Arch Linux

93i

Member

Registered: 2014-02-24

Posts: 8

[SOLVED] Trouble with Server after reboot

Help, whats going on? I have set up a archlinux server, and it is in production... well, the parts that still work

I rebooted it today.

I have vsftpd installed with ssl enabled, and after the reboot, i could not connect anymore... turned out, that the ssl cert  /etc/ssl/certs/vsftpd.pem was gone (!?) i had to restore it from the backups... now vsftpd is up again, but what the heck happened, how can certs dissapear, this is really bad and makes me wonder if chosing arch was a good idea for a production server :-/

The second problem i have not solved yet: None of my https servers is working anymore. This time the certs seem to be there, and i can telnet to 443, but every browser says that the connection failed. No noticable errors in the logfile or anything.

Here is an example of my vhost config:

<VirtualHost *:443>
    DocumentRoot "/srv/http/dummy"
    ErrorLog "/var/log/httpd/dummy-error_log"
    CustomLog "/var/log/httpd/dummy-access_log" common

    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLHonorCipherOrder On
    SSLCompression off
    SSLCipherSuite AES256+EECDH:AES256+EDH:!MEDIUM:!aNULL:!eNULL:!EXP:!LOW:!MD5:!SSLv3:!SSLv2
    SSLCertificateFile "/etc/httpd/conf/certs/dummy/server.crt"
    SSLCertificateKeyFile "/etc/httpd/conf/certs/dummy/server.key"

    <Directory "/srv/http/dummy">
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>

I also ran the ssllabs test on the domain, which run with no obvious error.

Please help.

Last edited by 93i (2015-01-14 07:16:01)

jasonwryan

Anarchist

From: .nz

Registered: 2009-05-09

Posts: 30,426

Website

Re: [SOLVED] Trouble with Server after reboot

https://www.archlinux.org/news/ca-certificates-update/

---

Arch + dwm   •   Mercurial repos  •   Surfraw

Registered Linux User #482438

Ashren

Member

From: Denmark

Registered: 2007-06-13

Posts: 1,229

Website

Re: [SOLVED] Trouble with Server after reboot

When using Arch on a production system it is very important to read the news on the front page.

https://www.archlinux.org/news/ca-certificates-update/

---

Use LVM2!

XMobar/XMonad - Click Workspaces :: Blog about Linux (mostly) :: Script for repetitive scrotting :: ISC DHCP Git Hooks

93i

Member

Registered: 2014-02-24

Posts: 8

Re: [SOLVED] Trouble with Server after reboot

I've seen this and i did this.

My server certs are under /etc/httpd/conf/certs/hostname/* and named crt already

\hbar

Member

Registered: 2014-03-15

Posts: 165

Re: [SOLVED] Trouble with Server after reboot

Could you give more details about the error message that browsers report? Does anything show up in the access and error log when you try to connect via a browser?

93i

Member

Registered: 2014-02-24

Posts: 8

Re: [SOLVED] Trouble with Server after reboot

chrome:

The webpage at https://zefix.tv/ might be temporarily down or it may have moved permanently to a new web address.
Error code: ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Firefox (which is wrong, SSLv3 is disabled, ssllabs test confirms this)

Unable to Connect Securely

Firefox cannot guarantee the safety of your data on zefix.tv because it uses SSLv3, a broken security protocol.
Advanced info: ssl_error_no_cypher_overlap

\hbar

Member

Registered: 2014-03-15

Posts: 165

Re: [SOLVED] Trouble with Server after reboot

If you comment out the 'SSLCipherSuite' entry, does it work?

93i

Member

Registered: 2014-02-24

Posts: 8

Re: [SOLVED] Trouble with Server after reboot

Thanx, yes, SSLCipherSuite was the reason, i had to remove '!SSLv3', which is weired. So the https problem was obviously not archlinux related, maybe this was introduced with the last openssl update? I am not sure if the problem existed before the reboot, could be... Anyway, thanx, everything up again... still weird, that the vsftpd cert was gone though, have to keep an eye on that.