cmd/upspin: setupserver: signature does not match

[dncohen]

This may be the same issue as (closed) #260 . There, a couple people have reported the same message and there's no clear fix.

I've had some trouble setting up a local storage server. I've tried and re-tried various commands. Deleted and recreated directories, and basically tried everything I could think of twice. Maybe I've done a number of things wrong to this point. Anyway, here's an error I can reproduce but don't know how to get past it.

[upspin@upspin ~]$ upspin setupserver -domain=upspin.example.com -host upspin.example.com
User "upspin@upspin.example.com" already exists on key server.
Configured upspinserver at "upspin.example.com:443".
upspin: setupserver: client.MakeDirectory: upspin@upspin.example.com/: I/O error:
	dir/remote("upspin.example.com:443").Put:
	rpc.Invoke: 401 Unauthorized: rpc.SessionForRequest: permission denied:
	user upspin@upspin.example.com: invalid signature: invalid operation: signature does not match

Note that if I run setupserver again, I get a different error (every time I retry the same command...

[upspin@upspin ~]$ upspin setupserver -domain=upspin.example.com -host upspin.example.com
User "upspin@upspin.example.com" already exists on key server.
upspin: setupserver: upspinserver returned status 400 Bad Request:
Parse: user.Parse: user setupserver: invalid operation: user name must contain one @ symbol

To reproduce the earlier signature does not match error, I need to stop upspinserver, delete the upspin/server directory that was created there, and restart that process.

At this point, i'm unable to setup the server and I'd appreciate any help troubleshooting. Thanks.

[dncohen]

My best guess is that I used a hostname in the -domain parameter. I'm trying to setup from scratch. Currently stuck on #611 . If I'm able to get past that I'll close this issue out.

[n2vi]

User ***@***.***" already exists on key server.

This message sounds like you had successfully bound a public key on the upspin keyserver with the given email address, then later tried to register a new key from scratch. That's not allowed. (Otherwise there is too much risk a bad actor could steal your account.) Most likely if you look around in your .ssh directory you'll find a "secret2" file that archived the original key. I'm on the road but when back in town am willing to look into trying to make the setupserver script smarter about such things. In the meantime, you can contact me directly ( grosse@gmail.com) and maybe I can help you restore the proper key in your local files.

[dncohen]

I appreciate the help. When I wrote this issue, I was using "upspin.example.com" as the domain, and host. Looking over the directions, they use "upspin.example.com" as host, and "example.com" as domain. So I started over following that example.

I created a user "upspin@upspin.example.com" manually, following the "sign up for an Upspin user account" step.

upspin later created "upspin@example.com" automatically, during the "configure a domain name and create an Upspin user for the server" step (https://upspin.io/doc/server_setup.md)

Notice that when host and domain were the same, both accounts are named "upspin@upspin.example.com". Could it be that the server was attempting to register that name, but I'd already taken it?

[n2vi]

The "dave-cohen.com" lines in https://key.upspin.io/log may give some clues as well. We should almost surely change our setup code to reject "example.com" as input. It isn't possible to register foo@x.example.com because no such mail address exists and hence the email verification step will fail. But people can register a valid email and list their server as upspin.example.com even though no such host will ever exist. We can't check that in general because t is not unreasonable to register a host before creating it. But we should catch that people are confused by our document and quoting example.com without meaning to.

…

On Fri, Sep 7, 2018 at 1:46 PM, dncohen ***@***.***> wrote: I appreciate the help. When I wrote this issue, I was using " upspin.example.com" as the domain, and host. Looking over the directions, they use "upspin.example.com" as host, and "example.com" as domain. So I started over following that example. I created a user ***@***.***" manually, following the "sign up for an Upspin user account" step. upspin later created ***@***.***" automatically, during the "configure a domain name and create an Upspin user for the server" step ( https://upspin.io/doc/server_setup.md) Notice that when host and domain were the same, *both* accounts are named ***@***.***". Could it be that the server was attempting to register that name, but I'd already taken it? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#610 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AIA3ujL75FU_ii4cf9Ag1eKDAUWs01lBks5uYttDgaJpZM4WeOmI> .

[dncohen]

I'm using "example.com" here on github. I didn't use "example.com" in the actual setup.

I'm saying that I chose "upspin@upspin.dave-cohen.com" to be my local admin account. And upspin chose "upspin@upspin.dave-cohen.com" to be the server's account, because is prepends "upspin@" to the domain. I didn't realize when I chose my admin account name that they would collide.
(I'm not sure that was the cause of the problem, because I still had some other issues to work out on the server.)

[n2vi]

Ah, I see what you mean. Yes, one can use the same account for both purposes but it is not ideal and worth at least a cautionary message during setup.

…

On Fri, Sep 7, 2018 at 4:09 PM, dncohen ***@***.***> wrote: I'm using "example.com" here on github. I didn't use "example.com" in the actual setup. I'm saying that I chose ***@***.***" to be my local admin account. And upspin chose ***@***.***" to be the server's account, because is prepends "upspin@" to the domain. I didn't realize when I chose my admin account name that they would collide. (I'm not sure that was the cause of the problem, because I still had some other issues to work out on the server.) — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#610 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AIA3ujHx9ObrpqcOE8Oij2hvuTdolOb3ks5uYvy5gaJpZM4WeOmI> .