Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #273238 > unrolled thread

SSL/TLS debugging on MariaDB

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  SSL/TLS debugging on MariaDB Andrew Wood <andrewjameswood@ymail.com> - 2024-09-23 22:10 +0200
    Re: SSL/TLS debugging on MariaDB - tos minclock 4 minsane 1 George at Clug <Clug@goproject.info> - 2024-09-24 00:30 +0200
      Re: SSL/TLS debugging on MariaDB - tos minclock 4 minsane 1 Andy Smith <andy@strugglers.net> - 2024-09-24 00:50 +0200
        Re: SSL/TLS debugging on MariaDB - tos minclock 4 minsane 1 George at Clug <Clug@goproject.info> - 2024-09-24 01:50 +0200
    Re: SSL/TLS debugging on MariaDB Jeffrey Walton <noloader@gmail.com> - 2024-09-24 02:50 +0200

#273238 — SSL/TLS debugging on MariaDB

Hi

Is there a way to get  MariaDB on Bookworm to log verbosely everything 
to do with connection attempts in order to try and debug why a client 
keeps getting error  2026 SSL connection error: protocol version mismatch?

There is currently nothing being logged on the server other than:

  [Warning] Aborted connection 332 to db: 'unconnected' user: 
'unauthenticated' host: '192.168.253.231' (This connection closed 
normally without authentication)

SHOW GLOBAL VARIABLES LIKE 'tls_version'; gives TLSv1.1,TLSv1.2,TLSv1.3 
and the client is based on a relatively recent version of libmysqlclient 
so Im struggling to understand what is going wrong without some more 
detailed logging. I cant find anything in the MariaDB manual.

Thanks

Andrew

[toc] | [next] | [standalone]

#273239 — Re: SSL/TLS debugging on MariaDB - tos minclock 4 minsane 1

[Multipart message — attachments visible in raw view] — view raw

Andrew,


I was not even aware of the move from NTP to NTPsec. Thanks for
posting. I should [fully] read the release notes.

https://www.debian.org/releases/bookworm/amd64/release-notes/ch-information.en.html#changes-to-packages-that-set-the-system-clock
5.1.2. Changes to packages that set the system clock
The ntp package, which used to be the default way to set the system
clock from a Network Time Protocol (NTP) server, has been replaced by
ntpsec. 



When I did a bit of research I found this comment which seems similar
to your issue (well at least to me it does):


https://forums.debian.net/viewtopic.php?t=156136
/etc/ntpsec/ntp.conf


Re: NTPSec: no servers found error despite finding the server
#3 Post by michael_S » 2023-09-26 13:54
Solved the problem for me. The cause behind this behaviour is the
following line in /etc/ntpsec/ntp.conf
Code: Select all
tos minclock 4 minsane 3 

The option minsane 3 implies to (my understanding) that the ntpd wants
at least 3 "good" NTP servers, i.e. servers that somewhat agree. I
changed this to
Code: Select all
tos minclock 4 minsane 2 

And now it works for me with 2 NTP servers available. If you only have
a single NTP server, change this to 1 should work - but it naturally
there won't be any redundancy in there.
Last edited by michael_S on 2023-09-26 13:55, edited 1 time in total. 


https://docs.ntpsec.org/latest/miscopt.html
minsane _minsane_

    Specify the number of servers used by the selection algorithm
as the minimum to set the system clock. The default is 1 for legacy
purposes; however, for critical applications the value should be
somewhat higher (e.g. 3) but less than minclock.



Please let me know if the above solves your problem?


George.


https://docs.ntpsec.org/latest/quick.html







On Tuesday, 24-09-2024 at 06:05 Andrew Wood wrote:


Hi

Is there a way to get  MariaDB on Bookworm to log verbosely
everything 
to do with connection attempts in order to try and debug why a client 
keeps getting error  2026 SSL connection error: protocol version
mismatch?

There is currently nothing being logged on the server other than:

 [Warning] Aborted connection 332 to db: 'unconnected' user: 
'unauthenticated' host: '192.168.253.231' (This connection closed 
normally without authentication)

SHOW GLOBAL VARIABLES LIKE 'tls_version'; gives
TLSv1.1,TLSv1.2,TLSv1.3 
and the client is based on a relatively recent version of
libmysqlclient 
so Im struggling to understand what is going wrong without some more 
detailed logging. I cant find anything in the MariaDB manual.

Thanks

Andrew

[toc] | [prev] | [next] | [standalone]

#273240 — Re: SSL/TLS debugging on MariaDB - tos minclock 4 minsane 1

Hi,

You seem to have hit reply on the wrong message so this appears in a
different thread. I've attempted to stitch it back to the other thread
with a References: header, but I might have got that wrong. The other
thread started at
<trinity-844a6353-587d-4c15-9f1e-b0c8980aa93e-1727094081079@3c-app-gmx-bap51>.

On Tue, Sep 24, 2024 at 08:23:05AM +1000, George at Clug wrote:
> https://docs.ntpsec.org/latest/miscopt.html
> minsane _minsane_
> 
>     Specify the number of servers used by the selection algorithm
> as the minimum to set the system clock. The default is 1 for legacy
> purposes; however, for critical applications the value should be
> somewhat higher (e.g. 3) but less than minclock.
> 
> Please let me know if the above solves your problem?

Rather than lower minsane to 1, it would be better if OP added at least
two other servers (or used a pool, for providing the same). Although it
says that this is for "critical applications", it's basically free to do
so in most circumstances¹ and unless you do this you can't tell if the
ntp server is correct or not (with two you can't tell *which* is
correct).

Thanks,
Andy

¹ I can see why some places may have policies about not using third
  party services, but if it is that important then hopefully such places
  can justify having three local NTP clocks.

  The other thing people sometimes say to justify having only one is
  that they don't care if it's correct only that it's consistent with
  all their other stuff. However I've found in real life that I often
  want to correlate with events from outside my systems in which case
  knowing that at least my stuff was synced to a global understanding of
  time is valuable to me.

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

[toc] | [prev] | [next] | [standalone]

#273242 — Re: SSL/TLS debugging on MariaDB - tos minclock 4 minsane 1

[Multipart message — attachments visible in raw view] — view raw

Thanks Andy.


I certainly did reply to the wrong email, apologies to all.


George.



On Tuesday, 24-09-2024 at 08:43 Andy Smith wrote:


Hi,

You seem to have hit reply on the wrong message so this appears in a
different thread. I've attempted to stitch it back to the other thread
with a References: header, but I might have got that wrong. The other
thread started at

.

On Tue, Sep 24, 2024 at 08:23:05AM +1000, George at Clug wrote:
> https://docs.ntpsec.org/latest/miscopt.html
> minsane _minsane_
> 
>     Specify the number of servers used by the selection algorithm
> as the minimum to set the system clock. The default is 1 for legacy
> purposes; however, for critical applications the value should be
> somewhat higher (e.g. 3) but less than minclock.
> 
> Please let me know if the above solves your problem?

Rather than lower minsane to 1, it would be better if OP added at
least
two other servers (or used a pool, for providing the same). Although
it
says that this is for "critical applications", it's basically free to
do
so in most circumstances¹ and unless you do this you can't tell if
the
ntp server is correct or not (with two you can't tell *which* is
correct).

Thanks,
Andy

¹ I can see why some places may have policies about not using third
  party services, but if it is that important then hopefully such
places
  can justify having three local NTP clocks.

  The other thing people sometimes say to justify having only one is
  that they don't care if it's correct only that it's consistent
with
  all their other stuff. However I've found in real life that I
often
  want to correlate with events from outside my systems in which
case
  knowing that at least my stuff was synced to a global
understanding of
  time is valuable to me.

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

[toc] | [prev] | [next] | [standalone]

#273243

On Mon, Sep 23, 2024 at 7:13 PM Andrew Wood <andrewjameswood@ymail.com> wrote:
>
> Is there a way to get  MariaDB on Bookworm to log verbosely everything
> to do with connection attempts in order to try and debug why a client
> keeps getting error  2026 SSL connection error: protocol version mismatch?

I typically use OpenSSL's s_client to connect to the server. It is an
excellent debugging tool for times like this. Something like:

    openssl s_client -connect db.example.com:443 -servername db.example.com

You can also use -tls1_2 and -tls1_3 if you want to nail down a
particular version of the protocol. See
<https://docs.openssl.org/3.0/man1/openssl-s_client/> for more
options.

I suspect (and it is just a guess) that the mismatch is due to a plain
text error page being returned to the TLS client rather than a TLS
protocol message with a well formed version. That usually means a TLS
server is _not_ listening on the port you are connecting to. Rather,
just a regular server is listening (without TLS).

> There is currently nothing being logged on the server other than:
>
>   [Warning] Aborted connection 332 to db: 'unconnected' user:
> 'unauthenticated' host: '192.168.253.231' (This connection closed
> normally without authentication)
>
> SHOW GLOBAL VARIABLES LIKE 'tls_version'; gives TLSv1.1,TLSv1.2,TLSv1.3
> and the client is based on a relatively recent version of libmysqlclient
> so Im struggling to understand what is going wrong without some more
> detailed logging. I cant find anything in the MariaDB manual.

Jeff

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web