My failure to arrange a graceful TLS root certificate rollover with OpenVPN
Generally, what I write about here is discoveries,questions, and successes. This presents a somewhat misleading pictureof what my sysadmin work is like, so today I'm going to talk abouta TLS issue that I spent a day or two failing at recently.
(I wouldn't say that failure is a routine event in systemadministration, but sometimes you can't solve a problem, andit can happen to anyone.)
We have some OpenVPN serversfor our users, running on OpenBSD using the
TLS certificates have at least two internal representations of time
TLS certificates famously have a validity period, expressed as 'notbefore' and 'not after' times. These times can have a broad range,and there are some TLS Certificate Authority root certificates thatalready have 'not after' times relatively far in the future (as Imentioned here ). All TLS certificates,including CA root certificates, are encoded in ASN.1 . Recently I was both generatinglong-lived certificates and peering very closely into them in anattempt to figure out why my new certificates weren
The case of the very old If-Modified-Since HTTP header
Every so often I look at the top IP sources for Wandering Thoughts . Recently, I noticed that one relatively active IP was therebecause it was fetching my Atom syndication feed every few minutes,and on top of that it was always getting a HTTP 200 reply with thefull feed. Usually my assumption is that these requests aren't using HTTP conditional GET atall, but I keep looking because I might find something like theTiny Tiny RSS problem (which I cantheoretically fix Tiny Tiny RSS ).
HTTP/3 needs us (and other people) to make firewall changes
The other day, I had a little realization :
Today I realized that the growing enabling of HTTP/3 means that weneed to allow UDP 443 through our firewalls (at least outbound), notjust TCP 443. Although in the mean time, blocking it shields our usersfrom any HTTP/3 issues. (Which happen.)
Like many places, our network layout hasfirewalls in it, in fact quite a lot of them. We have a perimeterfirewall, of course, then
New versions of Bash (and readline) default to special handling of pasting into the shell (or other programs)
Our standard habit on our OpenBSD machines is to use their packagedversion of Bash as the root shell, instead of the default of OpenBSD'sversion of ksh. When I set up an OpenBSD 6.9 machine recently andstarted to paste in install steps from our standard instructions,an odd thing happened: the line I'd just pasted in was highlightedin reverse video and Bash just sat there, instead of doing anything.After some fiddling around, I discovered that I had to hit Returnin order get
Fedora co-mingles its source packages with Red Hat Enterprise Linux
In the RPM package management world, the source RPM is whatpackages are built from and the source RPM's specfile is whatdescribes how to build the binary RPMs (in addition to other packagemetadata). For a specific and relevant example, the Fedora specfilefor the kmod RPM is what says (or used to say ) that the weak-modules script should be added to the binary RPM, althoughit's not in the upstream source and this created a DKMS problem .
However, this is a somewhat
Simple use of Let's Encrypt on OpenBSD is pleasantly straightforward (as of 6.8)
For reasons beyond the scope of this entry, I recently needed toget a Let's Encrypt TLS certificate for testing on an OpenBSDmachine, which isn't something I've done before. On a relativelymodern OpenBSD (6.8), it was pleasantly straightforward and easy,with the programs necessary already installed in a full base install(which is what we normally do on our OpenBSD machines, since a fullinstall is so small).
OpenBSD's standard Let's Encrypt client is acme
I've come to like date-based names for log rotation
One of the divides in Linux distributions is how they set up logrotate ,especially including how they have logrotate name the 'rotated'copies of logs. Ubuntu (and I assume Debian) use the traditionalapproach of numbered old log files, where the most recently rotatedlog file has a .0 suffix, the next most recent has a .1 suffix, andso on back to however many versions you want to keep. A while back,Red Hat Enterprise and thus Fedora switched to date-based naming,where
It'd be useful if TLS libraries had better and more detailed error messages
For my sins, I spent some time today exploring ways to potentiallydeal with a future TLS issue we're going to have . Part ofthis involved hand-generating various TLS certificates in an eccentricsystem I didn't really understand and then trying to use them in a non-HTTPS context . Through muchof this process, I kept getting error messages to the effect of, dependingon the library that they were coming from:
depth=0, error=unsupported certificate purpose: [...]
Go 1.17 will still support the old GOPATH mode (as well as modules)
It's no secret that the Go developers want to get rid of GOPATHbased development (also known as non-modular mode). At some pointin the future, Go modules will be our only option ,as covered in their blog entry Eleven Years of Go . At the time, and even today, theGOPATH wiki page said aboutthe timing of this:
- Go 1.17 (August 2021) will remove the
GO111MODULEsetting andGOPATH [development] mode entirely