我拉了一个魔术技巧从帽子里。
我把在 Raspberry Pi 3 B 上使用 FreeIPA 运行 Kerberos 5。
这是一个便宜的盒子，只做一件事，那就是发放票。我修改的将 60 秒超时时间改为 2000 秒，安装就完成了。这是下一个问题，这次我不太明白。
在 Web UI 上，它在一个选项卡“身份验证 -> 证书”上失败。
[Tue May 19 22:02:02.578593 2020] [wsgi:error] [pid 1364:tid 2941485888] [remote IP.119:53807] ipa: INFO: [jsonserver_session] [email protected]: user_find(None, version='2.236', no_members=True): SUCCESS</br>
[Tue May 19 22:02:05.062481 2020] [:warn] [pid 2099:tid 2494501696] [client IP.119:53807] failed to set perms (3140) on file (/run/ipa/ccaches/[email protected])!, referer: https://flash.aronetics.com/ipa/ui/
[Tue May 19 22:02:06.382009 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] ipa: ERROR: non-public: OverflowError: timestamp out of range for platform time_t
[Tue May 19 22:02:06.382180 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] Traceback (most recent call last):
[Tue May 19 22:02:06.382248 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] File "/usr/lib/python3.7/site-packages/ipaserver/rpcserver.py", line 368, in wsgi_execute
[Tue May 19 22:02:06.382269 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] result = command(*args, **options)
[Tue May 19 22:02:06.382288 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 450, in __call
[Tue May 19 22:02:06.382307 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] return self.__do_call(*args, **options)
[Tue May 19 22:02:06.382324 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 478, in __do_call
[Tue May 19 22:02:06.382343 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] ret = self.run(*args, **options)
[Tue May 19 22:02:06.382361 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 800, in run
[Tue May 19 22:02:06.382379 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] return self.execute(*args, **options)
[Tue May 19 22:02:06.382397 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] File "/usr/lib/python3.7/site-packages/ipaserver/plugins/cert.py", line 1835, in execute
[Tue May 19 22:02:06.382415 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] **options)
[Tue May 19 22:02:06.382433 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] File "/usr/lib/python3.7/site-packages/ipaserver/plugins/cert.py", line 1701, in _ca_search
[Tue May 19 22:02:06.382453 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] convert_pkidatetime(obj['valid_not_after']))
[Tue May 19 22:02:06.382471 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] File "/usr/lib/python3.7/site-packages/ipaserver/plugins/cert.py", line 257, in convert_pkidatetime
[Tue May 19 22:02:06.382490 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] value = datetime.datetime.fromtimestamp(int(value) // 1000)
[Tue May 19 22:02:06.382508 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] OverflowError: timestamp out of range for platform time_t
[Tue May 19 22:02:06.383531 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] ipa: INFO: [jsonserver_session] [email protected]: cert_find(None, version='2.236'): InternalError
[root@flash ~]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful
我必须修改有点危险的 sytemd 环境（恕我直言？！）或者延长此超时时间。
答案1
您的 CA 证书有效期已超过 2038 年，也就是说，在 UNIX 中，时间戳超出了 32 位边界。因此，在 32 位平台上尝试使用 Python 的 datetime 模块处理此类时间会失败。
请打开票https://pagure.io/freeipa/new_issue使用此堆栈跟踪。代码需要一些改进，以避免使用会引发 OverflowError 的 #fromtimestamp() 方法。