You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@ambari.apache.org by Dmitro Lisnichenko <dl...@hortonworks.com> on 2016/12/14 15:48:32 UTC
Review Request 54748: Ambari agent can't start when TLSv1 is disabled
in Java security
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/54748/
-----------------------------------------------------------
Review request for Ambari, Andrew Onischuk and Robert Levas.
Bugs: AMBARI-17666
https://issues.apache.org/jira/browse/AMBARI-17666
Repository: ambari
Description
-------
Currently, the commit for https://issues.apache.org/jira/browse/AMBARI-14236 explicit force the SSL protocol to TLSv1 in ambari-agent/src/main/python/ambari_agent/alerts/web_alert.py. Unfortunate, this setting in effect whenever web_alert pacackged is loaded (ambari-agent/src/main/python/ambari_agent/AlertSchedulerHandler.py) regardless whether ssl is used or not.
As a result, disabling TLSv1 in Ambari server will cause the agent to fail to start.
Recreate:
In Ambari's acitve JDK on Ambari server node, in java.security file, set jdk.tls.disabledAlgorithms=MD5, SSLv2, SSLv3, TLSv1, DSA, RC4, RSA keySize < 2048
restart ambari-server, and you will see errors in ambari agent logs:
ERROR 2016-07-11 15:11:15,269 NetUtil.py:84 - [Errno 8] _ssl.c:492: EOF occurred in violation of protocol
ERROR 2016-07-11 15:11:15,269 NetUtil.py:85 - SSLError: Failed to connect. Please check openssl library versions.
Refer to: https://bugzilla.redhat.com/show_bug.cgi?id=1022468 for more details.
Diffs
-----
ambari-agent/src/main/python/ambari_agent/AmbariConfig.py c3d6c39
ambari-agent/src/main/python/ambari_agent/CustomServiceOrchestrator.py 11c8cbe
ambari-agent/src/main/python/ambari_agent/NetUtil.py c3cd621
ambari-agent/src/main/python/ambari_agent/alerts/web_alert.py 6caf1d0
ambari-agent/src/test/python/ambari_agent/TestCustomServiceOrchestrator.py 5323d9a
ambari-common/src/main/python/ambari_commons/inet_utils.py b5cea75
ambari-common/src/main/python/resource_management/libraries/script/script.py 5375a53
ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/package/files/checkWebUI.py ddeb116
ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/package/scripts/params.py 25231f9
ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/package/scripts/service_check.py 737ae04
ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/package/scripts/utils.py 5997011
ambari-server/src/main/resources/stacks/BIGTOP/0.8/services/HDFS/package/scripts/params.py 49cfa86
ambari-server/src/main/resources/stacks/BIGTOP/0.8/services/HDFS/package/scripts/service_check.py 81d7ca5
Diff: https://reviews.apache.org/r/54748/diff/
Testing
-------
mvn clean test
Thanks,
Dmitro Lisnichenko
Re: Review Request 54748: Ambari agent can't start when TLSv1 is
disabled in Java security
Posted by Robert Levas <rl...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/54748/#review159161
-----------------------------------------------------------
Ship it!
Ship It!
- Robert Levas
On Dec. 14, 2016, 10:48 a.m., Dmitro Lisnichenko wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/54748/
> -----------------------------------------------------------
>
> (Updated Dec. 14, 2016, 10:48 a.m.)
>
>
> Review request for Ambari, Andrew Onischuk and Robert Levas.
>
>
> Bugs: AMBARI-17666
> https://issues.apache.org/jira/browse/AMBARI-17666
>
>
> Repository: ambari
>
>
> Description
> -------
>
> Currently, the commit for https://issues.apache.org/jira/browse/AMBARI-14236 explicit force the SSL protocol to TLSv1 in ambari-agent/src/main/python/ambari_agent/alerts/web_alert.py. Unfortunate, this setting in effect whenever web_alert pacackged is loaded (ambari-agent/src/main/python/ambari_agent/AlertSchedulerHandler.py) regardless whether ssl is used or not.
>
> As a result, disabling TLSv1 in Ambari server will cause the agent to fail to start.
>
> Recreate:
>
> In Ambari's acitve JDK on Ambari server node, in java.security file, set jdk.tls.disabledAlgorithms=MD5, SSLv2, SSLv3, TLSv1, DSA, RC4, RSA keySize < 2048
> restart ambari-server, and you will see errors in ambari agent logs:
>
> ERROR 2016-07-11 15:11:15,269 NetUtil.py:84 - [Errno 8] _ssl.c:492: EOF occurred in violation of protocol
> ERROR 2016-07-11 15:11:15,269 NetUtil.py:85 - SSLError: Failed to connect. Please check openssl library versions.
> Refer to: https://bugzilla.redhat.com/show_bug.cgi?id=1022468 for more details.
>
>
> Diffs
> -----
>
> ambari-agent/src/main/python/ambari_agent/AmbariConfig.py c3d6c39
> ambari-agent/src/main/python/ambari_agent/CustomServiceOrchestrator.py 11c8cbe
> ambari-agent/src/main/python/ambari_agent/NetUtil.py c3cd621
> ambari-agent/src/main/python/ambari_agent/alerts/web_alert.py 6caf1d0
> ambari-agent/src/test/python/ambari_agent/TestCustomServiceOrchestrator.py 5323d9a
> ambari-common/src/main/python/ambari_commons/inet_utils.py b5cea75
> ambari-common/src/main/python/resource_management/libraries/script/script.py 5375a53
> ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/package/files/checkWebUI.py ddeb116
> ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/package/scripts/params.py 25231f9
> ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/package/scripts/service_check.py 737ae04
> ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/package/scripts/utils.py 5997011
> ambari-server/src/main/resources/stacks/BIGTOP/0.8/services/HDFS/package/scripts/params.py 49cfa86
> ambari-server/src/main/resources/stacks/BIGTOP/0.8/services/HDFS/package/scripts/service_check.py 81d7ca5
>
> Diff: https://reviews.apache.org/r/54748/diff/
>
>
> Testing
> -------
>
> mvn clean test
>
>
> Thanks,
>
> Dmitro Lisnichenko
>
>