Docker and SCP Publisher Compatibility

[maxwellchandler]

Hi I will briefly describe my current wip architecture. 3 servers each with a CA docker node and galera replication. One master CA standalone non docker server. 2 reverse proxies in front of the 3 docker CAs. One VA server in docker, one publisher server.

My question is how to make scp publishing work with docker VA? There is no keygen functionality from within the keyfactor ce image and even when cping keys inside the image the gui says it cant find them, plus the user would be different. Is it possible to have a docker VA node gather ocsp info using scp?

[primetomas]

You should volume mount in directories and files to the container. See examples how to do it here:
https://hub.docker.com/r/keyfactor/ejbca-ce

Recently added more documentation about directories and mounting in your own files.

[primetomas]

Hi,

I'm wondering why you want to set up an SCP publisher from the VA? You have the SCP publisher on the CA, that publish to the VA right?
Setting up a publisher on the VA would publishing from the VA to somewhere else?
I don't think it works having publishers chained (CA->VA->XY), because there are no "issue" or "revoke" events happening on the VA and it is these events that trigger the publisher.

[maxwellchandler]

@primetomas

Tomas,

I may have expressed my self wrong but I am publishing to the VA from the CA. Here is a screenshot of the error. Outside of the GUIi scping to this location works. But within the gui I get the error seen below.

[primetomas]

If you check the server.log there is probably more detailed information in the log as to why this is. I.e. permission denied for the target directory, or something else?

[maxwellchandler]

@primetomas

This is all I see in the logs. Its not descriptve enough to diagnose the issue. Because as I said, from ubuntu cli SCPing with that key as that user to that dir works fine.

It seems that the option to specify port has been taken out in 8.2 CE edition? Could that be causing the error?

Error is occuring here:

if (StringUtils.isNotEmpty(certSCPDestination)) {
Session session = null;
try {
Destination destination = buildDestination(certSCPDestination, sshPort);
session = destination.port != null
? jsch.getSession(sshUsername, destination.host, destination.port)
: jsch.getSession(sshUsername, destination.host);
session.connect();
} catch (JSchException e) {
String msg = "Could not connect to certificate destination.";

[primetomas]

Ok, it says Auth fail. It should be visible in the SSH server as well than. If there's a reason auth fails apart from the private key not baing possible to access.