<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>Thanks, Paul, for your message.</div>
<div><br>
</div>
<div>I <span style="font-weight: bold; ">did</span> update the CA cert on the hosts (and edited their configurations to point to it). The package events work GREAT across the servers!</div>
<div><br>
</div>
<div>The real trouble is with, for example, the "compare-configs-default" task (via the built-in Task Engine).</div>
<div><br>
</div>
<div>Anyone have any ideas why this is now wedged? (Some configuration file that needs a new pointer to the new cert, or where a password is wrong, for example?)</div>
<div><br>
</div>
<div>TIA,</div>
<div>Andy</div>
<div><br>
</div>
<div>PS, I'm not sure I agree with your assessment of the heartbleed vulnerability, but that's a discussion for another time and/or place. ;)</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Paul Robert Marino <<a href="mailto:prmarino1@gmail.com">prmarino1@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>"<a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a>" <<a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, April 24, 2014 7:16 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a>" <<a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Spacewalk-list] after installation of 3rd party SSL certificate, now getting (intermittent) errors!<br>
</div>
<div><br>
</div>
<div>
<div>Did you deploy the CA cert from the third party signer to the hosts as in place of the one initially deployed by spacewalk or update the /etc/sysconfig/rhn/up2date file to point to the stock copy form the 3rd party vendor deployed by the rpm included in
the distro.<br>
<br>
Also heartbleed effected a smaller number of certs than most people think essentially if the cert was generated prior to the poisonous patch its safe. Its only new certs generated by versions after the poisonous patch and or systems that haven't updated the
openssl libraries since which are vulnerable.<br>
The vast majority of production systems are reasonably safe. Further more I wouldn't worry about it that much unless your traffic goes over a public network. Essentially if someone has the access to utilize it in your internal network you have a much bigger
problem.<br>
<br>
To be clear if you are vulnerable its a huge problem especially if you deal with ecommerce, web based financial information, or data that can be used for identity theaft. But you have really look at and understand the problem before you should panic and replace
all your certs.<br>
<span style="font-family: Prelude, Verdana, san-serif; "><br>
<br>
</span><span id="signature">
<div style="font-family: arial, sans-serif; font-size: 12px;color: #999999;">-- Sent from my HP Pre3</div>
<br>
</span><span style="color: navy; font-family: Prelude, Verdana, san-serif; ">
<hr align="left" style="width:75%">
On Apr 24, 2014 14:19, Andy Ingham <<a href="mailto:andy.ingham@duke.edu">andy.ingham@duke.edu</a>> wrote:
<br>
<br>
</span>Ever since we switched from a self-signed to a third-party SSL certificate
<br>
two days ago (thank you, Heartbleed!), I've seen intermittent issues. <br>
<br>
The most obvious error: the daily 11:00 PM "compare-configs-default" task <br>
(which has always run successfully for all 70+ servers), now is failing <br>
for 98% (but not ALL!) hosts. The event message when it fails is: "This <br>
action has been picked up multiple times without a successful transaction; <br>
this action is now failed for this system." <br>
<br>
The osa-dispatcher.log and rhn_server_xmlrpc.log show LOTS of entries like <br>
rhnSQL/driver_postgresql.check_connection('ERROR', "DATABASE CONNECTION <br>
TO 'spaceschema' LOST", "Exception information: Database instance has no <br>
attribute 'dbh'") <br>
clustered around the time of the scheduled run <br>
<br>
I've done full restarts of postgres and spacewalk (and even a full reboot <br>
for good measure). <br>
<br>
Is there some reason that a cert change would lead to problems with <br>
postgres connections, or is the error above a red herring? <br>
<br>
Any ideas of where to look next? <br>
<br>
TIA, <br>
Andy <br>
<br>
Andy Ingham <br>
IT Infrastructure <br>
Fuqua School of Business <br>
Duke University <br>
<br>
<br>
<br>
<br>
_______________________________________________ <br>
Spacewalk-list mailing list <br>
<a href="mailto:Spacewalk-list@redhat.com">Spacewalk-list@redhat.com</a> <br>
<a href="https://www.redhat.com/mailman/listinfo/spacewalk-list">https://www.redhat.com/mailman/listinfo/spacewalk-list</a>
<br>
</div>
</div>
</span>
</body>
</html>