HTTPD error logs filling up. Enterprise Manager to blame?
Since upgrading to 13.0 (currently HF3), my HTTPD log has been filling with errors regarding EM auth tokens. Dec 11 10:12:49 slot1/bigip1 err httpd[23832]: [error] [client 172.16.0.230] Got exception while handling EM auth token request: Invalid Token: Could not decrypt authentication token: Could not RSA decrypt authentication token., referer: http://localhost:8100/shared/device-availability Dec 11 10:13:14 slot1/bigip1 err httpd[24494]: [error] [client 172.16.0.230] Got exception while handling EM auth token request: Invalid Token: Could not decrypt authentication token: Could not RSA decrypt authentication token., referer: http://localhost:8100/shared/gossip This is puzzling because we don't have BIGIQ or Enterprise Manager configured. These vCMP guests are pre-production with APM/LTM modules provisioned. Troubleshooting steps so far have been: Reset device trust Delete and recreate device trust Restart the HTTPD daemon and clear the .gz files that accumulate. Is anyone else seeing this behavior in their version 13 BIG-IPs?
Bug (ID 775845) Workaround; REST API httpd restart
So this is less of a question, but a post to help my fellow BIG-IP LTM administrators, since the solution I came up with is quite the hack, but it works for me, so your mileage may vary, and of course -- test in non-production environments. So some background: I am a F5 administrator and a automation engineer. My main focus is automating much of my work as an administrator to take mundane and repetitive tasks out of my and my colleagues/organizations workflow. So, when it came time to renew the device certificates for my F5 VMs and hosts, combined with the most recently reduction in SSL certificate term length and guidance to renew certs often, I set forth to automate the entire stack of processes that are required to renew device certificates (create key/csr, submit csr to CA and obtain cert, upload cert to F5 and restart the httpd service to read in the new certificates). I was able to script everything using Python and REST API calls to the F5s and InCommon CA to get the certificates created and put on the F5s. The problem I ran into was the feature to restart the httpd service via a REST API call was broken (aka Bug ID 775845). I tried using the REST API call: /tm/sys/service -X POST -d '{"name":"httpd", "command":"restart"}' I also attempted to use the bash command call: /mgmt/tm/util/bash -X POST -d "{ "command": "run", "utilCmdArgs": "-c 'service httpd restart'" } NONE worked, as documented in the is KB article: https://support.f5.com/csp/article/K13292945 So I needed a workaround, and my solution incorporates a batch script that basically preemptively kills off httpd and then restarts it (as you see in the KB shows as a fix). First, you need the following bash script (which is actually incorporated into the script below so one can ensure that it always present on the F5 VM or host that needs to have the httpd daemon restarted). #/bin/bash # Pause, restart httpd # Greg Jewett, 2021-08-26, jewettg@austin.utexas.edu # # A known bug (Bug ID 775845) when using the REST API to restart the httpd service. # The pause is to allow the REST API call to complete, as script will be launched # in background, and should have successful exit code. This script provides an # immediate fix to bring environment back up, without manually restarting the # httpd daemon on each VM or host. service httpd status | logger -p local0.notice -t RST_HTTPD logger -p local0.notice -t RST_HTTPD Waiting 2 seconds... sleep 2s logger -p local0.notice -t RST_HTTPD Restarting httpd daemon thepids=`pgrep -d " " -f "/usr/sbin/httpd"` echo "httpd pids are: $thepids" for aPid in $thepids; do echo "Killing PID $aPid" kill -9 $aPid done service httpd start | logger -p local0.notice -t RST_HTTPD service httpd status | logger -p local0.notice -t RST_HTTPD logger -p local0.notice -t RST_HTTPD Done NOTE: I am having to attach the rest of my solution via comments, as the platform was allowing me to post a big chuck of text (>10k chars). See below.
How to allow access to configuration utility GUI only on particular VLAN instead of all VLANs
Hi, I would need to restrict the access to configuration utility GUI on only one VLAN, how is this done? I don't want to restrict the access based on the source IP, but just to have the port 443 listening only on the VLAN that is used for O&M purposes. The software version is 11.6.0. Thanks!
httpd settings keep re-enabling
HTTPD settings keep re-enabling. Was testing out settings for the management UI login. I end up having to go into tmsh or vi to un-do them. (Per the documentation.) (ssl-client-verify and ssl-ocsp-enable) I save a /sys config after I un-do the setting however every time I sync the Active and Standby the settings come back and re-enable. Are those settings stored in another file somewhere that the sync process reads?