Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rabbitmq-server fail to start after setting the cipher suites #259

Closed
wenchma opened this issue May 1, 2015 · 4 comments

Comments

Projects
None yet
3 participants
@wenchma
Copy link
Contributor

commented May 1, 2015

systemctl status rabbitmq-server

rabbitmq-server.service - RabbitMQ broker
Loaded: loaded (/usr/lib/systemd/system/rabbitmq-server.service; enabled)
Active: failed (Result: exit-code) since Wed 2015-04-29 01:09:55 EDT; 17s ago
Process: 28787 ExecStopPost=/usr/bin/rm /var/run/rabbitmq/pid (code=exited, status=0/SUCCESS)
Process: 28730 ExecStop=/usr/lib/rabbitmq/bin/rabbitmqctl stop (code=exited, status=2)
Process: 28596 ExecStartPost=/usr/lib/rabbitmq/bin/rabbitmqctl wait /var/run/rabbitmq/pid (code=exited, status=2)
Process: 28593 ExecStart=/usr/lib/rabbitmq/bin/rabbitmq-server (code=exited, status=1/FAILURE)
Process: 28538 ExecStartPre=/bin/sh -c /usr/lib/rabbitmq/bin/rabbitmqctl status > /dev/null 2>&1 (code=exited, status=2)
Main PID: 28593 (code=exited, status=1/FAILURE)

Apr 29 01:09:55 c582f1-n28-vm3.pok.stglabs.ibm.com rabbitmqctl[28730]: * epmd reports: node 'rabbit' not running at all
Apr 29 01:09:55 c582f1-n28-vm3.pok.stglabs.ibm.com rabbitmqctl[28730]: no other nodes on c582f1-n28-vm3
Apr 29 01:09:55 c582f1-n28-vm3.pok.stglabs.ibm.com rabbitmqctl[28730]: * suggestion: start the node
Apr 29 01:09:55 c582f1-n28-vm3.pok.stglabs.ibm.com rabbitmqctl[28730]: current node details:
Apr 29 01:09:55 c582f1-n28-vm3.pok.stglabs.ibm.com rabbitmqctl[28730]: - node name: 'rabbitmqctl-28730@c582f1-n28-vm3'
Apr 29 01:09:55 c582f1-n28-vm3.pok.stglabs.ibm.com rabbitmqctl[28730]: - home dir: /var/lib/rabbitmq
Apr 29 01:09:55 c582f1-n28-vm3.pok.stglabs.ibm.com rabbitmqctl[28730]: - cookie hash: kl5tp+Ye4yP52orFw/BILQ==
Apr 29 01:09:55 c582f1-n28-vm3.pok.stglabs.ibm.com systemd[1]: rabbitmq-server.service: control process exited, code=exited status=2
Apr 29 01:09:55 c582f1-n28-vm3.pok.stglabs.ibm.com systemd[1]: Failed to start RabbitMQ broker.
Apr 29 01:09:55 c582f1-n28-vm3.pok.stglabs.ibm.com systemd[1]: Unit rabbitmq-server.service entered failed state.

The /var/lib/rabbitmq/erl_crash.dump shows:

Wed Apr 29 01:09:55 2015
Slogan: could not start kernel pid (application_controller) (error in config file "/etc/rabbitmq/rabbitmq.config" (5): bad term)
System version: Erlang/OTP 17 [erts-6.2.1] [source] [64-bit] [smp:4:4] [async-threads:30] [hipe] [kernel-poll:true]

The "/etc/rabbitmq/rabbitmq.config" shows:
[
{kernel, [

]},
{ssl, [{versions, ['tlsv1.2']}]},
{rabbit, [
{ssl_listeners, [5671]},
{ssl_options, [{cacertfile,"/etc/rabbitmq/ssl/cacert.pem"},
{certfile,"/etc/rabbitmq/ssl/cert.pem"},
{keyfile,"/etc/rabbitmq/ssl/key.pem"},
{verify,verify_none},
{fail_if_no_peer_cert,false}
,{versions,['tlsv1.2']}
,{ciphers,[{ECDHE-ECDSA-AES256-SHA384},{ECDHE-RSA-AES128-SHA256},{ECDHE-ECDSA-AES256-SHA384},{ECDHE-ECDSA-AES128-SHA256}]}
]},
{tcp_listen_options, [binary, {packet,raw},
{reuseaddr,true},
{backlog,128},
{nodelay,true},
{exit_on_close,false},
{keepalive,false}]},

{default_user, <<"guest">>},
{default_pass, <<"guest">>},
{heartbeat, 580}

]}
].

I found that I set the cipher suites to {ciphers,['dhe_rsa,aes_256_cbc,sha','dhe_dss,aes_256_cbc,sha','rsa,aes_256_cbc,sha']} or
{ciphers,["ECDHE-ECDSA-AES256-SHA384", "ECDHE-RSA-AES128-SHA256", "ECDHE-ECDSA-AES256-SHA384", "ECDHE-ECDSA-AES128-SHA256"]}
rabbitmq server can work fine.
so I think we need to update the function: https://github.com/jjasghar/rabbitmq/blob/master/libraries/default.rb#L47

@michaelklishin

This comment has been minimized.

Copy link
Member

commented May 1, 2015

If you use uppercase-and-hypher cipher suite names, they must be strings or quoted: 'ECDHE-ECDSA-AES256-SHA384', not ECDHE-ECDSA-AES256-SHA384.

@michaelklishin

This comment has been minimized.

Copy link
Member

commented May 1, 2015

I'm not sure this is an issue with the cookbook, the value you've provided are not valid as far as Erlang runtime is concerned.

The cookbook could try correcting invalid inputs but it may end up being even more confusing.

@wenchma

This comment has been minimized.

Copy link
Contributor Author

commented May 1, 2015

should we change
def format_ssl_ciphers
Array(node['rabbitmq']['ssl_ciphers']).map { |n| "{#{n}}" }.join(',')
end
to
def format_ssl_ciphers
Array(node['rabbitmq']['ssl_ciphers']).map { |n| "'#{n}'" }.join(',')
end

@michaelklishin I tried your saying, it didnot work also.,

@michaelklishin

This comment has been minimized.

Copy link
Member

commented May 1, 2015

Ah, overlooked the extra curly braces. Yes, those seem unnecessary.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.