stefbehl on master
Make custom target filter table… (compare)
bogdan-bondar on master
Provide API for auto assignment… (compare)
Hello hawkBit community,
We are using hawkBit over reverse proxy TLS. We recently merged changes from 0.3.0M7 into our fork, and found that we get HTTP response instead of HTTPS. Setting hawkbit.server.security.require-ssl
to true
(a previous recommendation on Gitter) did not help. The migration guide does not include anything relevant for this - could this be caused by the Spring Boot 2.3.7 upgrade? Or any other upgraded dependencies?
Thanks!
Hi all! I have integrated the keycloak with hawkbit after successful validation it redirect to hawkbit I am not able to assign distrubution to target.But through target filter it is assigning to ds.And I have assigned all client level roles to the user
I have given all client roles to the user like
APPROVE_ROLLOUT
CREATE_ROLLOUT
DELETE_ROLLOUT
UPDATE_ROLLOUT
READ_ROLLOUT
HANDLE_ROLLOUT
ROLLOUT_MANAGEMENT
CREATE_TARGET
DELETE_TARGET
READ_TARGET
UPDATE_TARGET
CREATE_REPOSITORY
DELETE_REPOSITORY
READ_REPOSITORY
UPDATE_REPOSITORY
TENANT_CONFIGURATION
DOWNLOAD_REPOSITORY_ARTIFACT
READ_TARGET_SECURITY_TOKEN
I am getting error like this in terminal
I have decoded Access token it is getting client roles also Whatever I have assigned
Hey @kevlhop
yes this is possible with the new invalidation of distribution sets feature. Extract from the documentation:
Invalidating a distribution set removes all auto-assignments that reference this distribution set. Optionally, all rollouts that reference the distribution set can be stopped and existing update actions are removed, either by a soft-cancel or a forced-cancel.
Invalidated distribution sets cannot be valid again, but remain invalid. They cannot be assigned to targets, neither through a rollout, auto-assignment nor a single assignment.
Hi,
I am facing issue in swupdate after enable SSL/TLS security option in hawkbit server.
To enable SSL, these steps I have done inside hawkbit server source
Generate the self-signed x509 certificate suitable to use on web server.
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Generate pem file from generated server.key and server.crt
cat server.key > server.pem
cat server.crt >> server.pem
Generate .pkcs12 file
openssl pkcs12 -export -in server.pem -out keystore.pkcs12
Following command imports a .p12 into pkcs12 Java keystore
keytool -importkeystore -srckeystore keystore.pkcs12 -srcstoretype pkcs12 \
-destkeystore hb-pass.jks -deststoretype pkcs12 \
-alias 1 -deststorepass <password_of_p12>
Edit the hawkbit application.properties file
vi application.properties
Change authentication security from false to true.
hawkbit.server.ddi.security.authentication.anonymous.enabled=true
Enter the https details at last
server.hostname=localhost
server.port=8443
hawkbit.artifact.url.protocols.download-http.protocol=https
hawkbit.artifact.url.protocols.download-http.port=8443
security.require-ssl=true
server.use-forward-headers=true
server.ssl.key-store= <hb-pass.jks file location>
server.ssl.key-store-type=JKS
server.ssl.key-password= <password_of_key>
server.ssl.key-store-password= <password_of_key_store>
server.ssl.protocol=TLS
server.ssl.enabled-protocols=TLSv1.2
server.ssl.ciphers=TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_RSA_WITH_AES_256_CBC_SHA
after that I copied server.pem on target
and add the path in swupdate.cfg
suricatta :
{
tenant = "default";
id = "orion";
confirm = 0;
url = "https://swupdateurl:8443";
polldelay = 360;
nocheckcert = false;
retry = 4;
retrywait = 200;
loglevel = 10;
userid = 0;
groupid = 0;
max_artifacts = 1;
cafile = "/home/root/server.pem";
/
cafile = "/etc/ssl/cafile";
sslkey = "/etc/ssl/sslkey";
sslcert = "/etc/ssl/sslcert";
/
};
and the error logs :
Connected to 192.168.0.10 (192.168.0.10) port 8443 (#1)
I am facing issue in swupdate after enable SSL/TLS security option in hawkbit server.
To enable SSL, these steps I have done inside hawkbit server source
Generate the self-signed x509 certificate suitable to use on web server.
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Generate pem file from generated server.key and server.crt
cat server.key > server.pem
cat server.crt >> server.pem
Generate .pkcs12 file
openssl pkcs12 -export -in server.pem -out keystore.pkcs12
Following command imports a .p12 into pkcs12 Java keystore
keytool -importkeystore -srckeystore keystore.pkcs12 -srcstoretype pkcs12 \
-destkeystore hb-pass.jks -deststoretype pkcs12 \
-alias 1 -deststorepass <password_of_p12>
Edit the hawkbit application.properties file
vi application.properties
Change authentication security from false to true.
hawkbit.server.ddi.security.authentication.anonymous.enabled=true
Enter the https details at last
server.hostname=localhost
server.port=8443
hawkbit.artifact.url.protocols.download-http.protocol=https
hawkbit.artifact.url.protocols.download-http.port=8443
security.require-ssl=true
server.use-forward-headers=true
server.ssl.key-store= <hb-pass.jks file location>
server.ssl.key-store-type=JKS
server.ssl.key-password= <password_of_key>
server.ssl.key-store-password= <password_of_key_store>
server.ssl.protocol=TLS
server.ssl.enabled-protocols=TLSv1.2
server.ssl.ciphers=TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_RSA_WITH_AES_256_CBC_SHA
after that I copied server.pem on target
and add the path in swupdate.cfg
suricatta :
{
tenant = "default";
id = "orion";
confirm = 0;
url = "https://swupdateurl:8443";
polldelay = 360;
nocheckcert = false;
retry = 4;
retrywait = 200;
loglevel = 10;
userid = 0;
groupid = 0;
max_artifacts = 1;
cafile = "/home/root/server.pem";
/
cafile = "/etc/ssl/cafile";
sslkey = "/etc/ssl/sslkey";
sslcert = "/etc/ssl/sslcert"; /
};
and the error logs :
Connected to 192.168.0.10 (192.168.0.10) port 8443 (#1)
found 1 certificates in /home/root/server.pem
ALPN, offering http/1.1
SSL connection using TLS1.2 / RSA_AES_256_CBC_SHA1
server certificate verification failed. CAfile: /home/root/server.pem CRLfile: none
Closing connection 1
[ERROR] : SWUPDATE failed [0] ERROR /home/hmecd001520/orion-yocto-bsp/build/tmp/work/orion-poky-linux/swupdate/2021.04-r0/git/corelib/channel_curl.c : channel_get : '
[DEBUG] : SWUPDATE running : [start_suricatta] : No pending action to process.
[DEBUG] : SWUPDATE running : [suricattawait] : Sleeping for 360 seconds.
Hello everyone! I want to expose some hawkBit statistics via a custom InfoContributor (https://docs.spring.io/spring-boot/docs/1.5.2.RELEASE/reference/html/production-ready-endpoints.html#production-ready-application-info-custom). This endpoint is exposed on /info
. So far, I can successfully access the endpoint and even contribute some test data to this endpoint.
I am facing an issue when contributing data from TargetManagement
. When I inject TargetManagement
via my custom InfoContributor endpoint's constructor and invoke a method, e.g., targetManagement.count()
, the source code builds but throws an internal server error when I access the /info
endpoint. The error logs shows org.springframework.web.util.NestedServletException: Request processing failed; nested exception is org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext.
I tried removing the @PreAuthorize
annotation for the count()
method, but this does not change things. Any ideas what I might be doing wrong?
SecurityManagedConfiguration
) that is required for @PreAuthorize
to be used. The error that you get means exactly what it mentions: while accessing the /info
endpoint you don’t authenticate yourself, thus there is nothing available to check against in the security context.
Hi All,
I am trying to integrate SWUpdate to Hawkbit with Yocto as build system.
Can someone please let me know how to include some kind of script to set the necessary arguments needed, using the machine ID to uniquely identifiy a client, and passing the "-c" option to indicate the current update state based on the value of the "ustate" boot variable, so that after an update and reboot, a success or failure message would be sent to the hawkBit server.
Any example or reference link to accomplish this would be really helpful.
P.S: This is my first time involving with SWUpdate and hawkBit. And I am using STM32MP based Avenger96 board with u-boot bootloader.
Thanks in advance.
Hello all, I want to add a new column last_update
to sp_target
. This column records the timestamp of the last instance of an attribute update. I managed to change the schema and add this column. I also had to change the migration schema (e.g., V1_11_0__init__MYSQL.sql
) to include this column (otherwise, I get an error when loading the Management UI that this column name is not found). I can get hawkBit to work with an empty database.
When I run this hawkBit instance with an existing MySQL database, I get a org.flywaydb.core.api.FlywayException: Validate failed: Migration checksum mismatch for migration version 1.0.1
. Reading up on Flyway, I understand that this is because the tables in schema_version
database of my MySQL schema have different checksums than what I currently have in the hawkBit instance. Existing solutions on the web, e.g., dropping schema_version
does not seem right. How do I proceed? I also get the sense that there is no way to use an existing database with a modified database schema—is this true? Thanks!
@bogdan-bondar and here it is my property file for reference: org.eclipse.hawkbit.repository.s3.bucketName=hawkbit-dev-storage
org.eclipse.hawkbit.artifact.repository.s3.enabled=true
aws.region=us-east-1
#AWS_REGION
spring.jpa.database=MYSQL
spring.datasource.url=jdbc:mysql://mysql/hawkbit
spring.datasource.username=xxxxxxxxxxxxxxx
spring.datasource.password=XXXXXXXXXXXXXXXX
spring.datasource.driverClassName=com.mysql.jdbc.Driver
spring.security.user.name=admin
spring.security.user.password={noop}abc123!
spring.main.allow-bean-definition-overriding=true
server.servlet.encoding.charset=UTF-8
server.servlet.encoding.enabled=true
server.servlet.encoding.force=true
hawkbit.server.ddi.security.authentication.anonymous.enabled=true
hawkbit.server.ddi.security.authentication.targettoken.enabled=false
hawkbit.server.ddi.security.authentication.gatewaytoken.enabled=false
hawkbit.server.repository.publish-target-poll-event=true
server.hostname=$HOSTNAME
hawkbit.server.ddi.security.authentication.anonymous.enabled=true
server.port=8443
hawkbit.artifact.url.protocols.download-http.protocol=https
hawkbit.artifact.url.protocols.download-http.port=8443
hawkbit.server.security.require-ssl=true
security.require-ssl=true
server.use-forward-headers=true
server.ssl.key-store=/home/hb-pass.jks
server.ssl.key-store-type=JKS
server.ssl.key-password=XXXXXX
server.ssl.key-store-password=XXXXXX
server.ssl.protocol=TLS
server.ssl.enabled-protocols=TLSv1.2
server.ssl.ciphers=TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA
spring.rabbitmq.username=guest
spring.rabbitmq.password=guest
spring.rabbitmq.virtual-host=/
spring.rabbitmq.host=localhost
spring.rabbitmq.port=5672
spring.servlet.multipart.max-file-size=3073741824
spring.servlet.multipart.max-request-size=3073741824
hawkbit.server.security.dos.maxArtifactSize=3073741824