|
From: Lars N. <lar...@gm...> - 2013-06-02 10:05:08
|
I just recently started noticing this warning message when running ddclient 3.8.1: "Using the default of SSL_verify_mode of SSL_VERIFY_NONE for client is depreciated! Please set SSL_verify_mode to SSL_VERIFY_PEER together with SSL_ca_file|SSL_ca_path for verification. If you really don't want to verify the certificate and keep the connection open to Man-In-The-Middle attacks please set SSL_verify_mode explicitly to SSL_VERIFY_NONE in your application." Currently my ddclient.conf is rather spartan: ssl=yes protocol=dyndns2 use=web, web=checkip.dyndns.com,web-skip='IP Address' server=members.dyndns.org login=zzz password='zzz' zzz.dyndns-remote.com I've looked a little in the support list archive and not noticed any solution. Also, the documentation for ddclient itself is a little sparse. What do I need to add/change in ddclient.conf to fix the warning and still use SSL? And what do I need to download from DynDNS in the way of certs and where do they get stored, if anything? Regards, /Lars |
|
From: wimpunk <wi...@us...> - 2013-06-03 06:06:23
|
Hi, On 06/02/13 12:04, Lars Noodén wrote: > I just recently started noticing this warning message when running > ddclient 3.8.1: > Please try the latest svn version. > "Using the default of SSL_verify_mode of SSL_VERIFY_NONE for client > is depreciated! Please set SSL_verify_mode to SSL_VERIFY_PEER > together with SSL_ca_file|SSL_ca_path for verification. > If you really don't want to verify the certificate and keep the > connection open to Man-In-The-Middle attacks please set > SSL_verify_mode explicitly to SSL_VERIFY_NONE in your application." > Looks like a SSL message to me. Which distribution and version of SSL are you using? > Currently my ddclient.conf is rather spartan: > > ssl=yes > protocol=dyndns2 > use=web, web=checkip.dyndns.com,web-skip='IP Address' > server=members.dyndns.org > login=zzz > password='zzz' > zzz.dyndns-remote.com > > I've looked a little in the support list archive and not noticed any > solution. Also, the documentation for ddclient itself is a little sparse. > I thought I saw this message before but it could be on a linux distribution list. Did you tried the bugreporting system of your distribution? > What do I need to add/change in ddclient.conf to fix the warning and > still use SSL? And what do I need to download from DynDNS in the way of > certs and where do they get stored, if anything? > > Regards, > /Lars > Sorry, I don't have a direct fix. Regards, wimpunk. |
|
From: wimpunk <wi...@us...> - 2013-06-03 15:17:43
|
On 06/03/13 17:02, Lars Noodén wrote: > On 6/3/13 5:49 PM, William Makowski wrote: >> I reported this back in February on the mailing list and opened a >> ticket, https://sourceforge.net/apps/trac/ddclient/ticket/76. There >> is also a temporary patch that I suggested until a more permanent >> solution can be completed. >> >> Bill > > Thanks. That's the same version I have, but the patch looks like it > turns off verification. If so, that might not be a good long term > solution. Should there be some certificates from the dynammic services > checked instead? > > Regards, > /Lars > That's why I didn't applied the patch. Maybe we could add some kind of an unsafe option to make it usable. wimpunk. |
|
From: William M. <wf...@ho...> - 2013-06-03 15:57:40
|
> On 06/03/13 17:02, Lars Noodén wrote: > > On 6/3/13 5:49 PM, William Makowski wrote: > >> I reported this back in February on the mailing list and opened a > >> ticket, https://sourceforge.net/apps/trac/ddclient/ticket/76. There > >> is also a temporary patch that I suggested until a more permanent > >> solution can be completed. > >> > >> Bill > > > > Thanks. That's the same version I have, but the patch looks like it > > turns off verification. If so, that might not be a good long term > > solution. Should there be some certificates from the dynammic services > > checked instead? > > > > Regards, > > /Lars > > > > That's why I didn't applied the patch. Maybe we could add some kind of > an unsafe option to make it usable. > Ideally it would be nice if ddclient allowed us to set SSL_verify_mode to SSL_VERIFY_PEER together with a SSL_ca_file|SSL_ca_path for verification. Currently from what I understand ddclient defaults to using SSL_VERIFY_NONE because that is how the perl module IO::Socket::SSL works. The message is coming out because the module developers plan on forcing users to explicitly set a SSL_verify_mode. Once that happens ddclient probably won't work. My patch is temporary. It explicitly sets the verify mode to SSL_VERIFY_NONE and should keep ddclient working once the perl module is changed. Long term though I think this setting should become a configuration option and allow the user to set SSL_VERIFY to PEER or NONE. NONE, however, does lead to a less secure state. > ------------------------------------------------------------------------------ > Get 100% visibility into Java/.NET code with AppDynamics Lite > It's a free troubleshooting tool designed for production > Get down to code-level detail for bottlenecks, with <2% overhead. > Download for free and get started troubleshooting in minutes. > http://p.sf.net/sfu/appdyn_d2d_ap2 > _______________________________________________ > Ddclient-support mailing list > Ddc...@li... > https://lists.sourceforge.net/lists/listinfo/ddclient-support |
|
From: William M. <wf...@ho...> - 2013-06-03 14:49:46
|
I reported this back in February on the mailing list and opened a ticket, https://sourceforge.net/apps/trac/ddclient/ticket/76. There is also a temporary patch that I suggested until a more permanent solution can be completed. Bill > Date: Mon, 3 Jun 2013 08:06:10 +0200 > From: wi...@us... > To: ddc...@li... > Subject: Re: [Ddclient-support] Fixing warning message ''Use of the default SSL_verify_mode..." > > Hi, > > On 06/02/13 12:04, Lars Noodén wrote: > > I just recently started noticing this warning message when running > > ddclient 3.8.1: > > > > Please try the latest svn version. > > > "Using the default of SSL_verify_mode of SSL_VERIFY_NONE for client > > is depreciated! Please set SSL_verify_mode to SSL_VERIFY_PEER > > together with SSL_ca_file|SSL_ca_path for verification. > > If you really don't want to verify the certificate and keep the > > connection open to Man-In-The-Middle attacks please set > > SSL_verify_mode explicitly to SSL_VERIFY_NONE in your application." > > > > Looks like a SSL message to me. Which distribution and version of SSL > are you using? > > > Currently my ddclient.conf is rather spartan: > > > > ssl=yes > > protocol=dyndns2 > > use=web, web=checkip.dyndns.com,web-skip='IP Address' > > server=members.dyndns.org > > login=zzz > > password='zzz' > > zzz.dyndns-remote.com > > > > I've looked a little in the support list archive and not noticed any > > solution. Also, the documentation for ddclient itself is a little sparse. > > > > I thought I saw this message before but it could be on a linux > distribution list. Did you tried the bugreporting system of your > distribution? > > > What do I need to add/change in ddclient.conf to fix the warning and > > still use SSL? And what do I need to download from DynDNS in the way of > > certs and where do they get stored, if anything? > > > > Regards, > > /Lars > > > > Sorry, I don't have a direct fix. > > Regards, > > wimpunk. > > ------------------------------------------------------------------------------ > Get 100% visibility into Java/.NET code with AppDynamics Lite > It's a free troubleshooting tool designed for production > Get down to code-level detail for bottlenecks, with <2% overhead. > Download for free and get started troubleshooting in minutes. > http://p.sf.net/sfu/appdyn_d2d_ap2 > _______________________________________________ > Ddclient-support mailing list > Ddc...@li... > https://lists.sourceforge.net/lists/listinfo/ddclient-support |
|
From: Lars N. <lar...@gm...> - 2013-06-03 15:02:42
|
On 6/3/13 5:49 PM, William Makowski wrote: > I reported this back in February on the mailing list and opened a > ticket, https://sourceforge.net/apps/trac/ddclient/ticket/76. There > is also a temporary patch that I suggested until a more permanent > solution can be completed. > > Bill Thanks. That's the same version I have, but the patch looks like it turns off verification. If so, that might not be a good long term solution. Should there be some certificates from the dynammic services checked instead? Regards, /Lars |
