[mod-security-users] GNU_TLS Errors

[Jeremy Brock <jbrock@xt...>]

Hi all,

     I am running into the following errors in mlogc-error

[Wed Feb 06 09:35:54 2013] [4] [14730/0] Creating thread_pool.
[Wed Feb 06 09:35:54 2013] [4] [14730/0] Worker creation completed: 1f65688
[Wed Feb 06 09:35:54 2013] [4] [14730/0] Worker creation unlocking 
thread mutex.
[Wed Feb 06 09:35:54 2013] [5] [14730/1ef3170] Management thread: Last 
checkpoint was 5 seconds ago.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker thread starting.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch locking 
thread mutex.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch started.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Getting one entry from 
the queue.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch completed.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch unlocking 
thread mutex.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Processing entry.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Regular expression matched.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] STAT 
"/var/log/modsecurity/audit/20130206/20130206-0935/20130206-093544-URKUcH8AAQEAADmOVhMAAAAN" 
{uid=33; gid=33; size=11494; csize=12288; atime=1360172144237704; 
ctime=1360172144237704; mtime=1360172144237704}
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] File found (11494 bytes), 
activating cURL.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: About to connect() 
to 10.1.10.151 port 8443 (#0)
[Wed Feb 06 09:35:54 2013] [5] [14730/1f65688] CURL: Trying 10.1.10.151...
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: connected
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: Connected to 
10.1.10.151 (10.1.10.151) port 8443 (#0)
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: found 141 
certificates in /etc/ssl/certs/ca-certificates.crt
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: SSL re-using session ID
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: *gnutls_handshake() 
failed: GnuTLS internal error.*
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: Closing connection #0
[Wed Feb 06 09:35:54 2013] [2] [14730/1f65688] *Flagging server as 
errored after failure to submit entry URKUcH8AAQEAADmOVhMAAAAN (cURL 
code 35): gnutls_handshake() failed: GnuTLS internal error.*

     I did some googling and apparently openssl is recommended over 
GnuTLS but I haven't been able to find any documentation on how to 
re-compile mlogc with openssl. Can someone point me in the right direction?

     Ubuntu 10.04 x86_64

~Jeremy

-- 
--

Jeremy Brock

XtremeServices.Net
Xtreme Services, LLC

[mod-security-users] GNU_TLS Errors

[Jeremy Brock <jbrock@xt...>]

Hi all,

     I am running into the following errors in mlogc-error

[Wed Feb 06 09:35:54 2013] [4] [14730/0] Creating thread_pool.
[Wed Feb 06 09:35:54 2013] [4] [14730/0] Worker creation completed: 1f65688
[Wed Feb 06 09:35:54 2013] [4] [14730/0] Worker creation unlocking 
thread mutex.
[Wed Feb 06 09:35:54 2013] [5] [14730/1ef3170] Management thread: Last 
checkpoint was 5 seconds ago.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker thread starting.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch locking 
thread mutex.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch started.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Getting one entry from 
the queue.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch completed.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch unlocking 
thread mutex.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Processing entry.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Regular expression matched.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] STAT 
"/var/log/modsecurity/audit/20130206/20130206-0935/20130206-093544-URKUcH8AAQEAADmOVhMAAAAN" 
{uid=33; gid=33; size=11494; csize=12288; atime=1360172144237704; 
ctime=1360172144237704; mtime=1360172144237704}
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] File found (11494 bytes), 
activating cURL.
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: About to connect() 
to 10.1.10.151 port 8443 (#0)
[Wed Feb 06 09:35:54 2013] [5] [14730/1f65688] CURL: Trying 10.1.10.151...
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: connected
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: Connected to 
10.1.10.151 (10.1.10.151) port 8443 (#0)
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: found 141 
certificates in /etc/ssl/certs/ca-certificates.crt
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: SSL re-using session ID
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: *gnutls_handshake() 
failed: GnuTLS internal error.*
[Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: Closing connection #0
[Wed Feb 06 09:35:54 2013] [2] [14730/1f65688] *Flagging server as 
errored after failure to submit entry URKUcH8AAQEAADmOVhMAAAAN (cURL 
code 35): gnutls_handshake() failed: GnuTLS internal error.*

     I did some googling and apparently openssl is recommended over 
GnuTLS but I haven't been able to find any documentation on how to 
re-compile mlogc with openssl. Can someone point me in the right direction?

     Ubuntu 10.04 x86_64

~Jeremy

-- 
--

Jeremy Brock

XtremeServices.Net
Xtreme Services, LLC

Re: [mod-security-users] GNU_TLS Errors

[Christian Bockermann <chris@jw...>]

Hi Jeremy,

to what kind of server are you sending the logs to, with your mlogc?
It looks as if your mlogc has been compiled with gnutls as SSL engine. This
seemed to have caused some trouble in various cases.

Is it possible for you to re-compile mlogc with openssl?

Regards,
    Chris


Am 06.02.2013 um 18:46 schrieb Jeremy Brock <jbrock@...>:

> Hi all,
> 
>     I am running into the following errors in mlogc-error
> 
> [Wed Feb 06 09:35:54 2013] [4] [14730/0] Creating thread_pool.
> [Wed Feb 06 09:35:54 2013] [4] [14730/0] Worker creation completed: 1f65688
> [Wed Feb 06 09:35:54 2013] [4] [14730/0] Worker creation unlocking thread mutex.
> [Wed Feb 06 09:35:54 2013] [5] [14730/1ef3170] Management thread: Last checkpoint was 5 seconds ago.
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker thread starting.
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch locking thread mutex.
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch started.
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Getting one entry from the queue.
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch completed.
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch unlocking thread mutex.
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Processing entry.
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Regular expression matched.
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] STAT "/var/log/modsecurity/audit/20130206/20130206-0935/20130206-093544-URKUcH8AAQEAADmOVhMAAAAN" {uid=33; gid=33; size=11494; csize=12288; atime=1360172144237704; ctime=1360172144237704; mtime=1360172144237704}
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] File found (11494 bytes), activating cURL.
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: About to connect() to 10.1.10.151 port 8443 (#0)
> [Wed Feb 06 09:35:54 2013] [5] [14730/1f65688] CURL: Trying 10.1.10.151...
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: connected
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: Connected to 10.1.10.151 (10.1.10.151) port 8443 (#0)
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: found 141 certificates in /etc/ssl/certs/ca-certificates.crt
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: SSL re-using session ID
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: gnutls_handshake() failed: GnuTLS internal error.
> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: Closing connection #0
> [Wed Feb 06 09:35:54 2013] [2] [14730/1f65688] Flagging server as errored after failure to submit entry URKUcH8AAQEAADmOVhMAAAAN (cURL code 35): gnutls_handshake() failed: GnuTLS internal error.
> 
>     I did some googling and apparently openssl is recommended over GnuTLS but I haven't been able to find any documentation on how to re-compile mlogc with openssl. Can someone point me in the right direction?
> 
>     Ubuntu 10.04 x86_64
> 
> ~Jeremy
> 
> -- 
> --
> 
> Jeremy Brock
> 
> XtremeServices.Net
> Xtreme Services, LLC
> 
> ------------------------------------------------------------------------------
> Free Next-Gen Firewall Hardware Offer
> Buy your Sophos next-gen firewall before the end March 2013 
> and get the hardware for free! Learn more.
> http://p.sf.net/sfu/sophos-d2d-feb_______________________________________________
> mod-security-users mailing list
> mod-security-users@...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] GNU_TLS Errors

[Jeremy Brock <jbrock@xt...>]

Hello Christian,

     I am sending the logs to the latest Audit Console running on Ubuntu 
10.04 server.

     Is recompiling mlogc with openssl as simple as removing 
curl-gnutls, installing curl-openssl and re-running the ./configure; 
make; make install for modsecurity?

~Jeremy

--

Jeremy Brock

XtremeServices.Net
Xtreme Services, LLC

On 2/7/2013 6:16 AM, Christian Bockermann wrote:
> Hi Jeremy,
>
> to what kind of server are you sending the logs to, with your mlogc?
> It looks as if your mlogc has been compiled with gnutls as SSL engine. This
> seemed to have caused some trouble in various cases.
>
> Is it possible for you to re-compile mlogc with openssl?
>
> Regards,
>      Chris
>
>
> Am 06.02.2013 um 18:46 schrieb Jeremy Brock <jbrock@...>:
>
>> Hi all,
>>
>>      I am running into the following errors in mlogc-error
>>
>> [Wed Feb 06 09:35:54 2013] [4] [14730/0] Creating thread_pool.
>> [Wed Feb 06 09:35:54 2013] [4] [14730/0] Worker creation completed: 1f65688
>> [Wed Feb 06 09:35:54 2013] [4] [14730/0] Worker creation unlocking thread mutex.
>> [Wed Feb 06 09:35:54 2013] [5] [14730/1ef3170] Management thread: Last checkpoint was 5 seconds ago.
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker thread starting.
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch locking thread mutex.
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch started.
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Getting one entry from the queue.
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch completed.
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Worker fetch unlocking thread mutex.
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Processing entry.
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] Regular expression matched.
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] STAT "/var/log/modsecurity/audit/20130206/20130206-0935/20130206-093544-URKUcH8AAQEAADmOVhMAAAAN" {uid=33; gid=33; size=11494; csize=12288; atime=1360172144237704; ctime=1360172144237704; mtime=1360172144237704}
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] File found (11494 bytes), activating cURL.
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: About to connect() to 10.1.10.151 port 8443 (#0)
>> [Wed Feb 06 09:35:54 2013] [5] [14730/1f65688] CURL: Trying 10.1.10.151...
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: connected
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: Connected to 10.1.10.151 (10.1.10.151) port 8443 (#0)
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: found 141 certificates in /etc/ssl/certs/ca-certificates.crt
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: SSL re-using session ID
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: gnutls_handshake() failed: GnuTLS internal error.
>> [Wed Feb 06 09:35:54 2013] [4] [14730/1f65688] CURL: Closing connection #0
>> [Wed Feb 06 09:35:54 2013] [2] [14730/1f65688] Flagging server as errored after failure to submit entry URKUcH8AAQEAADmOVhMAAAAN (cURL code 35): gnutls_handshake() failed: GnuTLS internal error.
>>
>>      I did some googling and apparently openssl is recommended over GnuTLS but I haven't been able to find any documentation on how to re-compile mlogc with openssl. Can someone point me in the right direction?
>>
>>      Ubuntu 10.04 x86_64
>>
>> ~Jeremy
>>
>> -- 
>> --
>>
>> Jeremy Brock
>>
>> XtremeServices.Net
>> Xtreme Services, LLC
>>
>> ------------------------------------------------------------------------------
>> Free Next-Gen Firewall Hardware Offer
>> Buy your Sophos next-gen firewall before the end March 2013
>> and get the hardware for free! Learn more.
>> http://p.sf.net/sfu/sophos-d2d-feb_______________________________________________
>> mod-security-users mailing list
>> mod-security-users@...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] GNU_TLS Errors

[Christian Bockermann <chris@jw...>]

Hi Jeremy!

Am 07.02.2013 um 17:03 schrieb Jeremy Brock <jbrock@...>:
>     I am sending the logs to the latest Audit Console running on Ubuntu 
> 10.04 server.

That makes me happy :-D


>     Is recompiling mlogc with openssl as simple as removing 
> curl-gnutls, installing curl-openssl and re-running the ./configure; 
> make; make install for modsecurity?

Yes, that should do the trick. The output of ./configure should tell you
which ssl-implementation has been linked in.
There *might* be an option for configure to enforce ssl-linkage without
the need to uninstall curl-gnutls (hopefully).

Chris

Re: [mod-security-users] GNU_TLS Errors

[Jeremy Brock <jbrock@xt...>]

Hi Christian,

     I just noticed your email address, thank you for all your work on 
Audit Console!  It has made working with Modsecurity an exceptional 
experience.

     I ended up installing libcurl4-openssl-dev with aptitude which 
auto-magically removes the gnutls version.  I re-compiled modsecurity 
and noticed during the  ./configure :

checking if libcurl is at least v... yes, 7.19.7
checking if libcurl is linked with gnutls... *no*
configure: using curl v7.19.7

     Many thanks again,

~Jeremy

--

Jeremy Brock

XtremeServices.Net
Xtreme Services, LLC

On 2/7/2013 8:09 AM, Christian Bockermann wrote:
> Hi Jeremy!
>
> Am 07.02.2013 um 17:03 schrieb Jeremy Brock <jbrock@...>:
>>      I am sending the logs to the latest Audit Console running on Ubuntu
>> 10.04 server.
> That makes me happy :-D
>
>
>>      Is recompiling mlogc with openssl as simple as removing
>> curl-gnutls, installing curl-openssl and re-running the ./configure;
>> make; make install for modsecurity?
> Yes, that should do the trick. The output of ./configure should tell you
> which ssl-implementation has been linked in.
> There *might* be an option for configure to enforce ssl-linkage without
> the need to uninstall curl-gnutls (hopefully).
>
> Chris
>

Re: [mod-security-users] GNU_TLS Errors

[Josh Amishav-Zlatin <jamuse@ow...>]

On Wed, Feb 6, 2013 at 7:46 PM, Jeremy Brock <jbrock@...>wrote:

>
>     I did some googling and apparently openssl is recommended over GnuTLS
> but I haven't been able to find any documentation on how to re-compile
> mlogc with openssl. Can someone point me in the right direction?
>
>     Ubuntu 10.04 x86_64
>
>
Hi Jeremy,

While there may be a better way, have you tried simply uninstalling GnuTLS
installing openssl then recompiling ModSecurity, that will recompile mlogc
as well.

--
 - Josh


> ~Jeremy
>
> --
> --
>
> Jeremy Brock
>
> XtremeServices.Net
> Xtreme Services, LLC
>
>
>
> ------------------------------------------------------------------------------
> Free Next-Gen Firewall Hardware Offer
> Buy your Sophos next-gen firewall before the end March 2013
> and get the hardware for free! Learn more.
> http://p.sf.net/sfu/sophos-d2d-feb
> _______________________________________________
> mod-security-users mailing list
> mod-security-users@...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
>

Re: [mod-security-users] GNU_TLS Errors

[Jeremy Brock <jbrock@xt...>]

Hi Josh,

     Thank you for the response, I ended up installing 
libcurl4-openssl-dev with aptitude which auto-magically removed the 
gnutls version.  I then recompiled modsecurity and all seems well so far.

~Jeremy

--

Jeremy Brock

XtremeServices.Net
Xtreme Services, LLC

On 2/7/2013 11:35 AM, Josh Amishav-Zlatin wrote:
> On Wed, Feb 6, 2013 at 7:46 PM, Jeremy Brock 
> <jbrock@... <mailto:jbrock@...>> wrote:
>
>
>         I did some googling and apparently openssl is recommended over
>     GnuTLS but I haven't been able to find any documentation on how to
>     re-compile mlogc with openssl. Can someone point me in the right
>     direction?
>
>         Ubuntu 10.04 x86_64
>
>
> Hi Jeremy,
>
> While there may be a better way, have you tried simply uninstalling 
> GnuTLS installing openssl then recompiling ModSecurity, that will 
> recompile mlogc as well.
>
> --
>  - Josh
>
>     ~Jeremy
>
>     -- 
>     --
>
>     Jeremy Brock
>
>     XtremeServices.Net
>     Xtreme Services, LLC
>
>
>     ------------------------------------------------------------------------------
>     Free Next-Gen Firewall Hardware Offer
>     Buy your Sophos next-gen firewall before the end March 2013
>     and get the hardware for free! Learn more.
>     http://p.sf.net/sfu/sophos-d2d-feb
>     _______________________________________________
>     mod-security-users mailing list
>     mod-security-users@...
>     <mailto:mod-security-users@...>
>     https://lists.sourceforge.net/lists/listinfo/mod-security-users
>     Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>     http://www.modsecurity.org/projects/commercial/rules/
>     http://www.modsecurity.org/projects/commercial/support/
>
>