I am going to be no help here, but as a long-time sysadmin I'd just like to note that I would kill for Paul's name.

-----Original Message----- From: Root, Paul [mailto:Paul.Root at qwest.com] Sent: Wednesday, January 19, 2011 2:06 PM To: 'xymon at xymon.com' Subject: RE: [xymon] sslcert

What do your lines in hosts.cfg look like for these two servers?

Paul Root Lead Internet Systems Eng Qwest Network Services

-----Original Message----- From: dOCtoR MADneSs [mailto:doctor at makelofine.org] Sent: Wednesday, January 19, 2011 12:45 PM To: xymon at xymon.com Subject: [xymon] sslcert

Hi

My xymon server has a strange behaviour.I have a host called tata running SSLed services. The tests are all OK. But when I go to sslcert test page, I see the information from another host (called toto). Their SSL certificates are differents, and all my other hosts have their own SSL informations. The host toto is the xymon server itself, running xymon- 4.3.0-beta3 client and server. The host 'tata' is running xymon 4.2.2.

Thank for any help.

Regards, Damien

To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

This communication is the property of Qwest and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

I better going into hiding.

:-)

Paul Root Lead Internet Systems Eng Qwest Network Services

-----Original Message----- From: Rob Munsch [mailto:Munsch at phillycarshare.org] Sent: Wednesday, January 19, 2011 1:53 PM To: xymon at xymon.com Subject: RE: [xymon] sslcert

I am going to be no help here, but as a long-time sysadmin I'd just like to note that I would kill for Paul's name.

-----Original Message----- From: Root, Paul [mailto:Paul.Root at qwest.com] Sent: Wednesday, January 19, 2011 2:06 PM To: 'xymon at xymon.com' Subject: RE: [xymon] sslcert

What do your lines in hosts.cfg look like for these two servers?

Paul Root Lead Internet Systems Eng Qwest Network Services

-----Original Message----- From: dOCtoR MADneSs [mailto:doctor at makelofine.org] Sent: Wednesday, January 19, 2011 12:45 PM To: xymon at xymon.com Subject: [xymon] sslcert

Hi

My xymon server has a strange behaviour.I have a host called tata running SSLed services. The tests are all OK. But when I go to sslcert test page, I see the information from another host (called toto). Their SSL certificates are differents, and all my other hosts have their own SSL informations. The host toto is the xymon server itself, running xymon- 4.3.0-beta3 client and server. The host 'tata' is running xymon 4.2.2.

Thank for any help.

Regards, Damien

To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

This communication is the property of Qwest and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

This communication is the property of Qwest and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

That's a lot of stuff on each line. I've never done multiple URLs on a single host. What does that do for you?

I put the URL on the line of the server.

Is tata by chance the real host of one of the URLs you put on the toto line?

Paul Root Lead Internet Systems Eng Qwest Network Services

-----Original Message----- From: dOCtoR MADneSs [mailto:doctor at makelofine.org] Sent: Wednesday, January 19, 2011 2:48 PM To: xymon at xymon.com Subject: Re: [xymon] sslcert

Le 19/01/2011 20:06, Root, Paul a écrit :

What do your lines in hosts.cfg look like for these two servers? -----Original Message----- From: dOCtoR MADneSs [mailto:doctor at makelofine.org] Sent: Wednesday, January 19, 2011 12:45 PM To: xymon at xymon.com Subject: [xymon] sslcert

Hi

My xymon server has a strange behaviour.I have a host called tata running SSLed services. The tests are all OK. But when I go to sslcert test page, I see the information from another host (called toto). Their SSL certificates are differents, and all my other hosts have their own SSL informations. The host toto is the xymon server itself, running xymon-4.3.0-beta3 client and server. The host 'tata' is running xymon 4.2.2.

Thank for any help.

Regards, Damien

Here is the hosts.cfg content : 127.0.0.1 toto # bbd ftp http://wikileaks.makelofine.org https://wikileaks.makelofine.org http://www.raclo.fr http://www.pleinphares.fr http://www.xenon-tuning.fr http://www.hoodmark.fr http://www.chasseresse.com https://mailadmin.makelofine.org https://www.makelofine.org http://www.skapiso.com http://www.galey-ariege.fr http://photos.makelofine.org http://www.warcho.net https://test.makelofine.org dns=galey-ariege.fr,skapiso.com,loozah.com,manurevah.com,loloack.com,makelofine.org smtp ssh imap imaps pop3 smtps pop3s apt apache=http://localhost/server-status?auto libs bind postfix mysql hardware ntpq TRENDS:*,!la,vmstat:vmstat1|vmstat2|vmstat3|vmstat4|vmstat5,apache:apache|apache1|apache2|apache3,mysql:mysql|mysqlslow|mysqlqueries|mysqltables|mysqlopens|mysqlflush|mysqlquestions,hardware:hardware|fans|voltages,mailgraph:mailgraph-rejected|mailgraph-local|mailgraph-amavis|mailgraph-spamd|mailgraph-postgrey|mailgraph-postgrey-passed|mailgraph-loglines|mailgraph-runtime

1.2.3.4 tata # DESCR:"server:Serveur Linux" smtp imap imaps bind pop3 pop3s postfix libs TRENDS:*,inode,ntpstat,vmstat:vmstat1|vmstat2|vmstat3|vmstat4|vmstat5,disk:disk|iostat-disk|iostat-part,mailgraph:mailgraph-rejected|mailgraph-local|mailgraph-amavis|mailgraph-spamd|mailgraph-postgrey|mailgraph-postgrey-passed|mailgraph-loglines|mailgraph-runtime,mysql:mysql|mysqlslow|mysqlqueries|mysqltables|mysqlopens|mysqlflush|mysqlquestions samba ntpq ssh

To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

This communication is the property of Qwest and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

Le 20/01/2011 17:52, Xymon User in Richmond a écrit :

So, the real root top-posts. ;)

Yeah, that looks funny to me, too. Using a bb-hosts/hosts.cfg line to test URLs not on that server is probably a novel way to test external stuff and group it all together. toto's sslcert page should be showing four external certs plus the local imaps and pop3s certs. Assuming that's really all one line--I don't see any "\" escapes.

But the issue reported is with a different line. tata should be showing its imap2 and pop3s certs, unless they're the same in which case it would be listed once. I assume we're quite certain that toto and tata don't use the same pops/imaps certs.

Which certs from toto is tata reporting? Just its own pops/imaps, or all of them including the ones from the external https URLs? I assume we're quite certain that toto and tata don't use the same pops/imaps certs.

On Thu, January 20, 2011 11:10, Root, Paul wrote:

...

That's a lot of stuff on each line. I've never done multiple URLs on a single host. What does that do for you?

I put the URL on the line of the server.

Is tata by chance the real host of one of the URLs you put on the toto line?

Paul Root Lead Internet Systems Eng Qwest Network Services

-----Original Message----- From: dOCtoR MADneSs [mailto:doctor at makelofine.org] Sent: Wednesday, January 19, 2011 2:48 PM To: xymon at xymon.com Subject: Re: [xymon] sslcert

Le 19/01/2011 20:06, Root, Paul a écrit :

...

What do your lines in hosts.cfg look like for these two servers? -----Original Message----- From: dOCtoR MADneSs [mailto:doctor at makelofine.org] Sent: Wednesday, January 19, 2011 12:45 PM To: xymon at xymon.com Subject: [xymon] sslcert

Hi

My xymon server has a strange behaviour.I have a host called tata running SSLed services. The tests are all OK. But when I go to sslcert test page, I see the information from another host (called toto). Their SSL certificates are differents, and all my other hosts have their own SSL informations. The host toto is the xymon server itself, running xymon-4.3.0-beta3 client and server. The host 'tata' is running xymon 4.2.2.

Thank for any help.

Regards, Damien Here is the hosts.cfg content : 127.0.0.1 toto # bbd ftp http://wikileaks.makelofine.org https://wikileaks.makelofine.org http://www.raclo.fr http://www.pleinphares.fr http://www.xenon-tuning.fr http://www.hoodmark.fr http://www.chasseresse.com https://mailadmin.makelofine.org https://www.makelofine.org http://www.skapiso.com http://www.galey-ariege.fr http://photos.makelofine.org http://www.warcho.net https://test.makelofine.org dns=galey-ariege.fr,skapiso.com,loozah.com,manurevah.com,loloack.com,make lofine.org smtp ssh imap imaps pop3 smtps pop3s apt apache=http://localhost/server-status?auto libs bind postfix mysql hardware ntpq TRENDS:*,!la,vmstat:vmstat1|vmstat2|vmstat3|vmstat4|vmstat5,apache:apache |apache1|apache2|apache3,mysql:mysql|mysqlslow|mysqlqueries|mysqltables|m ysqlopens|mysqlflush|mysqlquestions,hardware:hardware|fans|voltages,mailg raph:mailgraph-rejected|mailgraph-local|mailgraph-amavis|mailgraph-spamd| mailgraph-postgrey|mailgraph-postgrey-passed|mailgraph-loglines|mailgraph -runtime

1.2.3.4 tata # DESCR:"server:Serveur Linux" smtp imap imaps bind pop3 pop3s postfix libs TRENDS:*,inode,ntpstat,vmstat:vmstat1|vmstat2|vmstat3|vmstat4|vmstat5,dis k:disk|iostat-disk|iostat-part,mailgraph:mailgraph-rejected|mailgraph-loc al|mailgraph-amavis|mailgraph-spamd|mailgraph-postgrey|mailgraph-postgrey -passed|mailgraph-loglines|mailgraph-runtime,mysql:mysql|mysqlslow|mysqlq ueries|mysqltables|mysqlopens|mysqlflush|mysqlquestions samba ntpq ssh

To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

This communication is the property of Qwest and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

tata reports SSL certs from toto for imaps and pop3s. Actually, tata does not run any other SSL service.

Le 20/01/2011 20:00, Xymon User in Richmond a écrit :

On Thu, January 20, 2011 12:35, dOCtoR MADneSs wrote:

...

Le 20/01/2011 17:52, Xymon User in Richmond a écrit :

...

On Thu, January 20, 2011 11:10, Root, Paul wrote:

...

That's a lot of stuff on each line. I've never done multiple URLs on a single host. What does that do for you?

I put the URL on the line of the server.

Is tata by chance the real host of one of the URLs you put on the toto line?

Paul Root Lead Internet Systems Eng Qwest Network Services

-----Original Message----- From: dOCtoR MADneSs [mailto:doctor at makelofine.org] Sent: Wednesday, January 19, 2011 2:48 PM To: xymon at xymon.com Subject: Re: [xymon] sslcert

Le 19/01/2011 20:06, Root, Paul a écrit :

...

What do your lines in hosts.cfg look like for these two servers? -----Original Message----- From: dOCtoR MADneSs [mailto:doctor at makelofine.org] Sent: Wednesday, January 19, 2011 12:45 PM To: xymon at xymon.com Subject: [xymon] sslcert

Hi

My xymon server has a strange behaviour.I have a host called tata running SSLed services. The tests are all OK. But when I go to sslcert test page, I see the information from another host (called toto). Their SSL certificates are differents, and all my other hosts have their own SSL informations. The host toto is the xymon server itself, running xymon-4.3.0-beta3 client and server. The host 'tata' is running xymon 4.2.2.

Thank for any help.

Regards, Damien Here is the hosts.cfg content : 127.0.0.1 toto # bbd ftp http://wikileaks.makelofine.org https://wikileaks.makelofine.org http://www.raclo.fr http://www.pleinphares.fr http://www.xenon-tuning.fr http://www.hoodmark.fr http://www.chasseresse.com https://mailadmin.makelofine.org https://www.makelofine.org http://www.skapiso.com http://www.galey-ariege.fr http://photos.makelofine.org http://www.warcho.net https://test.makelofine.org dns=galey-ariege.fr,skapiso.com,loozah.com,manurevah.com,loloack.com, make lofine.org smtp ssh imap imaps pop3 smtps pop3s apt apache=http://localhost/server-status?auto libs bind postfix mysql hardware ntpq TRENDS:*,!la,vmstat:vmstat1|vmstat2|vmstat3|vmstat4|vmstat5,apache:ap ache |apache1|apache2|apache3,mysql:mysql|mysqlslow|mysqlqueries|mysqltabl es|m ysqlopens|mysqlflush|mysqlquestions,hardware:hardware|fans|voltages,m ailg raph:mailgraph-rejected|mailgraph-local|mailgraph-amavis|mailgraph-sp amd| mailgraph-postgrey|mailgraph-postgrey-passed|mailgraph-loglines|mailg raph -runtime

1.2.3.4 tata # DESCR:"server:Serveur Linux" smtp imap imaps bind pop3 pop3s postfix libs TRENDS:*,inode,ntpstat,vmstat:vmstat1|vmstat2|vmstat3|vmstat4|vmstat5 ,dis k:disk|iostat-disk|iostat-part,mailgraph:mailgraph-rejected|mailgraph -loc al|mailgraph-amavis|mailgraph-spamd|mailgraph-postgrey|mailgraph-post grey -passed|mailgraph-loglines|mailgraph-runtime,mysql:mysql|mysqlslow|my sqlq ueries|mysqltables|mysqlopens|mysqlflush|mysqlquestions samba ntpq ssh

So, the real root top-posts. ;)

Yeah, that looks funny to me, too. Using a bb-hosts/hosts.cfg line to test URLs not on that server is probably a novel way to test external stuff and group it all together. toto's sslcert page should be showing four external certs plus the local imaps and pop3s certs. Assuming that's really all one line--I don't see any "\" escapes.

But the issue reported is with a different line. tata should be showing its imap2 and pop3s certs, unless they're the same in which case it would be listed once. I assume we're quite certain that toto and tata don't use the same pops/imaps certs.

Which certs from toto is tata reporting? Just its own pops/imaps, or all of them including the ones from the external https URLs? I assume we're quite certain that toto and tata don't use the same pops/imaps certs.

tata reports SSL certs from toto for imaps and pop3s. Actually, tata does not run any other SSL service.

Bottom-post to top-post and back again gets kinda weird. But I try to go with the flow (ever since one of our crustier participants unloaded on me for grousing).

The tata thing is also pretty weird. I've tried mucking around with a sandbox setup trying to replicate it, and can't find anything short of the two host names resolving to the same IP. I presume the conn data for tata is showing the correct IP for that machine?

To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

You presume right. Both toto and tata reports their own IP reported.

Le 20/01/2011 23:13, Henrik Størner a écrit :

In <4D388DCE.1080400 at makelofine.org> dOCtoR MADneSs <doctor at makelofine.org> writes:

...

You presume right. Both toto and tata reports their own IP reported. OK, we need some debug data. Could you run - on the Xymon server doing your network tests - these two commands:

xymoncmd xymonnet --debug --no-update tata toto > tt.txt 2>&1

and either post the tt.txt file, or send it directly to me if you don't want to post such data publicly ? Feel free to anonymize any IP's and/or hostnames, as long as you do so consistently - e.g. replace the first octet of all IP's with "000".

Regards, Henrik

To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

Hi,

Thank you, in looking in the debug file, I found the reason. In fact, toto points to the tata IP, because of domain... so I changed the name to FQDN and used an alias. I(ll check tomorrow night if it's OK. I ignored the fact that xymon doesn't care about IP provided in hosts.cfg hence my error.

On Thu, January 20, 2011 18:21, dOCtoR MADneSs wrote:

Le 21/01/2011 00:14, dOCtoR MADneSs a écrit :

...

Le 20/01/2011 23:13, Henrik Størner a écrit :

...

In <4D388DCE.1080400 at makelofine.org> dOCtoR MADneSs <doctor at makelofine.org> writes:

...

You presume right. Both toto and tata reports their own IP reported. OK, we need some debug data. Could you run - on the Xymon server doing your network tests - these two commands:

xymoncmd xymonnet --debug --no-update tata toto > tt.txt 2>&1

and either post the tt.txt file, or send it directly to me if you don't want to post such data publicly ? Feel free to anonymize any IP's and/or hostnames, as long as you do so consistently - e.g. replace the first octet of all IP's with "000".

Regards, Henrik

To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

Hi,

Thank you, in looking in the debug file, I found the reason. In fact, toto points to the tata IP, because of domain... so I changed the name to FQDN and used an alias. I(ll check tomorrow night if it's OK. I ignored the fact that xymon doesn't care about IP provided in hosts.cfg hence my error.

To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

I confirm that changing the host name tata to the FQDN solves the problem. Combining CLIENT: and HOST: makes everything looking like it should, and everything run fine

So, it was using the toto ip for the checks but reporting the tata ip on the conn page? How very bizarre.

In <4D374E08.8030908 at makelofine.org> dOCtoR MADneSs <doctor at makelofine.org> writes:

...

My xymon server has a strange behaviour.I have a host called tata running SSLed services. The tests are all OK. But when I go to sslcert test page, I see the information from another host (called toto). Their SSL certificates are differents, and all my other hosts have their own SSL informations.

Here is the hosts.cfg content :

I've reformatted it slightly ...

127.0.0.1 toto # bbd ftp
https://wikileaks.makelofine.org
https://mailadmin.makelofine.org
https://www.makelofine.org
https://test.makelofine.org
imaps smtps pop3s
http://wikileaks.makelofine.org
http://www.raclo.fr
http://www.pleinphares.fr
http://www.xenon-tuning.fr
http://www.hoodmark.fr
http://www.chasseresse.com
http://www.skapiso.com
http://www.galey-ariege.fr
http://photos.makelofine.org
http://www.warcho.net
apache=http://localhost/server-status?auto
dns=galey-ariege.fr,skapiso.com,loozah.com,manurevah.com,loloack.com,makelofine.org
smtp ssh imap pop3 apt
libs bind postfix mysql hardware ntpq TRENDS:*,!la,vmstat:vmstat1|vmstat2|vmstat3|vmstat4|vmstat5,apache:apache|apache1|apache2|apache3,mysql:mysql|mysqlslow|mysqlqueries|mysqltables|mysqlopens|mysqlflush|mysqlquestions,hardware:hardware|fans|voltages,mailgraph:mailgraph-rejected|mailgraph-local|mailgraph-amavis|mailgraph-spamd|mailgraph-postgrey|mailgraph-postgrey-passed|mailgraph-loglines|mailgraph-runtime

OK, so you have (at least) 7 SSL-enabled services running on one host. The effect of that is rather unpredictable - when doing the "sslcert" status, I didn't think that you would have one line in hosts.cfg with multiple (different) SSL certificates. So which of the 7 certificates will show up in the "sslcert" status is unpredictable.

It shouldn't mix certificates from different servers, though, and I have never heard of it happening. Are you sure that the DNS entries for tata and toto are completely separate ? They don't point to the same IP - or some round-robin DNS entry? (I note that both of them run "imaps", so it could be a possibility).

Xymon by default doesn't care what IP-address you've put into hosts.cfg, it will always do a DNS lookup on the hostname to determine the IP- address. So tests for the "tata" server could easily end up on "toto", if there is a hostname resolution problem. You can of course override this by adding the "testip" tag to both of those hosts in hosts.cfg.

Regards, Henrik

In <f5c836b418c685568231ab13aa6b4c2f.squirrel at epperson.homelinux.net> "Xymon User in Richmond" <hobbit at epperson.homelinux.net> writes:

On Thu, January 20, 2011 17:06, Henrik Størner wrote:

...

OK, so you have (at least) 7 SSL-enabled services running on one host. The effect of that is rather unpredictable - when doing the "sslcert" status, I didn't think that you would have one line in hosts.cfg with multiple (different) SSL certificates. So which of the 7 certificates will show up in the "sslcert" status is unpredictable.

I have hosts running both httpd ssl and imaps services, with separate certs, and it reports both certs correctly. I don't know if it will handle status correctly, though. The imaps certs are self-generated with expirations years out. IIRC, it has gone yellow on the httpd certs at the correct time. The https test precedes the imaps test on the hosts line, and the certs are stacked in that order on the sslcert page.

I stand corrected, then - apparently I did foresee that possibility :-)

Regards, Henrik

On Fri, January 21, 2011 12:17, Henrik Størner wrote:

In <f5c836b418c685568231ab13aa6b4c2f.squirrel at epperson.homelinux.net> "Xymon User in Richmond" <hobbit at epperson.homelinux.net> writes:

...

On Thu, January 20, 2011 17:06, Henrik Størner wrote:

...

OK, so you have (at least) 7 SSL-enabled services running on one host. The effect of that is rather unpredictable - when doing the "sslcert" status, I didn't think that you would have one line in hosts.cfg with multiple (different) SSL certificates. So which of the 7 certificates will show up in the "sslcert" status is unpredictable.

...

I have hosts running both httpd ssl and imaps services, with separate certs, and it reports both certs correctly. I don't know if it will handle status correctly, though. The imaps certs are self-generated with expirations years out. IIRC, it has gone yellow on the httpd certs at the correct time. The https test precedes the imaps test on the hosts line, and the certs are stacked in that order on the sslcert page.

I stand corrected, then - apparently I did foresee that possibility :-)

I understand: I often turn out to have been smarter than I realized at the time (when I'm stupid it's usually readily apparent).

I noticed overnight on a personal server that even if the httpd and imaps certs are the same one, it's reported once per service. I like that.