SSL3 support

[MichielvM]

I recently added 2 servers to my Nagios park.
When I run Nagios install they both stop on wget http:~wk2html~and so on.
I see the incoming wget request in my squid proxy server.
The Network techs have checked it and report SSLv3 is the issue.

I tried this

Code: Select all

openssl s_client -ssl3 -connect remote_server:443

output:

Code: Select all

CONNECTED(00000003)

Which tells me that SSL3 is enabled.

When I run the same command on antoher (working) server, I get this:

Code: Select all

CONNECTED(00000003)
139754014816072:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:337:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 7 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1397652021
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

I understand that SSL3 is more secure and that I "should" use it on all of them.
But for now I like to know how to disable SSL3 on these two machines..

[tmcdonald]

I'm not quite sure what you mean by "disable SSL3" on those servers. We have a FAQ about using XI with proxies: http://support.nagios.com/wiki/index.ph ... th_Proxies

If wget is using SSL3 that would be a --secure-protocol='SSLv2' flag (or whatever the config file option would be) added to the wget config script.

[MichielvM]

Well, what a week that was. Assuming this and assuming that.

Turns out that some network-tech failed to setup the firewall correctly.
Going through my local nagios networksettings, and finding nothing out of the ordinary, I decided to run a Portscan....
Only port 22 was allowed. Ran nmap command from the nagios server, same result.

Kicked some net-tech @$$ and there we go! Running like clockwork.

Excuse my ranting..

The positive side to all this is that I've learned not to assume too much and I got a better insight into networking.

[tmcdonald]

Well, glad to see it wasn't something worse.

And while we're talking about assumptions, can I assume it is safe to close this thread?

[MichielvM]

roger that!