chef-boneyard / omnibus-chef-server Goto Github PK

I have installed chef-server on a gentoo system by extracting the debian package (chef-server_11.1.3-1_amd64.deb).

chef-server-ctl reconfigure freezes while waiting for RabbitMQ.

I figured out, that there was no symlinks created for RabbitMQ in /opt/chef-server/service

After creating symlinks for every service from /opt/chef-server/sv as soon as the reconfigure process freezes, i could configure and start chef-server.

Hi,

Prior to the recent postgres updates in omnibus, I used to be able to perform a backup of my Chef Server's database like this:

/opt/chef-server/embedded/bin/pg_dump -U opscode_chef -c opscode_chef > chef-server.pgsql

Unfortunately, that now results in a few errors:

pg_dump: [archiver (db)] connection to database "opscode_chef" failed: FATAL: no pg_hba.conf entry for host "[local]", user "opscode_chef", database "opscode_chef", SSL off

I can work around that error by specifying a TCP host: /opt/chef-server/embedded/bin/pg_dump --host 127.0.0.1 -U opscode_chef -c opscode_chef > chef-server.pgsql

But that presents a new error:

pg_dump: [archiver (db)] query failed: ERROR:  permission denied for schema sqitch
pg_dump: [archiver (db)] query was: LOCK TABLE sqitch.projects IN ACCESS SHARE MODE

Which I can work around finally by doing:

/opt/chef-server/embedded/bin/pg_dump --host 127.0.0.1 --schema public -U opscode_chef -c opscode_chef > chef-server.pgsql

In IRC, @juliandunn mentioned that this was probably a bug and to file an issue. So here I am!

We need to review at least our security releases for other products since, but maybe a manifest of software in OSS Server 11, to determine necessary security updates.

• OpenSSL
  Last release had 1.0.1j, there are at least 14 fixed CVEs between 1.0.1j and 1.0.1m.
• PostgreSQL
  Last bump was 9.2.9, there are five CVEs fixed in 9.2.10.
• Ruby
  The Gemfile points to chef/omnibus-software@a08918d, which has ruby 1.9.3-p484 from 2013-11-22. There are surely countless CVEs fixed since then. Ruby 1.9.3-p551 appears to be the latest
• Nginx
  The Gemfile points to chef/omnibus-software@a08918d, which has nginx 1.4.4. The 1.4 changelog shows 1 CVE fixed in 1.4.7 which was released on 2014-03-18. I don't see a statement about 1.4 being EOL, but it looks like they've stopped shipping it. Ngingx 1.6 has a couple CVE fixes since then. I don't see any subsequent security fixes in Nginx 1.8. We did recently release Chef Server 12.0.8 which included what looks like 8 Nginx security fixes.

Potential issues:

• This wasn't building in October? #99
• The Gemfile refers to http://www.github.com/opscode/omnibus-ruby, which is gone?
• Ruby 1.9.3 is EOL. In the 11.x client we chose to not to upgrade to a newer ruby for CVE-2015-1855 because it would be a lot of work and that CVE isn't a big deal

Docker has no upstart, it should try to fall back on old schoolz.

Can we make nginx listen addresses configurable via chef-server.rb config file?

I'm assuming the string presentation of the class isn't what was intended here... what was?

# chef-server-ctl install chef-ha
.
.
.
Running handlers:
-- Installed Add-On Package: chef-ha
  - #<Class:0x00000003d12df8>::AddonInstallHandler
Running handlers complete```

Hey,

I tried to build current master, but had to patch omnibus-software as some checksums and download URLs are outdated. Current omnibus-software master doesn't work out of the box.

Is there any reason chef-server can't be updated to use the latest versions of omnibus and omnibus-software? Are there known blockers?

These logs get huge pretty quick and eventually the server crashes when the root drive fills up. Even if you stick them on a larger data drive you can still fill up that drive causing logging to halt. This seems like a really big oversight that should get fixed asap.