[Gluster-users] Gluster communication via TLS client problem
Aravinda
aravinda at kadalu.tech
Wed Jan 31 17:11:27 UTC 2024
Sure let us know if it works with re setup.
> One reason I don't want to use docker is, I need to install it on VMs in
> the future. If everything is working, I will put the hole setup into
> ansible. But first step first. And the first step is, geting TLS running.
Kadalu Binnacle also supports ssh. Just change the command_mode to ssh, remove/replace the docker commands.
Refer below doc for Binnacle SSH config options.
https://github.com/kadalu/binnacle?tab=readme-ov-file#run-a-command-using-ssh
Blog post: https://aravindavk.in/blog/gluster-volume-setup-binnacle/
--
Thanks and Regards
Aravinda
Kadalu Technologies
---- On Wed, 31 Jan 2024 22:01:24 +0530 Stefan Kania <stefan at kania-online.de> wrote ---
Hi Aravinda,
im not so into Docker :-( So I just looked at your commands and I saw
that you did exacly the same I did. I even removed all TLS configuration
and all certificates and then copied your commands (as far as it was
possible) to create the certificates and compared it with my commands.
Everything is exacly the same. But my setup is not working :-(. At this
point I think it's not a Gluster problem but a problem of my Debian
installation and configuration. So I will start from scratch and do it
all again.
One reason I don't want to use docker is, I need to install it on VMs in
the future. If everything is working, I will put the hole setup into
ansible. But first step first. And the first step is, geting TLS running.
Stefan
Am 31.01.24 um 09:22 schrieb Aravinda:
> Hi Stefan,
>
>
>
> I reproduced this in our lab and it is working without any issues.
>
>
>
> Lab setup: Debian 12 and Gluster version 10.5
>
> Three servers and one client: c01.gluster, c02.gluster, c03.gluster and cluster-client.gluster
>
>
>
> I used RSA key length as 4096 instead of 2048 and used the below volume option
>
>
>
> gluster volume set gv1 ssl.cipher-list 'HIGH:!SSLv2'
>
>
>
> I used Kadalu Binnacle (https://github.com/kadalu/binnacle) to setup container based three nodes cluster. The details and the test file are available in the below Github repository.
>
>
>
> https://github.com/aravindavk/gluster-tests?tab=readme-ov-file#gluster-tls-tests
>
>
>
> --
> Aravinda
>
> Kadalu Technologies
>
>
>
>
>
>
>
>
> ---- On Mon, 29 Jan 2024 22:10:50 +0530 Stefan Kania <mailto:stefan at kania-online.de> wrote ---
>
>
>
> Hi Strahil, hi Aravinda
>
> Am 28.01.24 um 23:03 schrieb Strahil Nikolov:
>> You didn't specify correctly the IP in the SANS but I'm not sure if that's the root cause.
>> In the SANs section Specify all hosts + their IPs: IP.1=1.2.3.4IP.2=2.3.4.5DNS.1=c01.glusterDNS.2=c02.gluster
>
> That's what I did now:
>
> I took the commands from the article you recommended and added all the
> alternative names and IPs into the certificate:
> -------------
> openssl req -new -x509 -key /etc/ssl/glusterfs.key -subj "/CN=`hostname
> -f`" -addext "subjectAltName =
> IP:192.168.57.41,IP:192.168.57.42,IP:192.168.57.43,IP:192.168.57.51,DNS:c01.gluster,DNS:c02.gluster,DNS:c03.gluster,DNS:cluster-client.gluster"
> -out /etc/ssl/glusterfs.pem
> -------------
> Stille getting on the server:
> -------------
> [2024-01-29 16:32:08.877499 +0000] I
> [socket.c:4288:ssl_setup_connection_params] 0-socket.management: SSL
> support for MGMT is ENABLED IO path is ENABLED certificate depth is 1
> for peer 192.168.57.51:49151
> [2024-01-29 16:32:08.881842 +0000] E [socket.c:224:ssl_dump_error_stack]
> 0-socket.management: error:0A00010B:SSL routines::wrong version number
>
> -------------
>
> And on the client:
> -------------
> [2024-01-29 16:32:08.865731 +0000] I [MSGID: 100030]
> [glusterfsd.c:2767:main] 0-/usr/sbin/glusterfs: Started running version
> [{arg=/usr/sbin/glusterfs}, {version=10.5},
> {cmdlinestr=/usr/sbin/glusterfs --process-name fuse
> --volfile-server=c02.gluster --volfile-id=/gv1 /mnt}]
> [2024-01-29 16:32:08.870129 +0000] I [glusterfsd.c:2447:daemonize]
> 0-glusterfs: Pid of current running process is 664
> [2024-01-29 16:32:08.880528 +0000] I [MSGID: 101190]
> [event-epoll.c:667:event_dispatch_epoll_worker] 0-epoll: Started thread
> with index [{index=1}]
> [2024-01-29 16:32:08.880935 +0000] I [MSGID: 101190]
> [event-epoll.c:667:event_dispatch_epoll_worker] 0-epoll: Started thread
> with index [{index=0}]
> [2024-01-29 16:32:08.885755 +0000] I
> [glusterfsd-mgmt.c:2681:mgmt_rpc_notify] 0-glusterfsd-mgmt: disconnected
> from remote-host: c02.gluster
> [2024-01-29 16:32:08.885879 +0000] I
> [glusterfsd-mgmt.c:2720:mgmt_rpc_notify] 0-glusterfsd-mgmt: Exhausted
> all volfile servers
> [2024-01-29 16:32:08.887116 +0000] W
> [glusterfsd.c:1458:cleanup_and_exit]
> (-->/lib/x86_64-linux-gnu/libgfrpc.so.0(+0xfa35) [0x7fd18d185a35]
> -->/usr/sbin/glusterfs(+0x14769) [0x55d4f8d5d769]
> -->/usr/sbin/glusterfs(cleanup_and_exit+0x57) [0x55d4f8d54447] ) 0-:
> received signum (1), shutting down
> [2024-01-29 16:32:08.887209 +0000] I [fuse-bridge.c:7065:fini] 0-fuse:
> Unmounting '/mnt'.
> [2024-01-29 16:32:08.889719 +0000] I [fuse-bridge.c:7069:fini] 0-fuse:
> Closing fuse connection to '/mnt'.
> [2024-01-29 16:32:08.889909 +0000] W
> [glusterfsd.c:1458:cleanup_and_exit]
> (-->/lib/x86_64-linux-gnu/libc.so.6(+0x89044) [0x7fd18d00a044]
> -->/usr/sbin/glusterfs(glusterfs_sigwaiter+0xc5) [0x55d4f8d5be05]
> -->/usr/sbin/glusterfs(cleanup_and_exit+0x57) [0x55d4f8d54447] ) 0-:
> received signum (15), shutting down
> -------------
>
> executing the connect command on the client:
> --------------
> openssl s_client -showcerts -connect c02.gluster:24007
> --------------
>
> shows on the sever:
> --------------
> [2024-01-29 16:37:08.747123 +0000] I
> [socket.c:4288:ssl_setup_connection_params] 0-socket.management: SSL
> support for MGMT is ENABLED IO path is ENABLED certificate depth is 1
> for peer 192.168.57.51:58060
> [2024-01-29 16:37:08.767715 +0000] E
> [socket.c:426:ssl_setup_connection_postfix] 0-socket.management: SSL
> connect error (client: 192.168.57.51:58060) (server: 192.168.57.42:24007)
> --------------
>
> So still the same, no changes :-(
>
> Stefan
--
Stefan Kania
Landweg 13
25693 St. Michaelisdonn
Signieren jeder E-Mail hilft Spam zu reduzieren und schützt Ihre
Privatsphäre. Ein kostenfreies Zertifikat erhalten Sie unter
https://www.dgn.de/dgncert/index.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.gluster.org/pipermail/gluster-users/attachments/20240131/38783c61/attachment.html>
More information about the Gluster-users
mailing list