Incident: kopano-server not able to connect to kopano-search via https

[darootler]

Date Seen
Approximately 05.12.2016.

Versions
Ubuntu 16.04.1 LTS
Kopano 8.3.0-534
Apache 2.4.18
MySQL 5.7.16

Bug Description
kopano-server is not able to communicate with kopano-search over https. This worked in earlier 8.2.x versions of Kopano.

Severity
Minor

Steps to Reproduce
Create a self-signed certificate like described in the Kopano Core Administrator Manual.

Configure kopano-search to bind on https port 1238, restart the service and check for port 1238 to open:

Test if a connection could be made:

Configure kopano-server to use the https port to connect to kopano-search and restart the service:

Actual Behavior
kopano-server is not able to connect to kopano-search and only reports the following log lines, even on log_level 6:

Expected Behavior
Communication between kopano-server and kopano-search is encrypted over https and working like in earlier 8.2.x versions of Kopano.

Troubleshooting/Testing Steps Attempted
Port binding on port 238 doesn’t work, it seems that it will only bind on high ports (above 1024). Binding to port 1238 via http works and kopano-server is able to connect.

Workaround
As a workaround we could fall back to unix socket or http socket.

[fbartels]

Hello Richard,

thanks for your detailed report. Since KC-156 (ticket not public, but title is “libmapi client does not check SSL certificate subject name”) we are enforcing that the subjectAltNames and/or cn matches for ssl connections. Since you connect to “localhost” this probably fails for you. To “fix” it you need to connect to the hostname the certificate was created for.

EDIT: I also have to ask. Why do you want to use the http socket, when still running everything on the same machine? Performance-wise unix sockets outperform http sockets. See https://blog.myhro.info/2017/01/how-fast-are-unix-domain-sockets for example data.

[darootler]

Hi Felix,

i am using a self signed certificate and i think my configuration is fine:

I don’t want to use unix sockets for security reasons. It’s not mandantory for me and i am just “playing” around. But i am sure there are companies with security policies wich enforce the use of secured sockets.

Regards
Richard

[fbartels]

Hello Richard,

can you explain why you think an unauthenticated http socket could be more secure than a unix socket?

PS: please also post logs in clear text and not putty screenshots.

[darootler]

Hi Felix,

sorry i meant “i don’t want to use http sockets”. In my case using a unix socket is fine and as i said i am just playing around. But in a larger environment if the kopano-search service is installed on a different node the traffic should be encrypted using a ssl tcp socket.

Do you need more logs?

Regards
Richard

[fbartels]

I have created https://jira.kopano.io/browse/KC-454, so that we can try to reproduce this internally.

Even in large setups the usual install pattern is to run search on the same system that the server is running on. So the unix socket is indeed used in 99,9999% of all cases.

[darootler]

Hi Felix,

i see.

Just to clarify:

I submitted this thread because Kopano is offering an option wich isn’t working. This could be a bug on the software side or a configuration issue on my side. For me i virtually have no problem because i can just use a unix socket. The reason why i submitted this thread is to improve the software. Because Kopano is open source and i am very happy with it i felt reporting bugs/problems is an advantage for the Kopano staff.

Thank you for creating a ticket.

Regards
Richard

[fbartels]

Yes, it seems not to work, thats why I created the ticket. And we were also able to solve your misconception of using an http(s) socket. So win-win I would say ;-)