我无法让Rundeck使用SSL开头

Question

我使用rpm方法将Rundeck安装在新的RHEL 7.7盒上。我可以使用http很好地访问服务器，但是当我按照docs中的说明进行操作时，无法从浏览器或通过卷曲localhost访问该服务器。我收到的唯一错误是：

WARN SslContextFactory --- [           main] No supported ciphers from [SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,...(many more ciphers)
Grails application running at https://localhost:4443 in environment: production

curl localhost:4443
curl: (35) Peer reports it experienced an internal error.

配置文件的相关部分如下：/ etc / rundeck / profile：

RDECK_JVM="-Drundeck.jaaslogin=$JAAS_LOGIN \
           -Djava.security.auth.login.config=$JAAS_CONF \
           -Dloginmodule.name=$LOGIN_MODULE \
           -Drdeck.config=$RDECK_CONFIG \
           -Drundeck.server.configDir=$RDECK_SERVER_CONFIG \
           -Dserver.datastore.path=$RDECK_SERVER_DATA/rundeck \
           -Drundeck.server.serverDir=$RDECK_INSTALL \
           -Drdeck.projects=$RDECK_PROJECTS \
           -Drdeck.runlogs=$RUNDECK_LOGDIR \
           -Drundeck.config.location=$RDECK_CONFIG_FILE \
           -Djava.io.tmpdir=$RUNDECK_TEMPDIR \
           -Drundeck.server.workDir=$RUNDECK_WORKDIR \
           -Dserver.http.port=$RDECK_HTTP_PORT \
           -Drdeck.base=$RDECK_BASE \
           -Djdk.tls.ephemeralDHKeySize=jdk8 \
           -Drundeck.rundeck.jetty.connector.ssl.excludedCipherSuites=SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA384,SSL_RSA_WITH_AES_256_CBC_SHA256,SSL_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,SSL_ECDH_RSA_WITH_AES_256_CBC_SHA384,SSL_DHE_RSA_WITH_AES_256_CBC_SHA256,SSL_DHE_DSS_WITH_AES_256_CBC_SHA256,SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_AES_256_CBC_SHA,SSL_ECDH_ECDSA_WITH_AES_256_CBC_SHA,SSL_ECDH_RSA_WITH_AES_256_CBC_SHA,SSL_DHE_RSA_WITH_AES_256_CBC_SHA,SSL_DHE_DSS_WITH_AES_256_CBC_SHA,SSL_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA256,SSL_RSA_WITH_AES_128_CBC_SHA256,SSL_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,SSL_ECDH_RSA_WITH_AES_128_CBC_SHA256,SSL_DHE_RSA_WITH_AES_128_CBC_SHA256,SSL_DHE_DSS_WITH_AES_128_CBC_SHA256,SSL_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA,SSL_RSA_WITH_AES_128_CBC_SHA,SSL_ECDH_ECDSA_WITH_AES_128_CBC_SHA,SSL_ECDH_RSA_WITH_AES_128_CBC_SHA,SSL_DHE_RSA_WITH_AES_128_CBC_SHA,SSL_DHE_DSS_WITH_AES_128_CBC_SHA,SSL_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,SSL_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,SSL_ECDHE_RSA_WITH_AES_256_GCM_SHA384,SSL_RSA_WITH_AES_256_GCM_SHA384,SSL_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,SSL_ECDH_RSA_WITH_AES_256_GCM_SHA384,SSL_DHE_DSS_WITH_AES_256_GCM_SHA384,SSL_DHE_RSA_WITH_AES_256_GCM_SHA384,SSL_ECDHE_RSA_WITH_AES_128_GCM_SHA256,SSL_RSA_WITH_AES_128_GCM_SHA256,SSL_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,SSL_ECDH_RSA_WITH_AES_128_GCM_SHA256,SSL_DHE_RSA_WITH_AES_128_GCM_SHA256,SSL_DHE_DSS_WITH_AES_128_GCM_SHA256"

#
# Set min/max heap size
#
RDECK_JVM="$RDECK_JVM $RDECK_JVM_SETTINGS"
#
# SSL Configuration - Uncomment the following to enable.  Check SSL.properties for details.
#
if [ -n "$RUNDECK_WITH_SSL" ] ; then
  RDECK_JVM="$RDECK_JVM -Drundeck.ssl.config=$RDECK_SERVER_CONFIG/ssl/ssl.properties -Dserver.https.port=${RDECK_HTTPS_PORT} -Dorg.eclipse.jetty.util.ssl.LEVEL=DEBUG"
fi

/ etc / sysconfig / rundeckd：

export RUNDECK_WITH_SSL=true
export RDECK_HTTPS_PORT=4443

如果将export RDECK_JVM_OPTS="-Dserver.ssl.ciphers=SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"添加到/ etc / sysconfig / rundeckd，则会得到以下信息：

[2020-03-29 09:01:51.533]  WARN config --- [           main] Weak cipher suite SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 enabled for SslContextFactory@1456dec8[provider=null,keyStore=file:///etc/rundeck/ssl/keystore,trustStore=file:///etc/rundeck/ssl/truststore]
Grails application running at https://localhost:4443 in environment: production

curl: (35) Peer reports it experienced an internal error.

其他配置：/etc/rundeck/framework.properties：

framework.server.name = server-dns
framework.server.hostname = server-dns
framework.server.port = 4443
framework.server.url = https://server-dns
framework.rundeck.url = https://server-dns

/ etc / rundeck / rundeck-config.properties：

grails.serverURL=https://server-dns:4443

keystore和truststore存在，我尝试过自签名和真实crt。我在这里茫然。我遵循了互联网上的各种指南和建议，导致我当前的配置（错误？）。谢谢

编辑以纠正帖子中的错误。

Answer 1

也许您需要在ssl.properties文件中引用密钥库/ trustore（通常在/etc/rundeck/ssl/ssl.properties路径中）。我写了一些指南来使用SSL设置Rundeck。

1.-安装Rundeck。

rpm -Uvh https://repo.rundeck.org/latest.rpm

yum install rundeck

2.-创建密钥库：（如果您已经具有.key / .crt或.pk12格式的证书，请跳至2b）

keytool -keystore /etc/rundeck/ssl/keystore -alias rundeck -genkey -keyalg RSA -keypass password -storepass password

2b.-如果您有自己的证书，请执行以下操作：

如果有.crt和.key文件，请创建一个.p12文件：

openssl pkcs12 -export -in YOUR.crt -inkey YOUR.key -out NEW.p12

将其转换为.jks（如果只有.p12文件，也要转换为它：]

keytool -importkeystore -destkeystore keystore -srckeystore NEW.p12 -srcstoretype pkcs12

3.-将密钥库复制为信任库。

4.-编辑/etc/rundeck/ssl/ssl.properties文件：

keystore=/etc/rundeck/ssl/keystore
keystore.password=password
key.password=password
truststore=/etc/rundeck/ssl/truststore
truststore.password=password

5.-编辑/etc/rundeck/framework.properties文件：

framework.server.port = 4443
framework.server.url = https://localhost:4443

6.-编辑/etc/rundeck/rundeck-config.properties文件：

grails.serverURL=https://localhost:4443

7.-编辑/创建/ etc / sysconfig / rundeckd文件：

export RUNDECK_WITH_SSL=true

8.-启动流水线服务。

systemctl start rundeckd