/[monit]/monit/README.SSL
ViewVC logotype

Diff of /monit/README.SSL

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.5 by martinp, Mon Jun 9 20:32:38 2003 UTC revision 1.6 by hauk, Thu Aug 7 16:27:37 2003 UTC
# Line 14  You can get the newest version of openss Line 14  You can get the newest version of openss
14     http://www.openssl.org     http://www.openssl.org
15    
16  In many cases your operating system already has a binary version of  In many cases your operating system already has a binary version of
17  openssl.  So it is ususally not necessary to install it.  openssl.
18    
19    
20  How do I turn on ssl support in monit:  How do I turn on ssl support in monit:
21  --------------------------------------  --------------------------------------
22    
23  Monit can use ssl support in the http server and for network service  To start monit's http server with ssl support, use the standard SET
24  checks.    HTTPD statement and add SSL ENABLE keywords. It might look like this:
   
 The ssl httpd server is set up as followed. You use the HTTPDS  
 command instead of the HTTPD command.  It might look like this:  
25    
26    SET HTTPD PORT 2812    SET HTTPD PORT 2812
27        SSL ENABLE        SSL ENABLE
# Line 33  command instead of the HTTPD command.  I Line 30  command instead of the HTTPD command.  I
30        ALLOW admin:bar        ALLOW admin:bar
31        ALLOW adminscomp.network.com        ALLOW adminscomp.network.com
32    
33  The PEMFILE command needs filename.  The file holds the private key  The PEMFILE points to a file with the server's private key and
34  and the certificate (see also: Generation of a "pemfile").  certificate (see also: Generation of a "pemfile").
35    
36  For the service checks you just replace the TCP token by the TCPSSL  You may also utilize ssl to test a network connection. To do so,
37  token.  So checking a ssl-imap (a.k.a. imaps) service you can use  simply replace the TCP token by the TCPSSL token. For instance, to
38  e.g. the following command:  check a web server running over ssl (https) you can use the following
39    command:
40  check process imaps with pidfile /var/run/imap.pid  
41        port 993 type tcpssl protocol imap  check process https with pidfile /var/run/httpds.pid
42        start program = "/etc/init.d/imap start"   if failed port 443 type tcpssl protocol http then alert
43        stop program = "/etc/init.d/imap stop"   alert root@network.com
44        alert root@network.com  
45    In addition, it's possible to check a client's certificate and only
46  Additionally it is possible to enable client certificate checks.  That  allow clients with a certain certificate. This means, if a browser
47  means, if a browser wants to connect to monit it needs a sufficiant  wants to connect to monit it will need to connect using a sufficient
48  certificate (and of course a key for it).  This certificate is match agaist  certificate, known by monit. The certificate obtained from the browser
49  a database of certificates.  This "database" file can be configured via the  is checked against certificates in a database file. This database file
50  CLIENTPEMFILE statement.  It might look like this:  can be specified via the CLIENTPEMFILE statement. It might look like
51    this:
52    
53    SET HTTPD PORT 2812    SET HTTPD PORT 2812
54        SSL ENABLE        SSL ENABLE
55        PEMFILE  /var/certs/monit.pem        PEMFILE  /var/certs/monit.pem
56        CLIENTPEMFILE  /var/certs/monit-client.pem        CLIENTPEMFILE  /var/certs/monit-client.pem
57        ADDRESS localhost        ADDRESS localhost
58        ALLOW admin:bar        ALLOW admin:bar
59        ALLOW adminscomp.network.com        ALLOW adminscomp.network.com
60    
61  This "database" inhabits all client certificates which are allowed to  The database file mentioned in CLIENTPEMFILE contains all the client
62  access the server.  Additionally it holds all certificates the certificate  certificates which are allowed to access the monit httpd server.
63  authorities (CA) signing the certificates.  
64    A certificate may also be self-signed. Normally a self-signed
65    certificate is not allowed, but you may explicit allow it by using the
66    ALLOWSELFCERTIFICATION statement.
67    
68    If you want to switch off SSL support for a while you may replace the
69    ENABLE keyword with DISABLE (without having to remove any other SSL
70    statements in the monit control file). Like so:
71    
72  A certificate can also be signed itself.  This case considered as an error    SET HTTPD PORT 2812
73  and has to be allowed explicitly with the ALLOWSELFCERTIFICATION statement.        SSL DISABLE
74          PEMFILE  /var/certs/monit.pem
75          CLIENTPEMFILE  /var/certs/monit-client.pem
76          ALLOWSELFCERTIFICATION
77          ADDRESS localhost
78          ALLOW admin:bar
79          ALLOW adminscomp.network.com
80    
81  Finally the full syntax of the "SET HTTPD" statement is as followed:  Finally the full syntax for the "SET HTTPD" statement is as followed:
82    
83    SET HTTPD [PORT portnumber]    SET HTTPD [PORT portnumber]
84        [SSL [ENABLE|DISABLE]        [SSL [ENABLE|DISABLE]
85         PEMFILE filename         PEMFILE filename
86         [CLIENTPEMFILE  filename]]         [CLIENTPEMFILE  filename]]
87          ALLOWSELFCERTIFICATION
88        ADDRESS hostname        ADDRESS hostname
89        ALLOW [user:passwd|host]        ALLOW [user:passwd|host]
90        [ALLOW ...]        [ALLOW ...]
91    
92    
93    
94  How do I get my client certificate into a browser:  How do I get my client certificate into a browser:
95  --------------------------------------------------  --------------------------------------------------
96    
97  Here starts the tricky part because we are dealing with a program other  Here, the tricky part starts because we are dealing with a program
98  then monit. (-:    other then monit. (-:
99    
100  First of all it's not just the certificate you also have to provide the  First of all, it is not just the certificate, you also have to provide
101  private key of this certificate.  This key SHOULD differ to the key  the private key of this certificate. This key SHOULD differ to the key
102  combination of monit's server.  combination of monit's server.
103    
104  Anyways, you need a key with a "client" purpose (in openssl it is  You will need a key with a "client" purpose (in openssl it is
105  "nsCertType=client") or no explicit purpose.  Otherwise your browser won't  "nsCertType=client") or no explicit purpose. Otherwise your browser
106  send out anything.  won't send out anything.
107    
108  Netscape and his relatives (like Galeon or Mozilla) like to have a PKCS#12  Netscape and its relatives (like Galeon or Mozilla) likes to handle
109  file.  How do you get it?  Simply use the openssl tool to convert it from  certificates encoded with the PKCS12 format. So if you have your
110  X.509:  client certificate file PEM encoded you will need to convert it to the
111    PKCS12 format.
112  openssl pkcs12 -export -in certfile.crt \  
113                         -inkey keyfile.key \  So how do you convert a PEM encoded certificate to the PKCS12 format
114                         -out outfile.p12 \  and import it into your browser?  Simply use the openssl tool to
115                         -name "Name of cert or description"  convert it:
116    
117  In case you are using a pemfile holing certificate and private key use that  openssl pkcs12 -export -in monit_client.pem
118  file for "certfile.crt" and "keyfile.key".                         -out monit_client.p12 \
119                           -name "Monit"
120    
121    Finally you must import the certificate into your browser. In mozilla
122    you should use: Edit->Preferences->Privacy&Security, click on the
123    Manage Certificate button and in the window that pops up, click on the
124    Import button, then import the file monit_client.p12.
125    
126    
127  I have turned off client certification but monit still complains:  I have turned off client certification but monit still complains:
128  -----------------------------------------------------------------  -----------------------------------------------------------------
129    
130  If you turn of client certification but your client still sends out a  If you turn of client certification in monit but your client is
131  certificate monit will complain with an error like this:  sending out a certificate then the monit server may complain with an
132    error like this:
133    
134  [MET Nov  4 14:41:10] SSL VERIFY ERROR: depth=0, error=[20]  [MET Nov  4 14:41:10] SSL VERIFY ERROR: depth=0, error=[20]
135    'unable to get local issuer certificate': foo Subject    'unable to get local issuer certificate': foo Subject
# Line 117  certificate monit will complain with an Line 137  certificate monit will complain with an
137  [MET Nov  4 14:41:10] Accept with SSL service has failed!  [MET Nov  4 14:41:10] Accept with SSL service has failed!
138  [MET Nov  4 14:41:10] http server: Cannot establish SSL connection -- Error 0  [MET Nov  4 14:41:10] http server: Cannot establish SSL connection -- Error 0
139    
140  That simply means that the client provided cert but isn't able to verify  This simply means that the client provided cert but monit isn't able
141  it.  You can solve it by:  to verify it.  You can solve it by:
142    
143  1.) Configure your client not to send this certificate (e.g. delete it from  1.) Configure your client not to send this certificate (e.g. delete it from
144      the Netscape's "Your Certificates".      the Netscape's "Your Certificates".
# Line 130  it.  You can solve it by: Line 150  it.  You can solve it by:
150  But... but... openssl had so many problems lately:  But... but... openssl had so many problems lately:
151  --------------------------------------------------  --------------------------------------------------
152    
153  Yes that's true.  First of all you can of course disable all ssl  Yes that's true. First of all, you can of course disable all ssl
154  support in monit and run it without it.  Just configure it with  support in monit and run without ssl if you are in doubt. If you want
155    to build monit without SSL support at all, just run configure with
156    
157    ./configure --without-ssl    ./configure --without-ssl
158    
159  Then the world is okay again.  If monit was already compiled with ssl support you don't need to use
160    it if you don't want to.  Simply use
 But if monit is already compiled with ssl support you don't need  
 to use it if you don't want to.  Simply use  
161    
162    SET HTTPD PORT <port#>    SET HTTPD PORT <port#>
163    
# Line 150  instead of Line 169  instead of
169    
170  that should make it.  that should make it.
171    
172  Anyways, for security related software it is always wise to keep it up  And remember, for security related software it is always wise to keep
173  to date.  You should also keep an eye on advisories from cert and  it up to date. You should also keep an eye on advisories from cert and
174  other sources.  other sources.
175    
176    
177  Generation of a "pemfile":  Generation of a "pemfile":
178  --------------------------  --------------------------
179    
180  First generate a openssl configuration (or if you have one use it). It  First generate an openssl configuration (or if you have one use
181  might look like this... IT IS JUST AN EXAMPLE!!!!! (-:  it). It might look like this... IT IS JUST AN EXAMPLE!!!!! (-:
182    
183  ----- BEGIN:monit.cnf -----  ----- BEGIN:monit.cnf -----
184  # create RSA certs - Server  # create RSA certs - Server

Legend:
Removed from v.1.5  
changed lines
  Added in v.1.6

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26