is possible that this is due to the new greenlock v3 release. See: https://www.npmjs.com/package/greenlock
The v2 to v3 migration guide: https://git.rootprojects.orggreenlock.js/src/branch/v3/MIGRATION_GUIDE_V2_V3.md

infineonnetworks picture infineonnetworks on 2 Nov 2019

As a heads up to everyone, the current version of meshcentral is dependant on greenlock v2.8.8, which should be a dependency until v3 is resolved. Greenlock v3 was just released 2 days ago, thus causing issues with upgrades.

Thus if you are running into the same issue and want to run the latest 0.4.3-t version, cleanly re-install meshcentral and before running the first time install greenlock v2.8.8. Then it will run ok.

Commands
Main install: npm install meshcentral
Greenlock: npm install [email protected]

Then you can start your meshcentral as you normally would.

infineonnetworks picture infineonnetworks on 2 Nov 2019

Published MeshCentral 0.4.3-u to request GreenLock v2.8.8. This is exactly what is going on, GreenLock v3 just came out. I will add support for it when back from travels.

Ylianst picture Ylianst on 2 Nov 2019
👍2

This temporary fix seemed to work. Thanks

infineonnetworks picture infineonnetworks on 2 Nov 2019

Perfect. It's keep this issue open until I add v3 support which is required starting December 1st.

Ylianst picture Ylianst on 2 Nov 2019

Today I updated to the latest version 4.3-u and I have the same problem I cannot start all the services because MeshCentral cannot install [email protected].
I reinstall MeshCetral and manually install [email protected] but when starting MeshCentral either as a service or through Node always try to install [email protected] and cannot do it.
"d @ vps: ~ $ node ./node_modules/meshcentral
Installing [email protected] ...
ERROR: Unable to install required module "[email protected]". MeshCentral may not have access to npm, or npm may not have suffisent rights to load the new module. Try "npm install [email protected]" to manual and install this module.

Installation on WAN mode on Ubuntu 18.04.2 LTS

dagors picture dagors on 3 Nov 2019

There are a few things you probably want to check. But first, the way I had remediated it, was to delete the entire (and only) node_modules folder and then reinstall it. It will pick up your config information from the meshcentral_data/config.json file anyways.

Also, it seems that you were installing it as some special user, not a privileged user, which may be important.

infineonnetworks picture infineonnetworks on 3 Nov 2019

Deleting the Node_modules directory worked, although it was necessary to add a step.
sudo rm -rf node_modules
npm install meshcentral
npm install [email protected]
sudo setcap cap_net_bind_service = + ep / usr / bin / node

Then start normally

Thank you

dagors picture dagors on 3 Nov 2019

You can also just delete the "greenlock" folder within "node_modules" and start MeshCentral again. It should detect the module is missing and try to reinstall it.

Ylianst picture Ylianst on 3 Nov 2019

Same problem here. Did

rm -rf node_modules
npm install meshcentral
npm install [email protected]

but node ./node_modules/meshcentral insists on installing greenlook 2.8.8 and fails

Installing [email protected]...
ERROR: Unable to install required module "[email protected]". MeshCentral may not have access to npm, or npm may not have suffisent rights to load the new module. Try "npm install [email protected]" to manualy install this module.

sudo setcap 'cap_net_bind_service=+ep' /usr/bin/node does not help, either (it was already set, anyways) ...

disabling _letsencrypt_ in config.json gets it running again - without valid certificate, though.

baikal picture baikal on 4 Nov 2019

check where you node is actually installed. Depending on OS and installation of NodeJS it could be under /usr/local/bin/node instead.

infineonnetworks picture infineonnetworks on 4 Nov 2019

No, node is under /usr/bin/node.
Somethings is wrong about the usage of @2.8.2 in modules.push('[email protected]'); in meshcentral.js. It does not recognize that it is already installed, times out after 10 seconds (see #631).
Anyway, removing that @2.8.8 fixes it for me ... (after having [email protected] installed manually)

or basically use [email protected] (not -u) with manually installed [email protected] ...

baikal picture baikal on 4 Nov 2019

@infineonnetworks what version of node are you using? type "node -v". Thanks.

Ylianst picture Ylianst on 4 Nov 2019

@Ylianst v12.13.0

My nodejs install is in /usr/local/bin/node
Installed from nodesource.com directly.

infineonnetworks picture infineonnetworks on 4 Nov 2019

Just published MeshCentral 0.4.3-x with more fixes and clean up from @TotallyNotElite. Should still work but I do want to add GreenLock v3 as soon as I am back from vacation.

Ylianst picture Ylianst on 7 Nov 2019

See Migrating from Greenlock v2 to v3.

MailYouLater picture MailYouLater on 7 Nov 2019
👍2

Hi

I have Windows installation, so i will wait with wrong certificate until fixed.
Thanks

alesribic73 picture alesribic73 on 11 Nov 2019

Published MeshCentral v0.4.4-a with the move to GreenLock v3. When you update the server, it will revert to the default unsigned certificate and ask for a new Let's Encrypt certificate. This should take a minute. The new certificate will go in "meshcentral-data/letencrypt3". Once everything is working, you can remove the "meshcentral-data/letencrypt" folder and only keep the "3" one. The old one will no longer be used.

Feedback appreciated, this has been quite a pain to implement since documentation is not great for GreenLockv3. I had to figure a lot of things out from the code. Also, it seems like GreenLock v3 can only request RSA2048 certs, but I used to request RSA3072 with GreenLock v2. I will need to open an issue for this.

Ylianst picture Ylianst on 14 Nov 2019

Also... GreenLockv3 will require Node v8 or better. So you will see an error now saying you should update if you are using an older NodeJS with Let's Encrypt.

Ylianst picture Ylianst on 14 Nov 2019

i updated and it didin't generate the letsencrypt cert, it sticked with the auto-generated, i left it like that in case you need the logs.

sicutdeux picture sicutdeux on 14 Nov 2019

Sorry, restarted the service and it generated the Lets Cert and everything is back up,thanks!, Fixed confirmed.

sicutdeux picture sicutdeux on 14 Nov 2019
👍1

Nice!

Ylianst picture Ylianst on 14 Nov 2019

Hi,
having problem, letsencrypt certificate not downloading.
Meshcentral2 0.4.4.c, installed in google vm ubuntu18.04,
In previous version "letsencrypt" directory was populated but now "letsencrypt3" directory is empty.
Removed the whole "node_modules" and reinstalled with "npm install meshcentral", restarted with
"rsaKeySize": 2048, tried both "production": true and false,.
Restarted with "_letsencrypt" disabled, self certificates re-generated, deleted the letsencrypt* directories then re enabled letsencrypt. waited for hour but no wai to get valid certificate

leleb picture leleb on 15 Nov 2019

Arg! This is bad. Published MeshCentral v0.4.4-d with some fixes... Note that "rsaKeySize" is now ignored as GreenLockv3 only support 2048 keys (not sure why). more importantly, you can now run MeshCentral like this:

node node_modules/meshcentral --debug cert

It will display debug information about what is going on with Let's Encrypt.

Ylianst picture Ylianst on 15 Nov 2019

Published MeshCentral v0.4.4-f which hopefully will fix a lot of issues with GreenLockv3. Feedback appreciated.

Ylianst picture Ylianst on 16 Nov 2019

Note that with this new version, if you don't specify "names" in the "letsencrypt" configuration, then the "settings"->"cert" name is used. If you put multiple names, the first one will be the certificate's Common Name (CN) and other ones will the "AltNames". For example:

  "letsencrypt": {
    "email": "[email protected]",
    "names": "name1.domain.com,name2.domain.com",
    "production": false
  }

Here, "name1.domain.com" will be the CN. Hope it helps.

Ylianst picture Ylianst on 16 Nov 2019

Closing this one as it's a duplicate of #658 and I think GreenLock v3 if finally working correctly.

Ylianst picture Ylianst on 19 Nov 2019
Was this page helpful?
0 / 5 - 0 ratings

Related issues

unguzov picture unguzov  路  3Comments
Julien-asv picture Julien-asv  路  3Comments
guerby picture guerby  路  3Comments
whalehub picture whalehub  路  3Comments
hellofaduck picture hellofaduck  路  3Comments