14 |
http://www.openssl.org |
http://www.openssl.org |
15 |
|
|
16 |
In many cases your operating system already has a binary version of |
In many cases your operating system already has a binary version of |
17 |
openssl. So it is ususally not necessary to install it. |
openssl. |
18 |
|
|
19 |
|
|
20 |
How do I turn on ssl support in monit: |
How do I turn on ssl support in monit: |
21 |
-------------------------------------- |
-------------------------------------- |
22 |
|
|
23 |
Monit can use ssl support in the http server and for network service |
To start monit's http server with ssl support, use the standard SET |
24 |
checks. |
HTTPD statement and add SSL ENABLE keywords. It might look like this: |
|
|
|
|
The ssl httpd server is set up as followed. You use the HTTPDS |
|
|
command instead of the HTTPD command. It might look like this: |
|
25 |
|
|
26 |
SET HTTPD PORT 2812 |
SET HTTPD PORT 2812 |
27 |
SSL ENABLE |
SSL ENABLE |
30 |
ALLOW admin:bar |
ALLOW admin:bar |
31 |
ALLOW adminscomp.network.com |
ALLOW adminscomp.network.com |
32 |
|
|
33 |
The PEMFILE command needs filename. The file holds the private key |
The PEMFILE points to a file with the server's private key and |
34 |
and the certificate (see also: Generation of a "pemfile"). |
certificate (see also: Generation of a "pemfile"). |
35 |
|
|
36 |
For the service checks you just replace the TCP token by the TCPSSL |
You may also utilize ssl to test a network connection. To do so, |
37 |
token. So checking a ssl-imap (a.k.a. imaps) service you can use |
simply replace the TCP token by the TCPSSL token. For instance, to |
38 |
e.g. the following command: |
check a web server running over ssl (https) you can use the following |
39 |
|
command: |
40 |
check process imaps with pidfile /var/run/imap.pid |
|
41 |
port 993 type tcpssl protocol imap |
check process https with pidfile /var/run/httpds.pid |
42 |
start program = "/etc/init.d/imap start" |
if failed port 443 type tcpssl protocol http then alert |
43 |
stop program = "/etc/init.d/imap stop" |
alert root@network.com |
44 |
alert root@network.com |
|
45 |
|
In addition, it's possible to check a client's certificate and only |
46 |
Additionally it is possible to enable client certificate checks. That |
allow clients with a certain certificate. This means, if a browser |
47 |
means, if a browser wants to connect to monit it needs a sufficiant |
wants to connect to monit it will need to connect using a sufficient |
48 |
certificate (and of course a key for it). This certificate is match agaist |
certificate, known by monit. The certificate obtained from the browser |
49 |
a database of certificates. This "database" file can be configured via the |
is checked against certificates in a database file. This database file |
50 |
CLIENTPEMFILE statement. It might look like this: |
can be specified via the CLIENTPEMFILE statement. It might look like |
51 |
|
this: |
52 |
|
|
53 |
SET HTTPD PORT 2812 |
SET HTTPD PORT 2812 |
54 |
SSL ENABLE |
SSL ENABLE |
55 |
PEMFILE /var/certs/monit.pem |
PEMFILE /var/certs/monit.pem |
56 |
CLIENTPEMFILE /var/certs/monit-client.pem |
CLIENTPEMFILE /var/certs/monit-client.pem |
57 |
ADDRESS localhost |
ADDRESS localhost |
58 |
ALLOW admin:bar |
ALLOW admin:bar |
59 |
ALLOW adminscomp.network.com |
ALLOW adminscomp.network.com |
60 |
|
|
61 |
This "database" inhabits all client certificates which are allowed to |
The database file mentioned in CLIENTPEMFILE contains all the client |
62 |
access the server. Additionally it holds all certificates the certificate |
certificates which are allowed to access the monit httpd server. |
63 |
authorities (CA) signing the certificates. |
|
64 |
|
A certificate may also be self-signed. Normally a self-signed |
65 |
|
certificate is not allowed, but you may explicit allow it by using the |
66 |
|
ALLOWSELFCERTIFICATION statement. |
67 |
|
|
68 |
|
If you want to switch off SSL support for a while you may replace the |
69 |
|
ENABLE keyword with DISABLE (without having to remove any other SSL |
70 |
|
statements in the monit control file). Like so: |
71 |
|
|
72 |
A certificate can also be signed itself. This case considered as an error |
SET HTTPD PORT 2812 |
73 |
and has to be allowed explicitly with the ALLOWSELFCERTIFICATION statement. |
SSL DISABLE |
74 |
|
PEMFILE /var/certs/monit.pem |
75 |
|
CLIENTPEMFILE /var/certs/monit-client.pem |
76 |
|
ALLOWSELFCERTIFICATION |
77 |
|
ADDRESS localhost |
78 |
|
ALLOW admin:bar |
79 |
|
ALLOW adminscomp.network.com |
80 |
|
|
81 |
Finally the full syntax of the "SET HTTPD" statement is as followed: |
Finally the full syntax for the "SET HTTPD" statement is as followed: |
82 |
|
|
83 |
SET HTTPD [PORT portnumber] |
SET HTTPD [PORT portnumber] |
84 |
[SSL [ENABLE|DISABLE] |
[SSL [ENABLE|DISABLE] |
85 |
PEMFILE filename |
PEMFILE filename |
86 |
[CLIENTPEMFILE filename]] |
[CLIENTPEMFILE filename]] |
87 |
|
ALLOWSELFCERTIFICATION |
88 |
ADDRESS hostname |
ADDRESS hostname |
89 |
ALLOW [user:passwd|host] |
ALLOW [user:passwd|host] |
90 |
[ALLOW ...] |
[ALLOW ...] |
91 |
|
|
92 |
|
|
93 |
|
|
94 |
How do I get my client certificate into a browser: |
How do I get my client certificate into a browser: |
95 |
-------------------------------------------------- |
-------------------------------------------------- |
96 |
|
|
97 |
Here starts the tricky part because we are dealing with a program other |
Here, the tricky part starts because we are dealing with a program |
98 |
then monit. (-: |
other then monit. (-: |
99 |
|
|
100 |
First of all it's not just the certificate you also have to provide the |
First of all, it is not just the certificate, you also have to provide |
101 |
private key of this certificate. This key SHOULD differ to the key |
the private key of this certificate. This key SHOULD differ to the key |
102 |
combination of monit's server. |
combination of monit's server. |
103 |
|
|
104 |
Anyways, you need a key with a "client" purpose (in openssl it is |
You will need a key with a "client" purpose (in openssl it is |
105 |
"nsCertType=client") or no explicit purpose. Otherwise your browser won't |
"nsCertType=client") or no explicit purpose. Otherwise your browser |
106 |
send out anything. |
won't send out anything. |
107 |
|
|
108 |
Netscape and his relatives (like Galeon or Mozilla) like to have a PKCS#12 |
Netscape and its relatives (like Galeon or Mozilla) likes to handle |
109 |
file. How do you get it? Simply use the openssl tool to convert it from |
certificates encoded with the PKCS12 format. So if you have your |
110 |
X.509: |
client certificate file PEM encoded you will need to convert it to the |
111 |
|
PKCS12 format. |
112 |
openssl pkcs12 -export -in certfile.crt \ |
|
113 |
-inkey keyfile.key \ |
So how do you convert a PEM encoded certificate to the PKCS12 format |
114 |
-out outfile.p12 \ |
and import it into your browser? Simply use the openssl tool to |
115 |
-name "Name of cert or description" |
convert it: |
116 |
|
|
117 |
In case you are using a pemfile holing certificate and private key use that |
openssl pkcs12 -export -in monit_client.pem |
118 |
file for "certfile.crt" and "keyfile.key". |
-out monit_client.p12 \ |
119 |
|
-name "Monit" |
120 |
|
|
121 |
|
Finally you must import the certificate into your browser. In mozilla |
122 |
|
you should use: Edit->Preferences->Privacy&Security, click on the |
123 |
|
Manage Certificate button and in the window that pops up, click on the |
124 |
|
Import button, then import the file monit_client.p12. |
125 |
|
|
126 |
|
|
127 |
I have turned off client certification but monit still complains: |
I have turned off client certification but monit still complains: |
128 |
----------------------------------------------------------------- |
----------------------------------------------------------------- |
129 |
|
|
130 |
If you turn of client certification but your client still sends out a |
If you turn of client certification in monit but your client is |
131 |
certificate monit will complain with an error like this: |
sending out a certificate then the monit server may complain with an |
132 |
|
error like this: |
133 |
|
|
134 |
[MET Nov 4 14:41:10] SSL VERIFY ERROR: depth=0, error=[20] |
[MET Nov 4 14:41:10] SSL VERIFY ERROR: depth=0, error=[20] |
135 |
'unable to get local issuer certificate': foo Subject |
'unable to get local issuer certificate': foo Subject |
137 |
[MET Nov 4 14:41:10] Accept with SSL service has failed! |
[MET Nov 4 14:41:10] Accept with SSL service has failed! |
138 |
[MET Nov 4 14:41:10] http server: Cannot establish SSL connection -- Error 0 |
[MET Nov 4 14:41:10] http server: Cannot establish SSL connection -- Error 0 |
139 |
|
|
140 |
That simply means that the client provided cert but isn't able to verify |
This simply means that the client provided cert but monit isn't able |
141 |
it. You can solve it by: |
to verify it. You can solve it by: |
142 |
|
|
143 |
1.) Configure your client not to send this certificate (e.g. delete it from |
1.) Configure your client not to send this certificate (e.g. delete it from |
144 |
the Netscape's "Your Certificates". |
the Netscape's "Your Certificates". |
150 |
But... but... openssl had so many problems lately: |
But... but... openssl had so many problems lately: |
151 |
-------------------------------------------------- |
-------------------------------------------------- |
152 |
|
|
153 |
Yes that's true. First of all you can of course disable all ssl |
Yes that's true. First of all, you can of course disable all ssl |
154 |
support in monit and run it without it. Just configure it with |
support in monit and run without ssl if you are in doubt. If you want |
155 |
|
to build monit without SSL support at all, just run configure with |
156 |
|
|
157 |
./configure --without-ssl |
./configure --without-ssl |
158 |
|
|
159 |
Then the world is okay again. |
If monit was already compiled with ssl support you don't need to use |
160 |
|
it if you don't want to. Simply use |
|
But if monit is already compiled with ssl support you don't need |
|
|
to use it if you don't want to. Simply use |
|
161 |
|
|
162 |
SET HTTPD PORT <port#> |
SET HTTPD PORT <port#> |
163 |
|
|
169 |
|
|
170 |
that should make it. |
that should make it. |
171 |
|
|
172 |
Anyways, for security related software it is always wise to keep it up |
And remember, for security related software it is always wise to keep |
173 |
to date. You should also keep an eye on advisories from cert and |
it up to date. You should also keep an eye on advisories from cert and |
174 |
other sources. |
other sources. |
175 |
|
|
176 |
|
|
177 |
Generation of a "pemfile": |
Generation of a "pemfile": |
178 |
-------------------------- |
-------------------------- |
179 |
|
|
180 |
First generate a openssl configuration (or if you have one use it). It |
First generate an openssl configuration (or if you have one use |
181 |
might look like this... IT IS JUST AN EXAMPLE!!!!! (-: |
it). It might look like this... IT IS JUST AN EXAMPLE!!!!! (-: |
182 |
|
|
183 |
----- BEGIN:monit.cnf ----- |
----- BEGIN:monit.cnf ----- |
184 |
# create RSA certs - Server |
# create RSA certs - Server |